joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [rsp + 0x18], r8b
push rsi
push rdi
push r12
push r15
sub rsp, 0x48
xor r12b, r12b
movzx r15d, r9b
mov rsi, rdx
mov rdi, rcx
test rdx, rdx
je 0x14004b5d9
cmp r9b, 0x3f
je 0x14004b5cc
cmp r9b, byte [rdx]
je 0x14004b5d9
xor al, al
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
xor ebp, ebp
mov qword [rsp + 0x88], r13
movzx r13d, byte [rsp + 0x90]
mov qword [rsp + 0x40], r14
lea r14, [0x1401291b8]
mov rbx, qword [r14]
cmp r15b, 0x3f
je 0x14004b614
cmp r15b, byte [rbx]
jne 0x14004b74b
movzx ecx, byte [rbx + 1]
lea eax, [rcx + 2]
add r12b, al
test r8b, r8b
jne 0x14004b62c
test rsi, rsi
je 0x14004b74b
cmp r13b, 0x40
jne 0x14004b665
movzx eax, byte [rbx]
lea rcx, [rsp + 0x22]
mov byte [rsp + 0x20], al
xor edx, edx
movzx eax, byte [rbx + 1]
mov byte [rsp + 0x21], al
movzx r8d, byte [rbx + 1]
call fcn.1400b5f30
cmp byte [rbx], 8
jne 0x14004b71e
mov byte [rsp + 0x22], 5
jmp 0x14004b71e
movzx eax, cl
mov rdx, rbx
add eax, 2
lea rcx, [rsp + 0x20]
movsxd r8, eax
call fcn.1400b4ef0
movzx eax, byte [rbx]
cmp al, 3
jne 0x14004b6b4
mov eax, dword [rdi + 0x21c]
shr eax, 8
mov byte [rsp + 0x2a], al
movzx eax, byte [rdi + 0x21c]
mov byte [rsp + 0x2b], al
mov eax, dword [rdi + 0x220]
shr eax, 8
mov byte [rsp + 0x2c], al
movzx eax, byte [rdi + 0x220]
mov byte [rsp + 0x2d], al
jmp 0x14004b71e
cmp al, 4
jne 0x14004b6f2
mov rcx, qword [rdi + 0x210]
mov eax, 0xffffff
cmp rcx, rax
cmova rcx, rax
mov rax, rcx
mov byte [rsp + 0x24], cl
shr rax, 0x10
mov byte [rsp + 0x22], al
mov rax, rcx
shr rax, 8
mov byte [rsp + 0x23], al
movzx eax, byte [rdi + 0x218]
mov byte [rsp + 0x25], al
jmp 0x14004b71e
cmp al, 8
jne 0x14004b71e
test r13b, r13b
jne 0x14004b71e
movzx eax, byte [rsp + 0x22]
cmp byte [rdi + 0x231], r13b
je 0x14004b70f
or al, 1
mov byte [rsp + 0x22], al
cmp byte [rdi + 0x232], 0
je 0x14004b71e
or al, 4
mov byte [rsp + 0x22], al
test rsi, rsi
jne 0x14004b75a
movzx r8d, byte [rsp + 0x21]
lea rdx, [rsp + 0x20]
add r8d, 2
mov rcx, rdi
call fcn.140049780
test al, al
je 0x14004b7d5
movzx r8d, byte [rsp + 0x80]
inc ebp
add r14, 8
cmp ebp, 4
jb 0x14004b602
test r12b, r12b
je 0x14004b777
test rsi, rsi
je 0x14004b777
movzx ecx, byte [rsi + 1]
movzx r8d, r12b
lea eax, [r8 - 2]
cmp ecx, eax
je 0x14004b79d
xor r12b, r12b
movzx eax, r12b
mov r13, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rsi
ret
mov ecx, 2
cmp r8d, ecx
jbe 0x14004b777
movzx r9d, byte [rsp + 0x20]
nop dword [rax]
mov eax, ecx
movzx edx, byte [rax + rsi]
xor dl, byte [rsp + rax + 0x20]
je 0x14004b7cc
cmp r9b, 8
jne 0x14004b7d5
cmp ecx, 2
jne 0x14004b7d5
test dl, 0xfa
jne 0x14004b7d5
inc ecx
cmp ecx, r8d
jb 0x14004b7b0
jmp 0x14004b777
xor al, al
jmp 0x14004b77b
Function at 0x14004be70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r14d, edx
mov rsi, rcx
test edx, edx
je 0x14004c071
lea r12, [0x1401291b8]
mov r15d, 0xffffff
nop dword [rax]
cmp r14d, 2
jb 0x14004c096
mov r8d, 2
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140049710
test al, al
je 0x14004c096
movzx ecx, byte [rsp + 0x39]
lea eax, [r14 - 2]
mov r8d, ecx
cmp eax, ecx
jb 0x14004c096
cmp cl, 0x16
ja 0x14004c092
lea rdx, [rsp + 0x3a]
mov rcx, rsi
call fcn.140049710
test al, al
je 0x14004c096
movzx ebp, byte [rsp + 0x38]
xor dil, dil
cmp bpl, 0x3f
je 0x14004c03a
xor ecx, ecx
mov rax, r12
nop
mov rbx, qword [rax]
cmp bpl, byte [rbx]
je 0x14004bf38
inc ecx
add rax, 8
cmp ecx, 4
jb 0x14004bf20
jmp 0x14004c03d
movzx eax, byte [rbx + 1]
lea rcx, [rsp + 0x20]
mov rdx, rbx
lea edi, [rax + 2]
add eax, 2
movsxd r8, eax
call fcn.1400b4ef0
movzx eax, byte [rbx]
cmp al, 3
jne 0x14004bf8b
mov eax, dword [rsi + 0x21c]
shr eax, 8
mov byte [rsp + 0x2a], al
movzx eax, byte [rsi + 0x21c]
mov byte [rsp + 0x2b], al
mov eax, dword [rsi + 0x220]
shr eax, 8
mov byte [rsp + 0x2c], al
movzx eax, byte [rsi + 0x220]
mov byte [rsp + 0x2d], al
jmp 0x14004bfeb
cmp al, 4
jne 0x14004bfc4
mov rcx, qword [rsi + 0x210]
cmp rcx, r15
cmova rcx, r15
mov rax, rcx
mov byte [rsp + 0x24], cl
shr rax, 0x10
mov byte [rsp + 0x22], al
mov rax, rcx
shr rax, 8
mov byte [rsp + 0x23], al
movzx eax, byte [rsi + 0x218]
mov byte [rsp + 0x25], al
jmp 0x14004bfeb
cmp al, 8
jne 0x14004bfeb
cmp byte [rsi + 0x231], 0
movzx eax, byte [rsp + 0x22]
je 0x14004bfdc
or al, 1
mov byte [rsp + 0x22], al
cmp byte [rsi + 0x232], 0
je 0x14004bfeb
or al, 4
mov byte [rsp + 0x22], al
test dil, dil
je 0x14004c03d
movzx eax, byte [rsp + 0x39]
movzx r8d, dil
lea ecx, [r8 - 2]
cmp eax, ecx
jne 0x14004c03a
mov eax, 2
cmp r8d, eax
jbe 0x14004c03d
movzx r9d, byte [rsp + 0x20]
xor ecx, ecx
movzx edx, byte [rsp + rcx + 0x22]
xor dl, byte [rsp + rcx + 0x3a]
je 0x14004c02e
cmp r9b, 8
jne 0x14004c03a
cmp eax, 2
jne 0x14004c03a
test dl, 0xfa
jne 0x14004c03a
inc eax
inc rcx
cmp eax, r8d
jb 0x14004c013
jmp 0x14004c03d
xor dil, dil
movzx edx, dil
test dil, dil
je 0x14004c092
cmp bpl, 8
jne 0x14004c068
movzx ecx, byte [rsp + 0x3a]
movzx eax, cl
shr cl, 2
and al, 1
and cl, 1
mov byte [rsi + 0x231], al
mov byte [rsi + 0x232], cl
sub r14d, edx
jne 0x14004beb0
xor al, al
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov al, 0x26
jmp 0x14004c073
mov al, 0x1a
jmp 0x14004c073
Function at 0x140059ad0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rdx + 8], 0
mov rbx, r8
mov rcx, qword [rdx]
je 0x140059af2
mov rax, qword [rdx + 0x28]
mov qword [r8], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140059b11
mov rax, qword [rsp + 0x38]
mov qword [rbx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x20
pop rbx
ret
Function at 0x140059b20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
cmp qword [rdx + 8], 0
mov rdi, r9
mov r11, qword [rdx]
mov r13, r8
mov qword [rsp + 0x30], r11
mov rbx, rdx
je 0x140059cca
cmp r9, 0xffffffffffffffff
jne 0x140059b62
mov rdi, qword [rdx + 0x30]
mov r12, qword [rsp + 0x98]
xor r14d, r14d
test r12, r12
je 0x140059b76
mov dword [r12], r14d
mov rcx, qword [rdx + 0x28]
cmp rdi, rcx
jae 0x140059d31
mov ebp, dword [rsp + 0x90]
sub rcx, rdi
cmp rbp, rcx
cmova ebp, ecx
test ebp, ebp
je 0x140059d31
nop dword [rax + rax]
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x140059bf8
mov rcx, qword [rbx + 0x18]
cmp rdi, rcx
jb 0x140059bf8
add rax, rcx
cmp rdi, rax
jae 0x140059bf8
mov esi, dword [rbx + 0x20]
mov rdx, qword [rbx + 8]
sub esi, edi
add esi, ecx
cmp esi, ebp
cmova esi, ebp
sub rdx, rcx
add rdx, rdi
mov r8d, esi
mov rcx, r13
mov r15d, esi
call fcn.1400b4ef0
test r12, r12
je 0x140059be7
add dword [r12], esi
add rdi, r15
add r13, r15
mov qword [rbx + 0x30], rdi
sub ebp, esi
jmp 0x140059cb5
mov r9d, dword [rbx + 0x14]
mov rdx, rdi
mov ecx, dword [rbx + 0x10]
mov r15, qword [rbx + 8]
mov qword [rbx + 0x20], r14
lea r10d, [r9 - 1]
mov dword [rsp + 0x78], r14d
mov r8d, r10d
not r10d
and r8d, edi
sub ecx, r8d
mov eax, r8d
sub rdx, rax
cmp ecx, ebp
mov qword [rbx + 0x18], rdx
lea eax, [r9 + r8]
cmova ecx, ebp
lea esi, [rcx - 1]
add esi, eax
and esi, r10d
cmp rdx, 0xffffffffffffffff
je 0x140059c58
xor r9d, r9d
xor r8d, r8d
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140059c75
mov r11, qword [rsp + 0x30]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], r14
mov r8d, esi
mov rdx, r15
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140059c83
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140059d34
mov edx, dword [rsp + 0x78]
cmp edx, esi
je 0x140059caf
mov rcx, qword [rbx + 0x28]
sub rcx, qword [rbx + 0x18]
cmp rdx, rcx
jne 0x140059cc3
cmp edx, esi
jae 0x140059caf
mov ecx, edx
mov r8d, esi
add rcx, qword [rbx + 8]
sub r8d, edx
xor edx, edx
call fcn.1400b5f30
mov eax, esi
mov qword [rbx + 0x20], rax
test ebp, ebp
je 0x140059d31
mov r11, qword [rsp + 0x30]
jmp 0x140059ba0
mov eax, 0x1e
jmp 0x140059d34
xor r14d, r14d
mov dword [rsp + 0x78], r14d
cmp r9, 0xffffffffffffffff
je 0x140059cf3
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140059d15
mov r11, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x90]
lea r9, [rsp + 0x78]
mov rdx, r13
mov qword [rsp + 0x20], r14
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140059d1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x140059d31
mov eax, dword [rsp + 0x78]
mov dword [rcx], eax
mov eax, r14d
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14005bb90
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x450
mov rax, qword [0x14012dcd0]
xor rax, rsp
mov qword [rsp + 0x440], rax
or rbx, 0xffffffffffffffff
mov rsi, rdx
mov rbp, rcx
mov edi, 0x104
test rcx, rcx
je 0x14005bc38
mov rdx, rcx
mov r8d, edi
lea rcx, [rsp + 0x20]
call fcn.1400bcf60
lea rcx, [rsp + 0x20]
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14005bbe0
test rax, rax
je 0x14005bc1b
movzx ecx, word [rsp + rax*2 + 0x1e]
cmp cx, 0x2f
je 0x14005bc00
cmp cx, 0x5c
jne 0x14005bc1b
lea rax, [rax*2 - 2]
cmp rax, 0x208
jae 0x14005bd56
xor ecx, ecx
mov word [rsp + rax + 0x20], cx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005bc38
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rsi]
test ax, ax
je 0x14005bd33
mov rdx, rsi
mov rcx, rsi
nop word [rax + rax]
cmp ax, 0x2f
je 0x14005bc5c
cmp ax, 0x5c
jne 0x14005bc5f
mov rdx, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14005bc50
cmp rdx, rsi
je 0x14005bcb1
sub rdx, rsi
lea rcx, [rsp + 0x20]
sar rdx, 1
lea rdi, [rdx + rdx]
mov rdx, rsi
mov r8, rdi
call fcn.1400b4ef0
cmp rdi, 0x208
jae 0x14005bd5c
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov word [rsp + rdi + 0x20], ax
call fcn.14005bb90
mov edi, 0x104
xor eax, eax
mov word [rsp + 0x230], ax
test rbp, rbp
je 0x14005bcd3
mov r8, rdi
lea rcx, [rsp + 0x230]
mov rdx, rbp
call fcn.1400bcf60
xor ebp, ebp
lea rax, [rsp + 0x230]
mov word [rsp + 0x436], bp
inc rbx
cmp word [rax + rbx*2], bp
jne 0x14005bce5
sub rdi, rbx
lea rcx, [rsp + 0x230]
lea rcx, [rcx + rbx*2]
mov r8, rdi
mov rdx, rsi
call fcn.1400bcf60
lea rcx, [rsp + 0x230]
mov word [rsp + 0x436], bp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14005bd33
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400af8c0
mov rbx, qword [rsp + 0x480]
add rsp, 0x450
pop rdi
pop rsi
pop rbp
ret
call fcn.1400af23c
int3
call fcn.1400af23c
int3
Function at 0x14005c450
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r9d
mov r14, r8
mov rbp, rdx
mov rdi, rcx
jne 0x14005c53b
cmp dword [rcx + 8], 0xffffffff
jne 0x14005c53b
lea rdx, [rcx + 0x250]
mov qword [rsp + 0x48], rbx
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rdi + rax*2 + 0x252], 0
lea rax, [rax + 1]
jne 0x14005c4a0
movzx ecx, word [rdi + rax*2 + 0x24e]
xor ebx, ebx
cmp cx, 0x5c
je 0x14005c4d0
cmp cx, 0x2f
je 0x14005c4d0
mov dword [rdi + rax*2 + 0x250], 0x2f
cmp esi, 1
jne 0x14005c503
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x14005c503
mov eax, 0x2000000
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
lea r9, [rsp + 0x40]
mov r8d, esi
mov rdx, r14
mov rcx, rbp
call fcn.14005f200
test rax, rax
jne 0x14005c521
mov eax, dword [rsp + 0x40]
jmp 0x14005c4f0
mov rcx, rax
call fcn.14005fac0
test rax, rax
mov qword [rdi], rax
mov ecx, 0x200
cmove ebx, ecx
mov eax, ebx
jmp 0x14005c4f0
mov eax, 0x1000000
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14005f3a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, r9
imul edi, edx
mov rsi, rdx
cmp byte [r9], 0
mov r10, rcx
je 0x14005f3f0
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x48]
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14005f3ea
mov byte [rbx + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x14005f44c
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
lea eax, [rdx + rdi]
cmp eax, ecx
jbe 0x14005f403
sub ecx, edx
mov edi, ecx
mov rcx, qword [r9 + 0x30]
test rcx, rcx
je 0x14005f438
mov r9, rdx
mov dword [rsp + 0x48], 0
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x28], rdx
mov r8, r10
mov rdx, qword [rbx + 8]
mov dword [rsp + 0x20], edi
call qword [rax + 0x10]
mov edi, dword [rsp + 0x48]
jmp 0x14005f447
add rdx, qword [r9 + 0x20]
mov rcx, r10
mov r8d, edi
call fcn.1400b4ef0
add dword [rbx + 0x2c], edi
mov eax, edi
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14005f540
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x14005f556
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
lea rbx, [0x1400e44a0]
not ecx
cmp r10d, 8
jb 0x14005f648
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r10d, 0xfffffff8
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 + 7]
add r9, 8
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
sub r11, 1
jne 0x14005f580
test r10d, r10d
je 0x14005f670
nop dword [rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
add r10d, 0xffffffff
jne 0x14005f650
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x14005f890
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14005f8ae
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
cmp dword [rcx + 0x1c], 0
je 0x14005f8a2
cmp qword [rcx + 0x80], 0
je 0x14005f8c3
call fcn.14005f6f0
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.1400600a0
test eax, eax
je 0x14005f8ea
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call fcn.1400b79e8
mov rbx, rax
test rax, rax
jne 0x14005f910
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call fcn.1400b79e8
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
test rax, rax
jne 0x14005f956
mov rcx, rbx
call fcn.1400b79e0
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov dword [rbx + 0x64], ebp
mov ecx, ebp
cmp dword [rdi + 0x38], ecx
mov eax, dword [rdi + 0x40]
mov dword [rbx + 0x78], eax
sete cl
mov dword [rbx + 0x74], ebp
mov eax, dword [rdi + 0x38]
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x24], ebp
test ecx, ecx
jne 0x14005f9ad
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.14005d670
test eax, eax
jne 0x14005f9ad
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
movzx eax, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x14005f9d8
movzx eax, byte [rdi + 0x3d]
jmp 0x14005f9dc
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
movzx eax, byte [rbx + 0x98]
neg al
sbb ecx, ecx
and ecx, 0xc
mov dword [rbx + 0xa8], ecx
mov dword [rbx + 0x9c], 0x12345678
mov dword [rbx + 0xa0], 0x23456789
mov dword [rbx + 0xa4], 0x34567890
test rsi, rsi
je 0x14005fa87
lea r8, [0x1400e44a0]
movzx eax, byte [rsi]
test al, al
je 0x14005fa87
mov ecx, dword [rbx + 0x9c]
xor rcx, rax
mov eax, dword [rbx + 0x9c]
movzx edx, cl
shr eax, 8
mov ecx, dword [r8 + rdx*4]
mov edx, dword [rbx + 0xa4]
xor ecx, eax
movzx eax, cl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0xa0], ecx
movzx eax, byte [rbx + 0xa3]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [rbx + 0xa4], eax
add rsi, 1
jne 0x14005fa20
mov ecx, dword [rdi + 0x7c]
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x10], ebp
add eax, 0x1e
mov rbp, qword [rsp + 0x20]
add ecx, eax
mov dword [rbx + 0x60], ecx
xor eax, eax
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140060a80
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
cmp byte [rcx], 0
mov rsi, rdx
mov rbx, rcx
mov edi, 1
je 0x140060ac6
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140060ac0
mov byte [rbx + 0x10], dil
mov eax, dword [rsp + 0x68]
jmp 0x140060b24
mov edx, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rdx + 1]
cmp eax, ecx
jbe 0x140060ad7
mov edi, ecx
sub edi, edx
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140060b0e
mov r9, rdx
mov dword [rsp + 0x60], 0
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x28], rdx
lea r8, [rsp + 0x50]
mov rdx, qword [rbx + 8]
mov dword [rsp + 0x20], edi
call qword [rax + 0x10]
mov edi, dword [rsp + 0x60]
jmp 0x140060b1f
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x50]
mov r8d, edi
call fcn.1400b4ef0
add dword [rbx + 0x2c], edi
mov eax, edi
cmp eax, 1
jne 0x140060b3a
movzx eax, byte [rsp + 0x50]
mov dword [rsi], eax
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbx], 0
je 0x140060b30
cmp byte [rbx + 0x10], 0
je 0x140060b30
or eax, 0xffffffff
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x140060c30
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx + 8]
mov r10, rcx
mov r8d, r9d
movzx r11d, dl
mov edx, dword [rcx]
and r8d, 0xfffd
or r8d, 2
mov ecx, edx
mov eax, r8d
shr edx, 8
xor eax, 1
imul eax, r8d
lea r8, [0x1400e44a0]
shr eax, 8
xor r11b, al
movsx rax, r11b
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
add eax, dword [r10 + 4]
mov dword [r10], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [r10 + 4], ecx
movzx eax, byte [r10 + 7]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, dword [r8 + rcx*4]
xor eax, r9d
mov dword [r10 + 8], eax
movzx eax, r11b
ret

Function at 0x1400667c0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
cmp qword [rcx + 8], 0
mov rdi, rdx
mov rbx, rcx
jne 0x140066841
mov rcx, qword [rcx + 0x38]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x58], rsi
lea r8d, [r9 + 1]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14006683c
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [rsp + 0x50]
mov ecx, eax
shl rdx, 0x20
add rdx, rcx
mov rcx, rsi
mov qword [rbx + 8], rdx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x58]
mov rax, qword [rbx + 8]
mov rbx, qword [rsp + 0x60]
mov qword [rdi], rax
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x140071810
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x140132f4c], 0
lea rax, vtable.CLargeMem.0
mov qword [rcx], rax
mov rbx, rcx
jne 0x140071872
lea rcx, [0x140132f10]
mov byte [0x140132f4c], 1
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x140132f14]
xor edx, edx
shr eax, 9
mov ecx, 1
mov dword [0x140132f40], eax
mov eax, 0x100000
div dword [0x140132f14]
mov dword [0x140132f44], eax
call fcn.140071cc0
mov dword [0x140132f48], eax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140073390
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x58
cmp dword [0x14012a128], 0
mov ebx, edx
mov rdi, rcx
je 0x1400733c8
lea rcx, [0x140132f58]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x140132f88], 0
jne 0x1400733d1
lea rcx, [0x140132f58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
add rsp, 0x58
pop rdi
pop rbx
ret
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x50], r14
call fcn.1400735f0
mov r8, qword [0x140132f80]
mov ebp, 0x140
cmp ebx, ebp
cmovg ebx, ebp
xor r14d, r14d
movsxd rsi, ebx
mov r9d, r14d
test ebx, ebx
jle 0x140073432
mov edx, dword [0x140132f90]
nop dword [rax]
movsxd rax, edx
inc edx
cmp edx, ebp
cmove edx, r14d
movzx ecx, byte [rax + r8]
mov byte [r9 + rdi], cl
inc r9
cmp r9, rsi
jl 0x140073410
mov dword [0x140132f90], edx
movdqa xmm1, xmmword [0x1400df540]
mov eax, 0xa
nop
movdqu xmm0, xmmword [r8]
lea r8, [r8 + 0x20]
pandn xmm0, xmm1
movdqu xmmword [r8 - 0x20], xmm0
movdqu xmm0, xmmword [r8 - 0x10]
pandn xmm0, xmm1
movdqu xmmword [r8 - 0x10], xmm0
sub rax, 1
jne 0x140073440
mov ebx, dword [0x140132f8c]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x38]
mov rcx, rax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov edx, 8
lea rcx, [rsp + 0x88]
call fcn.140073680
mov edx, 8
lea rcx, [rsp + 0x30]
call fcn.140073680
mov edx, 8
lea rcx, [rsp + 0x38]
call fcn.140073680
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.140073680
call fcn.1400738d0
mov dword [0x140132f8c], ebx
test rsi, rsi
jle 0x140073523
mov r8, qword [0x140132f80]
mov eax, dword [0x140132f90]
nop word [rax + rax]
movsxd rcx, eax
lea rdi, [rdi + 1]
inc eax
movzx edx, byte [rcx + r8]
xor byte [rdi - 1], dl
cmp eax, ebp
cmove eax, r14d
sub rsi, 1
jne 0x140073500
mov dword [0x140132f90], eax
lea rcx, [0x140132f58]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rsp + 0x50]
mov eax, 1
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x58
pop rdi
pop rbx
ret