joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400020b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400020e1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1400020ff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000211b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000211d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140002159
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400021ee
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140002194
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400021ce
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400021ee
cmp rbx, rax
ja 0x1400021a0
test rbx, rbx
je 0x1400021ee
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140002630
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002654
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140002697
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140002697
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1400027c8
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400026da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002705
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400027cd
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000277a
sub eax, 1
je 0x14000277a
cmp eax, 2
jne 0x1400027c8
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1400027cd
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1400027ab
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400027c8
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400027cd
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140002be0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002ca9
cmp byte [rcx + 0x71], 0
je 0x140002ca9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002c9c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002c58
sub eax, 1
je 0x140002c5c
cmp eax, 2
jne 0x140002c9c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140002c8a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002c9c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x140003b74
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003bbe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003bbe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003bbe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003bbe
cmp dword [rcx + 0x84], 0xe
jbe 0x140003bbe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003bc0
xor al, al
add rsp, 0x28
ret
Function at 0x140002c79
Capabilities:
Resolve function by djb2 hash

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov esi, ecx
call fcn.14000430a
mov ecx, 0x5fbff0fb
call fcn.14000107d
mov rcx, qword [0x140006038]
test rcx, rcx
je 0x140002d82
mov r15, qword [rax]
mov rax, qword [0x140006040]
mov edx, 0xff
movzx r9d, word [rcx + 0x13e]
mov r10d, r9d
shl r10d, 2
mov r8, 0xffffffffffffffff
test r10, r10
je 0x140002cfa
xor r11d, r11d
cmp dword [rcx + r8*4 + 0x114], esi
setne r11b
cmova r11d, edx
inc r8
add r10, 0xfffffffffffffffc
cmp r11b, 1
je 0x140002cca
movzx r9d, r11b
test r9d, r9d
je 0x140002d0d
jmp 0x140002cfd
mov r8, r9
sub rax, 1
jb 0x140002d82
mov rcx, qword [rcx + r8*8 + 0x140]
jmp 0x140002cb4
imul rax, r8, 0x18
mov rbx, qword [rcx + rax + 0x10]
mov rdi, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x140002d39
js 0x140002d8f
mov ecx, 1
mov rdx, rdi
call fcn.140002ada
test rax, rax
je 0x140002d94
mov r14, rax
jmp 0x140002d3f
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140005e10
mov rcx, r14
call r15
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call fcn.140001194
test rbx, rbx
je 0x140002d82
lea rcx, [0x140006008]
mov edx, esi
mov r8, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp 0x140001257
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140004430
mov rcx, rdi
call fcn.140004400
int3
Function at 0x14000378e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov esi, r8d
mov r8d, edx
mov rdi, rcx
mov rcx, qword [rcx]
mov rdx, qword [rdi + 8]
call fcn.1400011e9
test rax, rax
je 0x140003855
mov rbx, qword [rax]
movsxd rax, dword [rbx + 0x3c]
mov eax, dword [rbx + rax + 0x88]
mov r15d, dword [rbx + rax + 0x1c]
mov r12d, dword [rbx + rax + 0x20]
add r12, rbx
mov r13d, dword [rbx + rax + 0x24]
add r13, rbx
add r15, rbx
mov rbp, 0xffffffffffffffff
lea r14, [rsp + 0x20]
mov ecx, dword [r12 + rbp*4 + 4]
add rcx, rbx
call fcn.1400010a7
mov r8, rdx
mov rcx, r14
mov rdx, rax
call fcn.140004eb0
cmp qword [rsp + 0x20], 0
jne 0x140003867
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
call fcn.14000386d
inc rbp
cmp eax, esi
jne 0x1400037ee
movzx eax, word [r13 + rbp*2]
mov eax, dword [r15 + rax*4]
add rbx, rax
add rdi, 0x18
mov rcx, rdi
mov edx, esi
mov r8, rbx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x140001257
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400055b0
int3

Function at 0x14000386d
Capabilities:
Hash data using djb2

Disassembly:
add rdx, rcx
mov eax, 0x1505
cmp rcx, rdx
je 0x14000390b
movzx r8d, byte [rcx]
test r8b, r8b
js 0x14000388c
inc rcx
jmp 0x140003900
mov r9d, r8d
and r9d, 0x1f
movzx r11d, byte [rcx + 1]
and r11d, 0x3f
cmp r8b, 0xdf
jbe 0x1400038e2
movzx r10d, byte [rcx + 2]
shl r11d, 6
and r10d, 0x3f
or r10d, r11d
cmp r8b, 0xf0
jb 0x1400038f2
movzx r8d, byte [rcx + 3]
and r9d, 7
shl r9d, 0x12
shl r10d, 6
and r8d, 0x3f
or r8d, r10d
or r8d, r9d
cmp r8d, 0x110000
je 0x14000390b
add rcx, 4
jmp 0x140003900
add rcx, 2
shl r9d, 6
or r9d, r11d
mov r8d, r9d
jmp 0x140003900
add rcx, 3
shl r9d, 0xc
or r10d, r9d
mov r8d, r10d
imul eax, eax, 0x21
add eax, r8d
jmp 0x140003875
ret
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and bl, byte [rdi + rdi*8]
jmp qword [rdx]
and bl, byte [rdi + rdi*8]
jmp qword [rdx]
and bl, byte [rdi + rdi*8]
jmp qword [rdx]
invalid
and bl, byte [rdi + rdi*8]
jmp qword [rcx]
invalid
and byte [rdx], bl
invalid
std
stc
jae 0x14003f707
sti
neg dword [rdx - 0x46090567]
mov ecx, 0xcdccf6f8
clc
neg al
invalid
clc
neg ch
fdivp st(0)
neg dl
invalid
stc
idiv dword [rdx + rbx*8 - 0x29610607]
stc
cld
je 0x14003f68c
sti
cld
invalid
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x43fd03]
std
add bh, byte [rdi + rdi*8 - 0x45fd03]
std
add bh, byte [rax - 0x48fd0201]
std
std
add dh, byte [rbp - 0x4cfd0203]
cld
std
add dh, byte [rcx - 0x51fd0204]
sti
std
add esi, dword [rdi - 0x5afb0001]
idiv byte [rbp]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rcx - 0x5d], al
or eax, 0xb03f27
invalid
Function at 0x14013728f
Capabilities:
Encode data using xor

Disassembly:
lea rbx, [0x14013f9d0]
lea rsp, [rsp + 8]
mov eax, 0xfd27eb04
add rax, 0x10883790
movzx eax, byte [rbp + riz]
push 0xffffffff88208f8a
xor eax, r11d
and eax, 0xff
mov eax, dword [rbx + rax*4]
shr r11d, 8
xor r11d, eax
inc rbp
ror word [rsp + 4], 0xe5
push 0xd097b13
xor r11d, 0xc2ac179a
sar byte [rsp + 5], 0x27
dec rdi
lea rsp, [rsp + 0x10]
jne 0x14013729b
mov ebx, 0xad3ad602
jmp 0x14015ea26
pop rbx
jmp 0x1401541ed

Function at 0x14015bffe
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rbp + riz]
call fcn.140159fdf
lea rbp, [rsp + rbp + 0x10]
call fcn.1401385ad
not edx
push 0xffffffff8ea51913
mov dword [r9], edx
push 0x74124d90
push 0x7922892d
call fcn.14016f9e0
lea r9, [0x14013b260]
movzx esi, byte [r8]
call fcn.14014eddc
pop rbp
rol r10b, 1
call fcn.14013d6e3
jmp 0x14012e742
or r10d, 0xa3bd8616
mov r10, qword [r9 + 8]
mov qword [rsp], 0xffffffffdd0486a9
adc r9, 0xc
xor edx, edx
test r10, r10
push 0x4eb624a7
lea rsp, [rsp + 0x10]
je 0x14014629d
push rdi
push 0xffffffffe9851a18
shr byte [rsp], 6
lea rdi, [0x1401301e0]
lea rsp, [rsp + 8]
mov r11d, 0x5b017f86
or r11, r11
movzx r11d, byte [rcx + r11 - 0x5b017f86]
xor r11d, edx
push 0xffffffff8fbd5712
and r11d, 0xff
mov r11d, dword [rdi + r11*4]
shr edx, 8
neg word [rsp + 2]
xor edx, r11d
rol qword [rsp], 0xaa
inc rcx
xor edx, 0x51988331
dec r10
lea rsp, [rsp + 8]
jne 0x14015c043
call fcn.140133c5e
Function at 0x140f8a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140f8a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f8a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f8a06f
add dl, dl
jne 0x140f8a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f8a0f6
xor eax, eax
add dl, dl
jne 0x140f8a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f8a1ad
add dl, dl
jne 0x140f8a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f8a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f8a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f8a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f8a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f8a07e
mov eax, 1
add dl, dl
jne 0x140f8a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f8a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f8a0fb
sub eax, ebx
mov ebx, 1
jne 0x140f8a14c
mov ecx, 1
add dl, dl
jne 0x140f8a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f8a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f8a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f8a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f8a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f8a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f8a15d
cmp eax, 0x7d00
jae 0x140f8a19b
cmp eax, 0x500
jb 0x140f8a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f8a07e
cmp eax, 0x7f
ja 0x140f8a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f8a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f8a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f8a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002370
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000239d
xor eax, eax
jmp 0x140002509
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400023d7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400023d7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002509
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400024fc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000241a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002445
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002501
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400024b4
sub eax, 1
je 0x1400024b4
cmp eax, 2
jne 0x1400024fc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002501
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400024e2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400024fc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002501
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400033d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002770
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002843
cmp byte [rcx + 0x71], 0
je 0x140002843
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000283f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002804
sub eax, 1
je 0x140002808
cmp eax, 2
jne 0x14000283f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400033d0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002836
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000283f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400027ec
xor al, al
jmp 0x1400027ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400033d0
add rsp, 0x60
pop rbx
ret

Function at 0x140003d58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003da2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003da2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003da2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003da2
cmp dword [rcx + 0x84], 0xe
jbe 0x140003da2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003da4
xor al, al
add rsp, 0x28
ret
Function at 0x14000877c
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
neg r10
sbb edx, edx
and edx, eax
jmp fcn.140009174

Function at 0x140008e04
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, r9d
mov rsi, r8
test r8, r8
je 0x140008e2b
and qword [r8], 0
call fcn.140008f40
mov rbx, rax
test rax, rax
je 0x140008f24
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140008f1b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140008f1b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140008f1b
mov rax, qword [0x14004fe30]
mov rbp, rdi
test rax, rax
je 0x140008e93
inc dword [rax + 0x3c8]
mov rdx, qword [0x14004fe40]
lea rcx, [r15 + rdi]
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x140008f1b
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbp
je 0x140008ef2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14004fe30]
test rax, rax
je 0x140008ee0
dec dword [rax + 0x3c8]
mov rdx, qword [0x14004fe40]
mov rcx, rdi
call qword [0x14004e008]
jmp 0x140008f24
test r15d, r15d
jle 0x140008f05
lea rcx, [rdi + rbp]
mov r8, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140008f16
mov qword [rsi], rbp
mov rax, rdi
jmp 0x140008f26
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140009174
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x14004fe64], 0
lea rsi, [0x14004fe60]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x1400091db
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x1400091a9
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x1400091a1
not ebx
mov edx, ebx
test edi, edi
jle 0x1400091fd
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x1400091e3
jmp 0x140009237
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x140009237
mov r9b, 0x23
cmp r8b, r9b
jne 0x14000921c
cmp byte [r10], r9b
jne 0x14000921c
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x14000920b
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000e46c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14004fe30]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000e4d5
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000e4e0
lea rdx, [0x140040ab4]
mov rcx, rbx
mov rdi, rax
call fcn.140008f40
mov rbx, rax
test rax, rax
je 0x14000e4d5
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret