joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001a4ca
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001a4c0
cmp r11, r10
ja 0x14001a563
cmp r10, rdx
ja 0x14001a577
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14001a4c2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001a4a0
jmp 0x14001a537
ja 0x14001a4ca
mov r11, r10
cmp rax, r8
jne 0x14001a472
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001a53b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001a510
mov r8, r10
sub ecx, r9d
jns 0x14001a52e
jmp 0x14001a53d
cmp r10, rdx
je 0x14001a549
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001a53d
xor al, 1
cmp r8, rdx
jne 0x14001a4f0
jmp 0x14001a53d
xor eax, eax
jmp 0x14001a53d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001d2f0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001d7c0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001d740
ud2

Function at 0x14001c0c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c10a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c10a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c10a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c10a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c10a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001c10c
xor al, al
add rsp, 0x28
ret
Function at 0x140001720
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor bl, bl
mov qword [rcx], rdx
mov rsi, r9
mov rdi, rcx
test r8b, r8b
je 0x14000181b
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
movdqu xmmword [rsp + 0x38], xmm0
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x14000177f
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x14000180e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
sete bl
je 0x140001810
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140001810
mov rax, qword [rsp + 0x48]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov ecx, 2
lea rax, [rsi + 1]
mov qword [rsp + 0x28], rsi
test rax, 0xfffffffffffffffe
mov dword [rsp + 0x70], 0
mov eax, 1
mov r9d, 0xffffffff
cmove ecx, eax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x140001810
mov rcx, qword [rdi]
lea r8, [rsp + 0x70]
xor r9d, r9d
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x140001810
mov bl, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x68]
movzx eax, bl
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140001a60
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rsi, qword [rcx + 0x18]
mov r15, rdx
mov rbx, qword [rcx + 0x10]
mov rax, rsi
sub rax, rbx
mov r14, rcx
cmp rax, 0x1000
jae 0x140001ad0
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 0x1000
jae 0x140001ab1
add rcx, 0x10
call fcn.140001e40
jmp 0x140001ad0
sub rbx, rsi
xor edx, edx
add rbx, 0x1000
mov rcx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
lea rax, [rbx + rsi]
mov qword [r14 + 0x18], rax
xorps xmm0, xmm0
mov qword [r15], 0x1000
mov rbx, qword [r14 + 0x10]
mov ebp, 1
xor esi, esi
mov edx, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
xor ecx, ecx
xor dil, dil
movdqu xmmword [rsp + 0x38], xmm0
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140001c04
mov r8d, dword [r15]
lea rax, [rsp + 0x30]
mov rcx, qword [r14]
mov r9, r15
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140001c23
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x140001bf4
cmp byte [r14 + 8], sil
je 0x140001bd3
mov r9d, 0x3e8
mov dword [rsp + 0x20], 0x1cff
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov ecx, ebp
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x140001bcf
cmp eax, ebp
jne 0x140001b46
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140001b46
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x140001b95
jmp 0x140001b46
cmp byte [r14 + 8], sil
mov rcx, qword [r14]
lea rdx, [rsp + 0x30]
sete sil
mov r8, r15
mov r9d, esi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
movzx edi, dil
cmovne edi, ebp
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test dil, dil
jne 0x140001c2e
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [r14 + 0x10]
jmp 0x140001c06

Function at 0x140002c20
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.___svc:OnMsgArgCountError
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add rsp, 0x28
ret

Function at 0x140002c40
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str.___svc:OnMsgArgCountError
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add rsp, 0x28
ret
Function at 0x140005644
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140079080]
xor rax, rsp
mov qword [rbp + 0x80], rax
lea rcx, [0x1400860d8]
call fcn.1400517a8
xor bl, bl
call fcn.140005898
cmp eax, 2
je 0x140005689
xor al, al
jmp 0x140005851
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatTrunkInstaller_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000584f
and dword [rsp + 0x34], eax
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rdx, str.IsInstalledViaUpsell
lea rax, [rsp + 0x34]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005713
cmp dword [rsp + 0x30], 4
jne 0x140005713
cmp dword [rsp + 0x34], 1
sete bl
and dword [rsp + 0x38], 0
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x3c], 0x104
test bl, bl
jne 0x140005844
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.ProductSource
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005844
cmp dword [rsp + 0x38], 1
jne 0x140005844
cmp dword [rsp + 0x3c], eax
je 0x140005844
and qword [rsp + 0x60], 0
lea rcx, [rsp + 0x70]
and qword [rsp + 0x68], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r8, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.140004880
lea rbx, str.UPGRADE32
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov r9, qword [rsp + 0x68]
lea r8, [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
cmp r9, 7
mov rdx, qword [rsp + 0x60]
cmova r8, rcx
cmp rdx, rax
jne 0x140005807
test rdx, rdx
je 0x140005803
sub r8, rbx
movzx eax, word [rbx]
cmp word [r8 + rbx], ax
jne 0x140005807
add rbx, 2
sub rdx, 1
jne 0x1400057ef
mov bl, 1
jmp 0x140005809
xor bl, bl
cmp r9, 7
jbe 0x140005844
lea rdx, [r9*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000583f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000583f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140051634
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140051870
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rbp
ret
Function at 0x140005898
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rcx, [0x1400860d8]
call fcn.1400517a8
lea rax, [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatTrunkInstaller_
mov rcx, 0xffffffff80000002
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005936
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140005936
and dword [rsp + 0x40], eax
lea r9, [rsp + 0x40]
and dword [rsp + 0x48], eax
lea rdx, str.SCAPackageLevel
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 4
mov qword [rsp + 0x28], rax
xor r8d, r8d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000592b
cmp dword [rsp + 0x40], 4
cmove ebx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x140005b24
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov bl, cl
lea rcx, [0x1400860d8]
call fcn.1400517a8
cmp byte [0x14007e223], 0
je 0x140005b50
test bl, bl
je 0x140005cb4
lea rax, [rbp - 0x10]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREAdobeAdobe_AcrobatTrunkInstaller_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005cad
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140005cad
and dword [rbp + 0x20], eax
lea ebx, [rax + 4]
and dword [rbp + 0x18], eax
cmp byte [0x14007e223], al
mov dword [rbp + 0x28], ebx
jne 0x140005bd8
lea rax, [rbp + 0x28]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
lea rdx, str.bIsSingleClientApp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005bd8
cmp dword [rbp + 0x20], ebx
jne 0x140005bd8
cmp dword [rbp + 0x18], eax
setne byte [0x14007e221]
cmp byte [0x14007e221], 0
je 0x140005ca3
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.bIsSCAcroAppInstalled
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005c26
cmp dword [rbp + 0x20], ebx
jne 0x140005c26
cmp dword [rbp + 0x18], eax
setne byte [0x14007e220]
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
and dword [rbp + 0x18], 0
lea r9, [rbp + 0x20]
mov qword [rsp + 0x28], rax
lea rdx, str.SCAPackageLevel
lea rax, [rbp + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005c66
cmp dword [rbp + 0x20], ebx
jne 0x140005c66
mov eax, dword [rbp + 0x18]
mov dword [section..data], eax
mov rcx, qword [rbp - 0x10]
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x20]
lea rax, [rbp + 0x18]
xor r8d, r8d
lea rdx, str.IsAcrInstalledInRdrMode
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005ca3
cmp dword [rbp + 0x20], ebx
jne 0x140005ca3
cmp dword [rbp + 0x18], eax
setne byte [0x14007e222]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x14007e223], 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x14001d61c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
lea rcx, [0x14008620d]
call fcn.1400517a8
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rbx, rbx
je 0x14001d668
movzx eax, byte [r9 + rdi]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, rbx
jb 0x14001d64a
mov rbx, qword [rsp + 0x30]
mov rax, r8
add rsp, 0x20
pop rdi
ret
Function at 0x1400457bc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
mov rbp, rsp
sub rsp, 0x38
lea rcx, [0x1400869ac]
call fcn.1400517a8
xor ebx, ebx
call fcn.14001c16c
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesAdobeAcrobat_ReaderTrunkFeatureLockDown_
cmp eax, 1
mov r9d, 0x20019
lea rax, [rbp + 0x30]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
je 0x140045805
lea rdx, str.SOFTWAREPoliciesAdobeAdobe_AcrobatTrunkFeatureLockDown_
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140045861
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x140045861
lea rax, [rbp + 0x28]
mov dword [rbp + 0x18], ebx
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x18]
lea rax, [rbp + 0x20]
mov dword [rbp + 0x20], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.iMIPCloud
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140045857
cmp dword [rbp + 0x18], 4
cmove ebx, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
ret

Function at 0x140050c4c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140050cc4
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140050cc4
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140050cc4
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140050cb8
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140050cd6
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140050ca6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140050cc6

Function at 0x140052c18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140052c62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140052c62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140052c62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140052c62
cmp dword [rcx + 0x84], 0xe
jbe 0x140052c62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140052c64
xor al, al
add rsp, 0x28
ret
Function at 0x140dca0b5
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], 0x179852a8
call fcn.140de4871
mov ecx, 0x320e4baf
movsx r8d, cl
movzx r8w, byte [rdi + rcx - 0x320e4baf]
dec cl
btr rcx, rcx
mov cl, byte [rdi + rcx*2 - 0x641c975a]
jae 0x140de6877
cmpsb byte [rsi], byte [rdi]
push 0xffffffff830f9be3
pushfq
mov dword [rcx], 0
add byte [rax], al
xor byte [rdx], 0xde
add dword [rax], eax
add byte [rax], al
mov ebx, 0x140de9f
add byte [rax], al
add byte [rax], al
add byte [rax + 0x140de32], al
add byte [rax], al
add byte [rbx + 0x140de9f], bh
add byte [rax], al
add byte [rbx], al
jl 0x140dca0d0
add dword [rax], eax
add byte [rax], al
cwde
or esi, ebx
add dword [rax], eax
add byte [rax], al
mov dword [rax], edi
fld qword [rax + 1]
add byte [rax], al
add byte [rdx + 0x140db03], dl
add byte [rax], al
add byte [rdx + 0x45], cl
fiadd dword [rax + 1]
add byte [rax], al
add byte [rdx], cl
out 0xd9, al
add dword [rax], eax
add byte [rax], al
add bl, ch
fld dword [rax + 1]
add byte [rax], al
add cl, ch
invalid
Function at 0x180013880
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180089208]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18001392c
cmp byte [rcx + 0x71], 0
je 0x18001392c
mov rax, qword [rcx]
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800138ed
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800138f1
sub eax, 1
je 0x1800138f5
sub eax, 2
je 0x18001392c
xor al, al
jmp 0x18001392e
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180013923
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800138ed
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18001392e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800507a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x180015d00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180015d34
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180015d20
ret
Function at 0x180018ac0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180089208]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180018aed
xor eax, eax
jmp 0x180018c42
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x180018b18
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x180018b18
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x180018c42
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180018c35
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x180018b5b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180018b86
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180018c3a
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x180018c35
cmp eax, 1
jle 0x180018bf5
cmp eax, 3
jne 0x180018c35
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180018c3a
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180018c23
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180018c35
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x180018c3a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800507a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18001a080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x18001a0b7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov rdx, qword [rax]
test rdx, rdx
je 0x18001a0d8
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001a0da
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18001a140
test ecx, ecx
jle 0x18001a10e
cmp rbx, rbp
mov rcx, r14
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x50]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x38]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18001a140
cmp qword [rdi + 0x80], 0
je 0x18001a140
mov rcx, rdi
call fcn.180014930
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18001a170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x18001a1a7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x18001a1c8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18001a1ca
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18001a223
test ecx, ecx
jle 0x18001a1fe
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18001a223
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18001a223
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret