joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016c60
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xf0
mov qword [rbp - 0xb8], rbx
mov qword [rbp - 0xb0], rsi
mov qword [rbp - 0xa8], rdi
mov qword [rbp - 0xa0], r12
mov qword [rbp - 0x98], r13
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov r13, rdx
mov rsi, qword [rbp + 0x20]
mov r12, qword [rbp + 0x28]
test cl, cl
je 0x140016d9a
xor r10d, r10d
mov qword [rbp - 0xc0], r10
mov qword [rbp - 0xc8], 0x8000080
mov qword [rbp - 0xd0], 4
mov r9, r10
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call sub.KERNEL32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
setne r10b
movzx r10, r10b
mov qword [rbp - 0xd0], r10
mov rdx, qword [r12 + 8]
mov rax, qword [r12]
mov qword [rbp - 0x90], rax
mov qword [rbp - 0x88], rdx
lea r9, [rbp - 0x90]
mov r8, rsi
lea rcx, str.std_file.d
mov qword [rbp - 0x78], rcx
mov r10d, 0xa
mov qword [rbp - 0x80], r10
lea rdx, [rbp - 0x80]
mov ecx, 0x369
call fcn.140023750
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call sub.KERNEL32.dll_SetFilePointer
cmp eax, 0xffffffff
setne r10b
movzx r10d, r10b
mov qword [rbp - 0xd0], r10
mov rdx, qword [r12 + 8]
mov rax, qword [r12]
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rdx
lea r9, [rbp - 0x70]
mov r8, rsi
lea rcx, str.std_file.d
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x60], 0xa
lea rdx, [rbp - 0x60]
mov ecx, 0x36a
call fcn.140023750
jmp 0x140016e1b
xor ecx, ecx
mov qword [rbp - 0xc0], rcx
mov qword [rbp - 0xc8], 0x8000080
mov qword [rbp - 0xd0], 2
mov r9, rcx
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
call sub.KERNEL32.dll_CreateFileW
mov rbx, rax
cmp rbx, 0xffffffffffffffff
setne r10b
movzx r10, r10b
mov qword [rbp - 0xd0], r10
mov rdx, qword [r12 + 8]
mov rax, qword [r12]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea r9, [rbp - 0x50]
mov r8, rsi
lea rcx, str.std_file.d
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x40], 0xa
lea rdx, [rbp - 0x40]
mov ecx, 0x375
call fcn.140023750
mov qword [rbp + 0x28], r12
mov r12, qword [r13]
mov qword [rbp + 0x20], rsi
xor esi, esi
test r12, r12
je 0x140016e79
mov r9, r12
sub r9, rsi
mov r8d, 0x40000000
cmp r9, r8
jae 0x140016e44
mov rdi, r9
jmp 0x140016e47
mov rdi, r8
mov qword [rbp - 0xd0], 0
lea r9, [rbp - 0x30]
mov r8d, edi
mov rdx, qword [r13 + 8]
add rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_WriteFile
mov r10d, dword [rbp - 0x30]
cmp r10, rdi
jne 0x140016e79
add rsi, r10
cmp rsi, r12
jne 0x140016e2e
cmp rsi, r12
jne 0x140016e8a
mov rcx, rbx
call sub.KERNEL32.dll_CloseHandle
test eax, eax
jne 0x140016e8f
xor r8d, r8d
jmp 0x140016e95
mov r8d, 1
mov qword [rbp - 0xd0], r8
mov rdx, qword [rbp + 0x28]
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
lea r9, [rbp - 0x20]
mov r8, qword [rbp + 0x20]
lea rcx, str.std_file.d
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], 0xa
lea rdx, [rbp - 0x10]
mov ecx, 0x382
call fcn.140023750
mov rbx, qword [rbp - 0xb8]
mov rsi, qword [rbp - 0xb0]
mov rdi, qword [rbp - 0xa8]
mov r12, qword [rbp - 0xa0]
mov r13, qword [rbp - 0x98]
mov rsp, rbp
pop rbp
ret
Function at 0x140017260
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov rdi, rcx
mov dword [rdi + 0x9bc], edx
mov r11d, 0x26f
test r11, r11
lea r11, [r11 - 1]
je 0x1400172fd
lea rsi, [rdi + r11*4]
lea rcx, [r11 + 1]
mov edx, 0x270
cmp rcx, rdx
jae 0x14001732d
lea r10, [rdi + r11*4]
mov r9d, dword [r10 + 4]
mov qword [rbp - 8], r9
lea r8, [r11 + 1]
cmp r8, rdx
jb 0x1400172cf
mov r9, rdx
mov edx, 0x393
lea rcx, str.std_random.d
call fcn.140018720
mov r10d, r9d
shr r10d, 0x1e
mov r9, qword [rbp - 8]
xor r9d, r10d
imul r12d, r9d, 0x6c078965
mov r9, rdx
lea r13d, [r11 + 1]
sub r9d, r13d
add r12d, r9d
mov dword [rsi], r12d
test r11, r11
lea r11, [r11 - 1]
jne 0x140017290
mov qword [rdi + 0x9c8], 0x26f
mov rcx, rdi
call fcn.140017370
mov rcx, rdi
call fcn.140017370
mov rsi, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
mov rsp, rbp
pop rbp
ret
mov r9, rdx
mov r8, rcx
mov edx, 0x393
lea rcx, str.std_random.d
call fcn.140018720
int3
Function at 0x140019c10
Capabilities:
Accept command line arguments

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp - 0x48], 0x90
mov qword [rbp - 0x88], rbx
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r15
mov qword [rbp + 0x20], r8
mov dword [0x1400be640], ecx
mov qword [0x1400be648], rdx
sub rsp, 0x20
call sub.KERNEL32.dll_GetCommandLineW
add rsp, 0x20
mov rsi, rax
mov rcx, rsi
sub rsp, 0x20
call sub.MSVCR120.dll_wcslen
add rsp, 0x20
mov rdi, rax
xor edx, edx
mov dword [rbp - 0x40], edx
lea rdx, [rbp - 0x40]
mov rcx, rsi
sub rsp, 0x20
call sub.SHELL32.dll_CommandLineToArgvW
add rsp, 0x20
mov r12, rax
movsxd rcx, dword [rbp - 0x40]
shl rcx, 4
sub rsp, 0x20
lea rdx, [rbp - 0x48]
call fcn.140026450
add rsp, 0x20
mov qword [rbp - 0x30], rax
movsxd r8, dword [rbp - 0x40]
mov qword [rbp - 0x38], r8
push 0
push 0
push 0
push 0
mov r9d, edi
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
sub rsp, 0x20
call sub.KERNEL32.dll_WideCharToMultiByte
add rsp, 0x40
cdqe
mov r14, rax
mov rcx, r14
sub rsp, 0x20
lea rdx, [rbp - 0x48]
call fcn.140026450
add rsp, 0x20
mov qword [rbp - 0x20], rax
xor edi, edi
mov qword [rbp - 0x28], r14
xor r14d, r14d
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x18], eax
cmp eax, edi
jle 0x140019dba
movsxd rbx, r14d
mov rcx, qword [r12 + rbx*8]
sub rsp, 0x20
call sub.MSVCR120.dll_wcslen
add rsp, 0x20
mov r13, rax
push 0
push 0
push 0
push 0
mov r9d, r13d
mov r8, qword [r12 + rbx*8]
xor edx, edx
mov ecx, 0xfde9
sub rsp, 0x20
call sub.KERNEL32.dll_WideCharToMultiByte
add rsp, 0x40
mov r15d, eax
movsxd rax, r15d
lea rsi, [rax + rdi]
sub rsi, rdi
mov r8, qword [rbp - 0x20]
lea rdx, [rdi + r8]
mov qword [rbp - 0x50], rbx
shl rbx, 4
mov rcx, qword [rbp - 0x30]
mov qword [rbx + rcx], rsi
mov qword [rbx + rcx + 8], rdx
test r15d, r15d
je 0x140019dad
add rdi, rax
push 0
push 0
push r15
mov rax, qword [rbp - 0x50]
shl rax, 4
add rax, qword [rbp - 0x30]
push qword [rax + 8]
mov r9d, r13d
mov rbx, qword [rbp - 0x50]
mov r8, qword [r12 + rbx*8]
xor edx, edx
mov ecx, 0xfde9
sub rsp, 0x20
call sub.KERNEL32.dll_WideCharToMultiByte
add rsp, 0x40
inc r14d
cmp r14d, dword [rbp - 0x18]
jl 0x140019d0d
mov r14, qword [rbp - 0x28]
mov rcx, r12
sub rsp, 0x20
call sub.KERNEL32.dll_LocalFree
add rsp, 0x20
mov dword [rbp - 0x40], 0
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp - 0x30]
mov qword [rbp - 8], rbx
mov r8, qword [rbp + 0x20]
mov rdx, r14
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.1400264b0
add rsp, 0x20
mov rbx, qword [rbp - 0x88]
mov rsi, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov r13, qword [rbp - 0x68]
mov r14, qword [rbp - 0x60]
mov r15, qword [rbp - 0x58]
mov rsp, rbp
pop rbp
ret
Function at 0x14001b0e0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r14
mov r14, rcx
mov r13, rdx
mov rdi, r8
test r14, r14
je 0x14001b120
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax + 0x48]
mov r12, rax
test r12, r12
jne 0x14001b13f
xor eax, eax
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
mov rcx, rdi
call fcn.14001b200
xor al, 1
je 0x14001b182
mov rcx, r12
imul rcx, r14
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], r13
lea rdx, [rbp - 0x10]
xor ecx, ecx
call fcn.14001b390
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
xor ebx, ebx
xor esi, esi
test r14, r14
je 0x14001b1d7
mov rdx, rsi
imul rdx, r12
add rdx, r13
mov rcx, rdi
mov r8, qword [rdi]
call qword [r8 + 0x30]
movabs r9, 0x87c37b91114253d5
mul r9
rol rax, 0x1f
movabs r10, 0x4cf5ad432745937f
mul r10
xor rax, rbx
rol rax, 0x1b
lea rdx, [rax + rax*4 + 0x52dce729]
mov rbx, rdx
inc rsi
cmp rsi, r14
jb 0x14001b18b
mov rax, rbx
mov rbx, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
mov rdi, qword [rbp - 0x30]
mov r12, qword [rbp - 0x28]
mov r13, qword [rbp - 0x20]
mov r14, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret

Function at 0x14001b390
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rdi
mov rdi, qword [rdx]
mov rsi, qword [rdx + 8]
mov rax, rdi
shr rax, 2
mov dword [rbp - 8], ecx
mov qword [rbp - 0x10], rdi
lea rdi, [rsi + rax*4]
cmp rsi, rdi
je 0x14001b40a
mov rcx, rsi
call fcn.140027460
mov ebx, eax
imul edx, ebx, 0xcc9e2d51
mov ebx, edx
rol edx, 0xf
mov ebx, edx
imul r8d, ebx, 0x1b873593
mov ebx, r8d
xor dword [rbp - 8], ebx
mov r9d, dword [rbp - 8]
rol r9d, 0xd
mov dword [rbp - 8], r9d
lea r9d, [r9 + r9*4]
lea r10d, [r9 - 0x19ab949c]
mov dword [rbp - 8], r10d
add rsi, 4
cmp rsi, rdi
jne 0x14001b3c2
mov rdi, qword [rbp - 0x10]
xor ecx, ecx
mov r11, rdi
and r11, 3
cmp r11, 1
je 0x14001b43e
cmp r11, 2
je 0x14001b435
cmp r11, 3
je 0x14001b42e
jmp 0x14001b45d
movzx ecx, byte [rsi + 2]
shl ecx, 0x10
movzx edx, byte [rsi + 1]
shl edx, 8
xor ecx, edx
movzx r8d, byte [rsi]
xor ecx, r8d
imul eax, ecx, 0xcc9e2d51
mov ecx, eax
rol eax, 0xf
mov ecx, eax
imul ebx, ecx, 0x1b873593
mov ecx, ebx
xor dword [rbp - 8], ecx
xor dword [rbp - 8], edi
movzx ecx, word [rbp - 6]
xor ecx, dword [rbp - 8]
imul edx, ecx, 0x85ebca6b
mov dword [rbp - 8], edx
shr edx, 0xd
xor edx, dword [rbp - 8]
imul esi, edx, 0xc2b2ae35
mov dword [rbp - 8], esi
movzx eax, word [rbp - 6]
xor dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbp - 0x20]
mov rdi, qword [rbp - 0x18]
mov rsp, rbp
pop rbp
ret
Function at 0x140023450
Capabilities:
Get common file path

Disassembly:
push rbp
mov rbp, rsp
mov r11d, 2
sub rsp, 0x1000
test dword [rsp], esp
dec r11d
jne 0x14002345a
sub rsp, 0xe0
mov qword [rbp - 0x20b8], rbx
mov qword [rbp - 0x20b0], rsi
lea rdx, [rbp - 0x2090]
mov qword [rbp - 0x20a8], rdx
mov ecx, 0x1000
call fcn.140028830
mov ecx, eax
mov rdx, qword [rbp - 0x20a8]
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov r9d, eax
lea rax, [0x140023680]
mov qword [rbp - 0x78], rax
xor edx, edx
mov qword [rbp - 0x80], rdx
lea r8, [rbp - 0x80]
lea rcx, str.std_file.d
mov qword [rbp - 0x68], rcx
mov ebx, 0xa
mov qword [rbp - 0x70], rbx
lea rdx, [rbp - 0x70]
mov ecx, 0xd5e
call fcn.140028850
mov dword [rbp - 0x90], eax
mov esi, eax
cmp rsi, 0x1000
jae 0x140023528
mov edx, dword [rbp - 0x90]
mov qword [rbp - 0x60], rdx
lea rax, [rbp - 0x2090]
mov qword [rbp - 0x58], rax
lea rcx, [rbp - 0x60]
sub rsp, 0x20
call fcn.140023420
add rsp, 0x20
mov rbx, qword [rbp - 0x20b8]
mov rsi, qword [rbp - 0x20b0]
mov rsp, rbp
pop rbp
ret
mov ecx, dword [rbp - 0x90]
call fcn.1400288e0
mov dword [rbp - 0x50], eax
mov edx, 2
lea rcx, [rbp - 0x50]
call fcn.140028910
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x40]
call fcn.140013ad0
mov rcx, rax
call sub.MSVCR120.dll_malloc
mov qword [rbp - 0x48], rax
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.140027460
add rsp, 0x20
mov rdx, qword [rbp - 0x48]
mov ecx, eax
sub rsp, 0x20
call sub.KERNEL32.dll_GetCurrentDirectoryW
add rsp, 0x20
mov dword [rbp - 0x38], eax
test eax, eax
je 0x1400235a0
mov edx, dword [rbp - 0x38]
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.140028940
add rsp, 0x20
test eax, eax
jg 0x1400235a5
xor r9d, r9d
jmp 0x1400235ab
mov r9d, 1
lea rax, [0x140023680]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x30], 0
lea r8, [rbp - 0x30]
lea rdx, str.std_file.d
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x20], rbx
lea rdx, [rbp - 0x20]
mov ecx, 0xd6b
sub rsp, 0x20
call fcn.140028970
add rsp, 0x20
mov eax, dword [rbp - 0x38]
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp - 0x48]
mov qword [rbp - 8], rbx
lea rcx, [rbp - 0x10]
sub rsp, 0x20
call fcn.140023420
add rsp, 0x20
mov qword [rbp - 0x20a0], rax
mov qword [rbp - 0x2098], rdx
sub rsp, 8
call fcn.140023652
add rsp, 8
mov rdx, qword [rbp - 0x2098]
mov rax, qword [rbp - 0x20a0]
mov rbx, qword [rbp - 0x20b8]
mov rsi, qword [rbp - 0x20b0]
mov rsp, rbp
pop rbp
ret

Function at 0x1400238b0
Capabilities:
Hash data using murmur3

Disassembly:
push rbx
push rsi
mov rax, rcx
shr rax, 0x21
xor rax, rcx
movabs rbx, 0xff51afd7ed558ccd
mul rbx
mov rcx, rax
shr rax, 0x21
xor rax, rcx
movabs rsi, 0xc4ceb9fe1a85ec53
mul rsi
mov rcx, rax
shr rax, 0x21
xor rax, rcx
pop rsi
pop rbx
ret
Function at 0x140023ab0
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xe0
mov qword [rbp - 0xb8], rbx
mov qword [rbp - 0xb0], rsi
mov qword [rbp - 0xa8], rdi
xor eax, eax
mov qword [rbp - 0x90], rax
call sub.KERNEL32.dll_GetEnvironmentStringsW
mov qword [rbp - 0x88], rax
mov r9, rax
lea rcx, [0x140023d30]
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x80], 0
lea r8, [rbp - 0x80]
lea rdx, str.stdprocess.d
mov qword [rbp - 0x68], rdx
mov qword [rbp - 0x70], 0xd
lea rdx, [rbp - 0x70]
mov ecx, 0x1a0
call fcn.1400293d0
xor esi, esi
mov rax, qword [rbp - 0x88]
cmp word [rax], si
je 0x140023cb2
mov edi, esi
movsxd r8, esi
mov r9, qword [rbp - 0x88]
cmp word [r9 + r8*2], 0x3d
je 0x140023b59
inc esi
movsxd rdx, esi
mov rcx, qword [rbp - 0x88]
cmp word [rcx + rdx*2], 0x3d
jne 0x140023b46
movsxd r10, esi
movsxd r8, edi
mov qword [rbp - 0xa0], r10
sub r10, r8
mov qword [rbp - 0x50], r10
mov r9, qword [rbp - 0x88]
lea rdx, [r9 + r8*2]
mov qword [rbp - 0x48], rdx
lea rcx, [rbp - 0x50]
sub rsp, 0x20
call fcn.140029440
add rsp, 0x20
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.140029470
add rsp, 0x20
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
lea edi, [rsi + 1]
mov r8, qword [rbp - 0xa0]
mov r9, qword [rbp - 0x88]
cmp word [r9 + r8*2], 0
je 0x140023bdb
inc esi
movsxd rdx, esi
mov r10, qword [rbp - 0x88]
cmp word [r10 + rdx*2], 0
jne 0x140023bc7
cmp qword [rbp - 0x60], 0
je 0x140023c9b
movsxd rcx, esi
movsxd r8, edi
sub rcx, r8
mov qword [rbp - 0x20], rcx
mov r9, qword [rbp - 0x88]
lea rdx, [r9 + r8*2]
mov qword [rbp - 0x18], rdx
lea rcx, [rbp - 0x20]
sub rsp, 0x20
call fcn.140029470
add rsp, 0x20
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
lea r8, [rbp - 0x60]
lea rdx, [0x1400a3ab0]
mov rcx, qword [rbp - 0x90]
sub rsp, 0x20
call fcn.14001b4a0
add rsp, 0x20
test rax, rax
jne 0x140023c9b
mov r9, qword [rbp - 0x28]
or r9, qword [rbp - 0x30]
je 0x140023c53
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x30]
jmp 0x140023c5c
lea rdx, [0x1400a1680]
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea r9, [rbp - 0x60]
mov r8d, 0x10
lea rdx, [0x1400ab090]
lea rcx, [rbp - 0x90]
sub rsp, 0x20
call fcn.140022c50
add rsp, 0x20
mov rdi, rax
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x10]
mov qword [rdi], rax
mov qword [rdi + 8], rdx
inc esi
movsxd rbx, esi
mov rdi, qword [rbp - 0x88]
cmp word [rdi + rbx*2], 0
jne 0x140023b32
mov rax, qword [rbp - 0x90]
mov qword [rbp - 0x98], rax
sub rsp, 8
call fcn.140023cfd
add rsp, 8
mov rax, qword [rbp - 0x98]
mov rbx, qword [rbp - 0xb8]
mov rsi, qword [rbp - 0xb0]
mov rdi, qword [rbp - 0xa8]
mov rsp, rbp
pop rbp
ret
Function at 0x14002dfa0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xb0
mov qword [rbp - 0x88], rbx
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r15
mov rsi, rdx
mov rax, qword [rcx]
mov qword [rbp - 0x40], rax
cmp qword [rbp - 0x40], 0
je 0x14002dfe9
mov rcx, qword [rbp - 0x40]
mov r8d, dword [rcx + 0x10]
sub r8d, dword [rcx + 0x14]
jne 0x14002e00f
xor eax, eax
mov rbx, qword [rbp - 0x88]
mov rsi, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov r13, qword [rbp - 0x68]
mov r14, qword [rbp - 0x60]
mov r15, qword [rbp - 0x58]
mov rsp, rbp
pop rbp
ret
mov rcx, rsi
call fcn.140025a70
mov rdi, rax
mov rdx, qword [rbp - 0x40]
mov r12d, dword [rdx + 0x2c]
mov r13, qword [rdi + 0x18]
mov qword [rbp - 0x50], r13
mov rax, qword [rbp - 0x50]
mov rbx, qword [rax]
mov r14, qword [rbx + 0x30]
mov r15, qword [rdi + 0x10]
mov qword [rbp - 0x50], r15
mov rsi, qword [rbp - 0x50]
mov rcx, qword [rsi]
mov r8, qword [rcx + 0x30]
mov qword [rbp - 0x38], r8
xor esi, esi
mov rax, qword [rdx]
mov rdx, qword [rdx + 8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
cmp qword [rbp - 0x30], rsi
je 0x14002e0f4
mov rbx, qword [rbp - 0x28]
mov r9, qword [rbp - 0x30]
shl r9, 4
add r9, qword [rbp - 0x28]
mov qword [rbp - 0x10], r9
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
cmp qword [rbp - 0x20], 0
jns 0x14002e0ea
mov edx, r12d
add rdx, qword [rbp - 0x18]
mov rcx, r15
call qword [rbp - 0x38]
movabs r8, 0x87c37b91114253d5
mul r8
mov rdi, rax
rol rdi, 0x1f
mov rax, rdi
movabs r9, 0x4cf5ad432745937f
mul r9
mov qword [rbp - 0x48], rax
mov rdx, qword [rbp - 0x18]
mov rcx, r13
call r14
mov r8, rax
mov rax, qword [rbp - 0x48]
xor rax, r8
rol rax, 0x1b
lea r10, [rax + rax*4 + 0x52dce729]
add rsi, r10
add rbx, 0x10
cmp rbx, qword [rbp - 0x10]
jb 0x14002e07b
mov rax, rsi
mov rbx, qword [rbp - 0x88]
mov rsi, qword [rbp - 0x80]
mov rdi, qword [rbp - 0x78]
mov r12, qword [rbp - 0x70]
mov r13, qword [rbp - 0x68]
mov r14, qword [rbp - 0x60]
mov r15, qword [rbp - 0x58]
mov rsp, rbp
pop rbp
ret

Function at 0x140032440
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rdi
mov rbx, rcx
mov rsi, rdx
mov rcx, rsi
call fcn.1400061e0
xor al, 1
je 0x140032486
mov rcx, rsi
call fcn.140047440
mov edi, eax
mov edx, edi
mov rcx, rbx
call fcn.140006b80
mov rcx, rsi
call fcn.1400061e0
xor al, 1
jne 0x140032466
mov rbx, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
mov rdi, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
Function at 0x140032cc0
Capabilities:
Create thread
Resume thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp - 0x90], rbx
mov qword [rbp - 0x88], rsi
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r15
mov qword [rbp + 0x10], rcx
mov al, byte [0x1400be8e0]
mov byte [rbp - 0x50], al
mov byte [0x1400be8e0], 1
mov rsi, rcx
add rsi, 0xb0
mov edi, dword [rcx + 0x40]
lea r12, [0x140047d60]
mov r13, rcx
mov rbx, rcx
add rbx, 0x10
push rbx
push 4
mov r9, rcx
lea r8, [0x140047d60]
mov edx, edi
xor ecx, ecx
sub rsp, 0x20
call sub.MSVCR120.dll__beginthreadex
add rsp, 0x30
mov qword [rsi], rax
mov rax, qword [rbp + 0x10]
cmp qword [rax + 0xb0], 0
jne 0x140032d6e
lea rbx, str.Error_creating_thread
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x40], 0x15
lea rcx, [rbp - 0x40]
sub rsp, 0x20
call fcn.140047f80
lea rcx, [0x1400be978]
lea rcx, [0x1400be990]
sub rsp, 0x20
call sub.KERNEL32.dll_EnterCriticalSection
add rsp, 0x20
mov rsi, qword [rbp + 0x10]
inc qword [0x1400bea28]
mov rdx, qword [0x1400bea28]
shl rdx, 3
mov rcx, qword [0x1400bea20]
sub rsp, 0x20
call sub.MSVCR120.dll_realloc
add rsp, 0x20
mov qword [0x1400bea20], rax
mov rbx, qword [0x1400bea28]
lea rax, [rax + rbx*8]
mov qword [rax - 8], rsi
mov rsi, qword [rbp + 0x10]
mov rcx, qword [rsi + 0xb0]
sub rsp, 0x20
call sub.KERNEL32.dll_ResumeThread
add rsp, 0x20
cmp eax, 0xffffffff
jne 0x140032e06
lea rdx, str.Error_resuming_thread
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x30], 0x15
lea rcx, [rbp - 0x30]
sub rsp, 0x20
call fcn.140047f80
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x58], rax
sub rsp, 8
call fcn.140032e55
add rsp, 8
mov rax, qword [rbp - 0x58]
mov rbx, qword [rbp - 0x90]
mov rsi, qword [rbp - 0x88]
mov rdi, qword [rbp - 0x80]
mov r12, qword [rbp - 0x78]
mov r13, qword [rbp - 0x70]
mov r14, qword [rbp - 0x68]
mov r15, qword [rbp - 0x60]
mov rsp, rbp
pop rbp
ret

Function at 0x140034190
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], rsi
mov rsi, rcx
call fcn.140003150
mov qword [rbp - 0x50], rax
mov rdx, qword [rsi]
lea rcx, [rbp - 0x50]
call fcn.140003200
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x30]
call fcn.140049310
lea rcx, [rbp - 0x30]
call fcn.1400493e0
xor al, 1
je 0x14003420e
lea rcx, [rbp - 0x30]
call fcn.140049420
mov esi, eax
movzx edx, sil
lea rcx, [rbp - 0x50]
call fcn.140008d70
lea rcx, [rbp - 0x30]
call fcn.140049500
lea rcx, [rbp - 0x30]
call fcn.1400493e0
xor al, 1
jne 0x1400341e0
lea rcx, [rbp - 0x50]
call fcn.140003250
mov rsi, qword [rbp - 0x58]
mov rsp, rbp
pop rbp
ret
Function at 0x140035fe0
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rdi
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rsi, qword [rbp + 0x18]
cmp byte [0x1400beb40], 0
je 0x1400360c8
cmp qword [rsi], 0x20
jb 0x140036019
ud2
mov eax, dword [str.DRT_]
mov dword [rbp - 0x60], eax
mov rdx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov qword [rbp + 0x18], rsi
xor esi, esi
cmp qword [rbp - 0x30], rsi
je 0x140036060
mov rcx, qword [rbp - 0x28]
movzx edi, byte [rsi + rcx]
movzx ecx, dil
call sub.MSVCR120.dll_toupper
lea r8, [rbp - 0x5c]
mov byte [rsi + r8], al
inc rsi
cmp rsi, qword [rbp - 0x30]
jb 0x14003603d
mov rsi, qword [rbp + 0x18]
mov rbx, qword [rsi]
lea rax, [rbp - 0x5c]
mov byte [rbx + rax], 0
lea rcx, [rbp - 0x60]
call sub.MSVCR120.dll_getenv
mov rsi, rax
test rsi, rsi
je 0x1400360c8
mov rcx, rsi
call sub.MSVCR120.dll_strlen
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rsi
lea rdx, [rbp - 0x10]
mov rbx, qword [rbp + 0x10]
mov rcx, qword [rbx]
call qword [rbx + 8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
test rax, rax
je 0x1400360c8
mov rdx, rcx
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x68]
mov rsp, rbp
pop rbp
ret
xor eax, eax
xor edx, edx
mov rbx, qword [rbp - 0x78]
mov rsi, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x68]
mov rsp, rbp
pop rbp
ret

Function at 0x140037c62
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
xor r9d, r9d
mov eax, r8d
shr eax, 8
mov ecx, r8d
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x1400aea50]
xor eax, dword [rdx + rcx*4]
mov r8d, eax
inc r9d
cmp r9d, 4
jb 0x140037c68
ret

Function at 0x140039fd0
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], r14
mov r13, rcx
mov r14, rdx
mov r12, r8
mov rbx, r9
mov dword [rbx], 0
mov esi, r12d
sub esi, dword [rbx]
cmp esi, 0x40000000
jbe 0x14003a014
mov esi, 0x40000000
mov r8d, esi
mov edx, dword [rbx]
add rdx, r14
mov ecx, dword [r13 + 0x1c]
call sub.MSVCR120.dll__read
mov edi, eax
test edi, edi
jle 0x14003a035
add dword [rbx], edi
mov r9d, dword [rbx]
cmp r9d, r12d
jb 0x14003a002
test edi, edi
jns 0x14003a077
call sub.MSVCR120.dll__errno
mov ecx, dword [rax]
call sub.MSVCR120.dll_strerror
mov r8, rax
mov edx, 0xffffffff
mov rcx, r13
call fcn.14003e370
mov eax, 0xffffffff
mov rbx, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
mov r14, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret
test edi, edi
jne 0x14003a083
mov dword [r13 + 0x50], 1
xor eax, eax
mov rbx, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
mov rdi, qword [rbp - 0x20]
mov r12, qword [rbp - 0x18]
mov r13, qword [rbp - 0x10]
mov r14, qword [rbp - 8]
mov rsp, rbp
pop rbp
ret