joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140132530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, edx
mov edi, 0x40
shl rax, 4
mov rbx, rcx
cmp rax, 0x400
cmovbe edi, edx
cmp edi, dword [rcx]
je 0x1401326a6
mov rax, qword [0x14037a870]
test rax, rax
je 0x140132567
call rax
mov ecx, edi
shl rcx, 4
call fcn.140152ef0
mov rcx, qword [0x14037a878]
mov rdi, rax
test rcx, rcx
je 0x140132583
call rcx
test rdi, rdi
je 0x1401326a6
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x30], rsi
call fcn.140108630
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x14033a590]
movsxd rsi, eax
xor edx, edx
shr rsi, 4
mov rcx, rdi
mov r8d, esi
shl r8, 4
mov dword [rbx], esi
call fcn.140249b10
mov rcx, qword [rbx + 8]
xor r10d, r10d
mov qword [rbx + 8], r10
test rcx, rcx
je 0x140132691
lea r11, [0x1402bae60]
nop dword [rax]
mov r9, qword [rcx + 0x18]
mov eax, r10d
movzx edx, byte [r9]
test dl, dl
je 0x140132611
nop
movzx edx, dl
lea r9, [r9 + 1]
movzx r8d, byte [rdx + r11]
lea edx, [rax*8]
xor r8d, edx
movzx edx, byte [r9]
xor eax, r8d
test dl, dl
jne 0x1401325f0
mov r9, qword [rcx]
xor edx, edx
div esi
mov r8d, edx
shl r8, 4
add r8, rdi
je 0x140132669
mov eax, dword [r8]
test eax, eax
je 0x140132631
mov rdx, qword [r8 + 8]
jmp 0x140132634
mov rdx, r10
inc eax
mov qword [r8 + 8], rcx
mov dword [r8], eax
test rdx, rdx
je 0x140132669
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x14013265f
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x140132685
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x140132685
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x14013267d
mov qword [rax + 8], rcx
mov qword [rcx + 8], r10
mov qword [rbx + 8], rcx
mov rcx, r9
test r9, r9
jne 0x1401325e0
mov rsi, qword [rsp + 0x30]
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14013ee90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [rcx]
lea rbx, [0x1402bae60]
movsxd r10, edx
mov r13, rcx
shl r10, 5
mov r15d, 1
mov rdx, qword [rax + 0x20]
mov rsi, qword [r10 + rdx]
mov r9d, r15d
lea r8, str.sqlite_stat_d
lea rdx, [rsp + 0x30]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1401083d0
mov rbp, qword [r13]
xor r11d, r11d
xor edi, edi
mov r14d, dword [rbp + 0x28]
test r14d, r14d
jle 0x14013f0c8
movzx r12d, byte [rsp + 0x30]
nop word [rax + rax]
mov r10d, edi
xor r10d, 1
cmp edi, 2
cmovge r10d, edi
test rsi, rsi
je 0x14013ef8b
mov rax, qword [rbp + 0x20]
movsxd rcx, r10d
shl rcx, 5
mov rdx, qword [rcx + rax]
test rdx, rdx
je 0x14013f087
movzx r8d, byte [rsi]
test r8b, r8b
je 0x14013ef74
mov r9, rsi
movzx eax, r8b
sub r9, rdx
nop
movzx ecx, al
movzx r8d, al
movzx eax, byte [rdx]
movzx eax, byte [rax + rbx]
cmp byte [rcx + rbx], al
jne 0x14013ef74
movzx eax, byte [r9 + rdx + 1]
inc rdx
movzx r8d, al
test al, al
jne 0x14013ef50
movzx eax, r8b
movzx ecx, byte [rax + rbx]
movzx eax, byte [rdx]
movzx eax, byte [rax + rbx]
cmp ecx, eax
jne 0x14013f087
mov rax, qword [rbp + 0x20]
movsxd rcx, r10d
shl rcx, 5
mov r9, qword [rcx + rax + 0x18]
add r9, 8
mov r10, qword [r9 + 0x10]
test r10, r10
je 0x14013eff2
xor eax, eax
lea r8, [rsp + 0x30]
movzx ecx, r12b
test r12b, r12b
je 0x14013efdd
nop dword [rax + rax]
movzx ecx, cl
inc r8
movzx edx, byte [rcx + rbx]
lea ecx, [rax*8]
xor edx, ecx
movzx ecx, byte [r8]
xor eax, edx
test cl, cl
jne 0x14013efc0
xor edx, edx
div dword [r9]
mov ecx, edx
add rcx, rcx
mov r11, qword [r10 + rcx*8 + 8]
mov ebx, dword [r10 + rcx*8]
jmp 0x14013effa
mov r11, qword [r9 + 8]
mov ebx, dword [r9 + 4]
test ebx, ebx
je 0x14013f07d
nop
mov r10, qword [r11 + 0x18]
dec ebx
test r10, r10
je 0x14013f076
movzx r9d, byte [r10]
lea r8, [rsp + 0x30]
test r9b, r9b
je 0x14013f05b
lea rcx, [rsp + 0x30]
movzx eax, r9b
sub r10, rcx
lea r14, [0x1402bae60]
nop dword [rax]
movzx edx, byte [r8]
movzx r9d, al
movzx ecx, al
movzx eax, byte [rdx + r14]
cmp byte [rcx + r14], al
jne 0x14013f057
movzx eax, byte [r10 + r8 + 1]
inc r8
movzx r9d, al
test al, al
jne 0x14013f030
mov r14d, dword [rbp + 0x28]
movzx eax, byte [r8]
lea rcx, [0x1402bae60]
movzx edx, byte [rax + rcx]
movzx eax, r9b
movzx ecx, byte [rax + rcx]
cmp ecx, edx
je 0x14013f0f4
mov r11, qword [r11]
test ebx, ebx
jne 0x14013f000
xor r11d, r11d
lea rbx, [0x1402bae60]
inc edi
cmp edi, r14d
jl 0x14013ef10
test r11, r11
je 0x14013f0c8
mov rax, qword [rsp + 0xa8]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.DELETE_FROM__Q._s_WHERE__s_Q
mov rax, qword [rsp + 0xa0]
mov r8, rsi
mov rcx, r13
mov qword [rsp + 0x20], rax
call fcn.140153860
inc r15d
lea rbx, [0x1402bae60]
cmp r15d, 4
jle 0x14013eed0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r11, qword [r11 + 0x10]
test r11, r11
jne 0x14013f097
jmp 0x14013f080
Function at 0x140146420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
xor r10d, r10d
mov rbx, rcx
mov esi, r9d
add rcx, 0x88
mov ebp, r8d
nop dword [rax]
cmp dword [rcx + 0xc], 0
jle 0x140146462
cmp dword [rcx], esi
jne 0x140146462
movsx eax, word [rcx + 4]
cmp eax, ebp
je 0x1401464b8
inc r10d
add rcx, 0x14
cmp r10d, 0xa
jl 0x140146450
mov qword [rsp + 0x40], rdi
mov r9d, ebp
mov edi, dword [rsp + 0x60]
mov r8d, esi
mov rcx, r14
mov dword [rsp + 0x20], edi
call fcn.140146590
movzx r8d, byte [rsp + 0x68]
test r8b, r8b
je 0x14014655f
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x14014656f
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r8b
jmp 0x14014656f
mov eax, dword [rbx + 0x74]
mov dword [rcx + 0x10], eax
inc dword [rbx + 0x74]
mov eax, dword [rcx + 0xc]
cmp dword [rbx + 0x94], eax
jne 0x1401464d3
mov byte [rbx + 0x8e], 0
cmp dword [rbx + 0xa8], eax
jne 0x1401464e2
mov byte [rbx + 0xa2], 0
cmp dword [rbx + 0xbc], eax
jne 0x1401464f1
mov byte [rbx + 0xb6], 0
cmp dword [rbx + 0xd0], eax
jne 0x140146500
mov byte [rbx + 0xca], 0
cmp dword [rbx + 0xe4], eax
jne 0x14014650f
mov byte [rbx + 0xde], 0
cmp dword [rbx + 0xf8], eax
jne 0x14014651e
mov byte [rbx + 0xf2], 0
cmp dword [rbx + 0x10c], eax
jne 0x14014652d
mov byte [rbx + 0x106], 0
cmp dword [rbx + 0x120], eax
jne 0x14014653c
mov byte [rbx + 0x11a], 0
cmp dword [rbx + 0x134], eax
jne 0x14014654b
mov byte [rbx + 0x12e], 0
cmp dword [rbx + 0x148], eax
jne 0x14014655a
mov byte [rbx + 0x142], 0
mov eax, dword [rcx + 0xc]
jmp 0x140146576
mov r9d, edi
mov r8d, ebp
mov edx, esi
mov rcx, rbx
call fcn.140145ed0
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140148260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1401483f5
test rdx, rdx
je 0x1401483f5
mov r9d, dword [rdx + 4]
mov r11d, dword [rcx + 4]
mov qword [rsp + 0x30], rsi
mov esi, r9d
or esi, r11d
bt esi, 0xa
jae 0x1401482d4
and r9d, r11d
bt r9d, 0xa
jae 0x1401483eb
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x1401483eb
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x14014831c
cmp r8b, 0x5f
jne 0x1401482f4
mov rcx, qword [rcx + 0x10]
mov r8d, ebp
call fcn.140148260
cmp eax, 2
jl 0x140148315
cmp byte [rbx], 0x5f
jne 0x1401483eb
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, rdi
call fcn.140148260
cmp eax, 2
jge 0x1401483eb
mov eax, 1
jmp 0x1401482bf
lea eax, [r8 + 0x66]
test al, 0xfd
je 0x14014835b
mov rax, qword [rcx + 8]
test rax, rax
je 0x14014835b
mov r10, qword [rdx + 8]
sub r10, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x140148347
inc rax
test ecx, ecx
jne 0x140148334
test edx, edx
je 0x14014835b
xor eax, eax
cmp r8b, 0x5f
setne al
inc eax
jmp 0x1401482bf
xor r9d, r11d
test r9b, 0x10
jne 0x1401483eb
bt esi, 0xe
jb 0x1401482bd
bt esi, 0xb
jb 0x1401483eb
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, qword [rdi + 0x10]
call fcn.140148260
test eax, eax
jne 0x1401483eb
mov rdx, qword [rbx + 0x18]
mov r8d, ebp
mov rcx, qword [rdi + 0x18]
call fcn.140148260
test eax, eax
jne 0x1401483eb
mov rdx, qword [rbx + 0x20]
mov r8d, ebp
mov rcx, qword [rdi + 0x20]
call fcn.140149050
test eax, eax
jne 0x1401483eb
bt esi, 0xd
jb 0x1401482bd
cmp byte [rdi], 0x61
je 0x1401482bd
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x1401483eb
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x1401482bd
cmp ecx, ebp
jne 0x1401483eb
test eax, eax
js 0x1401482bd
mov eax, 2
jmp 0x1401482bf
mov rbp, qword [rsp + 0x40]
xor eax, eax
cmp rbx, rdi
mov ecx, 2
mov rbx, qword [rsp + 0x38]
cmove ecx, eax
mov eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x14014a0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor r10d, r10d
xor ebx, ebx
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x14014a19f
mov qword [rsp + 0x48], r14
lea r14, [0x1402bae60]
nop
mov eax, ebx
xor eax, 1
cmp ebx, 2
cmovge eax, ebx
movsxd rcx, eax
mov rax, qword [rsi + 0x20]
shl rcx, 5
mov r11, qword [rcx + rax + 0x18]
test rdi, rdi
je 0x14014a15b
mov rax, qword [rcx + rax]
test rax, rax
je 0x14014a17f
movzx r8d, byte [rdi]
test r8b, r8b
je 0x14014a146
mov r9, rdi
movzx edx, r8b
sub r9, rax
nop dword [rax]
movzx ecx, byte [rax]
movzx r8d, dl
movzx edx, dl
movzx ecx, byte [rcx + r14]
cmp byte [rdx + r14], cl
jne 0x14014a146
movzx edx, byte [r9 + rax + 1]
inc rax
movzx r8d, dl
test dl, dl
jne 0x14014a120
movzx ecx, byte [rax]
movzx eax, r8b
movzx edx, byte [rcx + r14]
movzx ecx, byte [rax + r14]
cmp ecx, edx
jne 0x14014a17f
lea rcx, [r11 + 0x20]
mov rdx, rbp
lea r8, [rsp + 0x40]
call fcn.140122db0
test rax, rax
je 0x14014a17c
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x14014a18a
jmp 0x14014a17f
xor r10d, r10d
inc ebx
cmp ebx, dword [rsi + 0x28]
jl 0x14014a0e0
mov r14, qword [rsp + 0x48]
mov rax, r10
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x50]
mov rax, r10
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x14014a1b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
xor r11d, r11d
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
cmp dword [rcx + 0x28], ebx
jle 0x14014a2af
mov qword [rsp + 0x48], r14
lea r14, [0x1402bae60]
nop
mov r10d, ebx
xor r10d, 1
cmp ebx, 2
cmovge r10d, ebx
test rsi, rsi
je 0x14014a25b
mov rax, qword [rdi + 0x20]
movsxd rcx, r10d
shl rcx, 5
mov rax, qword [rcx + rax]
test rax, rax
je 0x14014a28f
movzx r8d, byte [rsi]
test r8b, r8b
je 0x14014a246
mov r9, rsi
movzx edx, r8b
sub r9, rax
nop
movzx ecx, byte [rax]
movzx r8d, dl
movzx edx, dl
movzx ecx, byte [rcx + r14]
cmp byte [rdx + r14], cl
jne 0x14014a246
movzx edx, byte [r9 + rax + 1]
inc rax
movzx r8d, dl
test dl, dl
jne 0x14014a220
movzx ecx, byte [rax]
movzx eax, r8b
movzx edx, byte [rcx + r14]
movzx ecx, byte [rax + r14]
cmp ecx, edx
jne 0x14014a28f
mov rax, qword [rdi + 0x20]
lea r8, [rsp + 0x40]
movsxd rcx, r10d
mov rdx, rbp
shl rcx, 5
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.140122db0
test rax, rax
je 0x14014a28c
mov r11, qword [rax + 0x10]
test r11, r11
jne 0x14014a29a
jmp 0x14014a28f
xor r11d, r11d
inc ebx
cmp ebx, dword [rdi + 0x28]
jl 0x14014a1e0
mov r14, qword [rsp + 0x48]
mov rax, r11
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x50]
mov rax, r11
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140153560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r12
push r15
sub rsp, 0x30
mov r12d, r8d
movsxd r15, edx
mov rbx, rcx
call fcn.14014ebd0
mov rsi, rax
test rax, rax
je 0x14015372a
movzx eax, byte [rbx + 0x1f]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r14
test al, al
jne 0x1401535ae
inc dword [rbx + 0x54]
mov r14d, dword [rbx + 0x54]
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x1401535d3
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0x24]
test al, al
jne 0x1401535c7
inc dword [rbx + 0x54]
mov ebp, dword [rbx + 0x54]
jmp 0x1401535d3
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov ebp, dword [rbx + rax*4 + 0x24]
mov r9d, r14d
mov dword [rsp + 0x20], 2
mov r8d, r15d
mov edx, reloc.SHELL32.dll_PathResolve
mov rcx, rsi
call fcn.140167a30
mov eax, dword [rsi + 0x94]
bts eax, r15d
mov dword [rsi + 0x94], eax
cmp r15d, 1
je 0x14015362d
mov rax, qword [rsi]
mov rdx, r15
shl rdx, 5
mov rcx, qword [rax + 0x20]
mov rax, qword [rdx + rcx + 8]
cmp byte [rax + 0x11], 0
je 0x14015362d
mov eax, dword [rsi + 0x98]
bts eax, r15d
mov dword [rsi + 0x98], eax
xor edi, edi
mov r9d, ebp
mov r8d, r12d
mov dword [rsp + 0x20], edi
mov rcx, rsi
lea edx, [rdi + 0x17]
call fcn.140167a30
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov r8d, ebp
lea edx, [rdi + 0x53]
mov rcx, rsi
call fcn.140167a30
mov r12d, eax
mov rax, qword [rsi + 8]
test rax, rax
je 0x140153673
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rcx + rcx*2]
mov byte [rax + rdx*8 - 0x15], 0x90
mov r9d, 2
mov dword [rsp + 0x20], ebp
mov r8d, r15d
mov rcx, rsi
lea edx, [r9 + 0x32]
call fcn.140167a30
mov edx, dword [rsi + 0x3c]
cmp edx, r12d
jbe 0x1401536a3
mov rax, qword [rsi + 8]
lea rcx, [r12 + r12*2]
mov dword [rax + rcx*8 + 8], edx
mov edx, dword [rsi + 0x3c]
mov rax, qword [rsi + 0x30]
lea ecx, [rdx - 1]
mov dword [rax + 0x64], ecx
test r14d, r14d
je 0x1401536e6
movzx edx, byte [rbx + 0x1f]
cmp dl, 8
jae 0x1401536e6
mov ecx, edi
lea rax, [rbx + 0x88]
cmp dword [rax + 0xc], r14d
je 0x1401536e2
inc ecx
add rax, 0x14
cmp ecx, 0xa
jl 0x1401536c4
movzx eax, dl
mov dword [rbx + rax*4 + 0x24], r14d
inc byte [rbx + 0x1f]
jmp 0x1401536e6
mov byte [rax + 6], 1
mov r14, qword [rsp + 0x60]
test ebp, ebp
je 0x140153720
movzx ecx, byte [rbx + 0x1f]
cmp cl, 8
jae 0x140153720
lea rax, [rbx + 0x88]
nop
cmp dword [rax + 0xc], ebp
je 0x14015371c
inc edi
add rax, 0x14
cmp edi, 0xa
jl 0x140153700
movzx eax, cl
mov dword [rbx + rax*4 + 0x24], ebp
inc byte [rbx + 0x1f]
jmp 0x140153720
mov byte [rax + 6], 1
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rsi
ret
Function at 0x140179d10
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
xor eax, eax
movzx ecx, byte [rcx]
test cl, cl
je 0x140179d51
lea r10, [0x1402bae60]
nop dword [rax]
nop word [rax + rax]
movzx edx, cl
lea r9, [r9 + 1]
lea ecx, [rax*8]
movzx r8d, byte [rdx + r10]
xor r8d, ecx
movzx ecx, byte [r9]
xor eax, r8d
test cl, cl
jne 0x140179d30
ret

Function at 0x14017e0e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov qword [rcx], 0
mov ecx, 0x28
mov rsi, r8
mov rbp, rdx
call fcn.140152ef0
mov rbx, rax
test rax, rax
jne 0x14017e11b
lea eax, [rbx + 7]
jmp 0x14017e18b
cmp dword [0x14033a554], 0
je 0x14017e158
mov qword [rax + 0x10], rbp
lea r8, [0x140163ac0]
mov qword [rax + 0x18], rsi
mov r9, rbx
add rax, 8
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.140258734
mov qword [rbx], rax
test rax, rax
jne 0x14017e16d
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
cmp qword [rbx + 0x10], 0
jne 0x14017e186
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov rcx, rsi
mov dword [rbx + 8], eax
call rbp
mov qword [rbx + 0x20], rax
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14018cb50
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x80
lea rdi, [rcx + 8]
mov r9d, r8d
lea rax, vtable.CSABArchiveFile::CMD5_LZMA.0
mov r8, rdx
mov qword [rcx], rax
lea rdx, [r11 - 0x68]
xor eax, eax
xor ebx, ebx
mov qword [rdi], rax
mov rsi, rcx
mov qword [rdi + 8], rax
mov qword [rcx + 0x18], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x68], rbx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov byte [rcx + 0x38], al
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.1400390f0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1401a2470
movzx r9d, byte [rdi]
lea ecx, [rbx + rbx]
add rcx, 0x18
lea r8, [0x14028a478]
add rcx, rsi
mov edx, 3
call fcn.14000b150
inc ebx
lea rdi, [rdi + 1]
cmp ebx, 0x10
jb 0x14018cbf5
lea r11, [rsp + 0x80]
mov rax, rsi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14018fcb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x480
mov rsi, rcx
mov ebx, r8d
add rcx, 0x18
mov edi, edx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rsi], 0
jne 0x14018fce5
xor edi, edi
jmp 0x14018fd9b
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x6a]
movzx edx, word [rsp + 0x68]
movzx r8d, word [rsp + 0x66]
movzx eax, word [rsp + 0x6c]
movzx r10d, word [rsp + 0x62]
movzx r9d, word [rsp + 0x60]
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ecx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x30], edx
mov edx, 0x410
mov dword [rsp + 0x28], r8d
lea r8, str._04u__02u__02u__02u:_02u:_02u_t_u_t_u_r_n
mov dword [rsp + 0x20], r10d
call fcn.14000b150
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14018fd54
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x490]
xor edi, edi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, [rsp + 0x70]
inc rbx
cmp byte [rax + rbx], dil
jne 0x14018fd81
mov eax, dword [rsp + 0x490]
cmp rax, rbx
jne 0x14018fd9b
mov edi, 1
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x480]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140190660
Capabilities:
Hash data with md5

Disassembly:
test r8d, r8d
je 0x140190742
mov r11, rsp
push rsi
sub rsp, 0x80
xor eax, eax
mov qword [r11 + 8], rbx
mov qword [rcx + 8], rax
mov r9d, r8d
mov qword [rcx + 0x10], rax
mov r8, rdx
mov qword [rcx + 0x18], rax
lea rdx, [r11 - 0x68]
mov qword [r11 - 0x50], rax
xor ebx, ebx
mov qword [r11 - 0x48], rax
mov rsi, rcx
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x68], rbx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [r11 + 0x10], rdi
lea rdi, [rcx + 8]
mov qword [rcx + 0x30], rax
mov byte [rcx + 0x38], al
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
call fcn.1400390f0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140039210
movzx r8d, byte [rdi]
lea ecx, [rbx + rbx]
add rcx, 0x18
lea rdx, [0x14028a478]
add rcx, rsi
call fcn.140006bc0
inc ebx
lea rdi, [rdi + 1]
cmp ebx, 0x10
jb 0x140190705
mov rdi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rsi
ret
Function at 0x1401914a0
Capabilities:
Get user security identifier

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x2150
call fcn.140247340
sub rsp, rax
mov ebx, edx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x150]
mov r8d, 0x1000
call fcn.140249b10
xor edx, edx
lea rcx, [rsp + 0x1150]
mov r8d, 0x1000
call fcn.140249b10
lea rax, [rsp + 0x2180]
mov dword [rsp + 0x2170], 0x1000
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x2178]
lea rax, [rsp + 0x2170]
xor edi, edi
mov qword [rsp + 0x28], rax
lea rdx, str.NT_AUTHORITYSYSTEM
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov dword [rsp + 0x2178], edi
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
lea rax, [rsp + 0x2180]
xor ecx, ecx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x2178]
lea rax, [rsp + 0x2170]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x150]
lea rax, [rsp + 0x1150]
lea rdx, str.NT_AUTHORITYSYSTEM
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x104
call fcn.140249b10
mov eax, dword [rsp + 0x2178]
lea rdx, [rsp + 0x150]
mov r8d, eax
mov dword [rsp + 0x148], 1
lea rcx, [rsp + 0x44]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x14c], ebx
call fcn.1402496a0
mov rax, qword [rsi]
cmp rax, 0xffffffffffffffff
jne 0x1401915ee
mov rcx, qword [rsi + 0x28]
lea r8d, [rdi + 3]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], 0x40000000
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsi], rax
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x2188]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], edi
mov rcx, rax
mov r9d, 0x110
mov qword [rsp + 0x20], rdi
mov edx, 0x9c40201c
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14019162e
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140191630
mov eax, edi
test eax, eax
sete dil
mov eax, edi
add rsp, 0x2150
pop rdi
pop rsi
pop rbx
ret