joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14093f40e
Capabilities:
Authenticate hmac

Disassembly:
mov r12, rdi
push r12
jbe 0x14088ca7a
xchg qword [rsp + r9 - 0x6f0ebb9c], rax
mov rcx, qword [rsp + rcx - 0x106ff97]
and byte [rsp + r12 - 0x106ffff], 0x38
add qword [rsp + r9 - 0x6f0ebbb4], 0xffffffffbf67d423
test dword [rsp + r9 - 0x6f0ebc09], edi
movabs r9, 0x129d608efe25c829
not qword [rsp + rdi*4 - 0x41bfffc]
mov r12, qword [rsp + 0x10]
jbe 0x140932af7
add qword [rsp + 0x20], 0xffffffffbf6493b5
mov r9d, 0x6d877c2e
and di, 0xca35
mov rdi, qword [rsp + rdi - 0x106ca1d]
setb r9b
neg word [rsp + r9 - 0x6d877c00]
shl r9, 0xfa
call fcn.140926398
push 0xffffffffd3b7ecbc
pushfq
add qword [rsp + 0x18], 0xffffffffbf6373ae
mov qword [rsp + 0x18], 0xffffffffb7d9e121
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.1409c662a

Function at 0x1409413c7
Capabilities:
Authenticate hmac

Disassembly:
and r11w, 0xbbaa
ja 0x14088990f

Function at 0x14094bc21
Capabilities:
Authenticate hmac

Disassembly:
lea rbx, [rbx - 0x185f9f4d]
lea r15, [r8 + rdx*8 - 0x5f6fa255]
xor r15b, 0x19
and dx, 0x8e3a
cmp r15, 0x5b9419b4
mov qword [rsp + 0x30], r15
mov word [rsp + 0x30], 0x23a5
cmovno r15d, r8d
xchg qword [rsp + 0x38], rbx
mov r15, qword [rsp + 0x20]
movabs r10, 0xf9382f97ad1cafbc
call fcn.1409622fe
neg qword [rsp + rbx*2 - 0x46e00]
mov rbx, qword [rsp + rbx - 0x236c0]
call fcn.14096226e
mov r14, qword [rsp + r14*2 - 0xc]
mov byte [rsp + 0x10], 0xd
or qword [rsp + 0x10], 0xffffffffbe2ced9c
call fcn.14096fb95
pop rdi
call fcn.140935042
call fcn.14096012e
jge 0x140982ba0
mov qword [rsp + 0x18], rbx
not bl
mov qword [rsp], r11
lea rsi, [rsi - 0x4b4f2c78]
shr word [rsp], 0x63
lea rsp, [rsp + 8]
ret
jge 0x14093f546
jle 0x1408915b1
xor r15w, 0xff31
and dx, r15w
test edx, edx
js 0x140967ee5

Function at 0x14094bc4b
Capabilities:
Encode data using base64

Disassembly:
neg esi
mov r9, qword [rsp + 0x10]
neg qword [rsp + 0x48]
shr word [rsp + 0x48], 0xb9
or esi, dword [rsp + 0x4c]
cmp esi, dword [rsp + 0x4b]
jns 0x140980f6f
jo 0x140924fed
neg word [rsp + 0x48]
add si, 0x7883
jg 0x140907537

Function at 0x1409595ac
Capabilities:
Encode data using xor

Disassembly:
mov r10, r15
add r10w, r15w
mov r15, qword [rsp + 0x30]
mov edi, dword [rsp + 0x30]
not r10
cmp r14w, 0x2536
setne byte [rsp + 0x58]
cmp r14d, 0x950f2536
and al, 0x58
add word [rsp + 0x50], 0xe3b2
mov r10, qword [rsp + 0x10]
add qword [rsp + 0x50], 0x340ce29d
jne 0x14095beec
jge 0x1409595bc
jnp 0x140959612
invalid
out 0x4e, eax
adc dword [rbx + 0x30], 0x86c90bd9
jge 0x1409595b4
fxam
and bh, byte [rcx + rdi*4]
cld
xlatb
invalid

Function at 0x14095f112
Capabilities:
Encode data using base64

Disassembly:
je 0x1408f9ca2
jg 0x1409936a2
shl word [rsp + 0x58], 0x61
call fcn.1408ab880

Function at 0x14095f15f
Capabilities:
Encode data using base64

Disassembly:
pop rsi
call fcn.14093e6ef
pop rdx
call fcn.14096c6e2

Function at 0x14095f16b
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
test cl, cl
lea rcx, [rcx + rcx*8 - 0x70cba7dd]
lea rcx, [rcx + rcx*8 + 0x380e7636]
call fcn.14094bc21
test r14w, 0x3c0d
call fcn.1408872c2
jae 0x140898620
and al, 0xb7
loopne 0x14095f136
adc edi, dword [rax + 0x2f]
jmp 0x113e9c8d4
Function at 0x14096012e
Capabilities:
Authenticate hmac

Disassembly:
mov rax, qword [rsp + 0x28]
push r9
movabs r9, 0x9885b533331f320f
movsx r9w, cl
lea r9, [r9 + rcx*8 + 0x9034a85]
not cl
jb 0x1409aa1e0
lea rax, [rax + 1]
and rcx, rcx
test cx, 0x9c31
jbe 0x14093f419
push r11
ja 0x1409144c8

Function at 0x1409617dd
Capabilities:
Authenticate hmac

Disassembly:
sub sil, 0x89
sub rsi, 0xffffffffd2232dae
mov qword [rsp + 0x38], r13
sets cl
add cl, byte [rsp + rsi - 0x2decb21d]
cmp ecx, esi
mov byte [rsp + rsi*2 - 0x5bd96480], 0xe
push r10

Function at 0x14096677f
Capabilities:
Authenticate hmac

Disassembly:
add r8d, 0x43b1851e
cmp byte [rsp + 0x20], 0x80
lea rbp, [rbp - 0x6fcf3efd]
setbe byte [rsp + 0x28]
or byte [rsp + 0x28], r8b
push r13
add qword [rsp + 0x28], r8
bswap r8
mov r13, qword [rsp + 0x30]
or r8b, 0x9c
xchg qword [rsp + r13*2 - 0x40621e5a], rbp
mov r13, qword [rsp + r13*2 - 0x40621e9a]
jl 0x140968ced
cmp dword [rsp + 0x30], 0xc9011920

Function at 0x1409697f4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
movabs r10, 0x6ab12853f839600
add qword [rsp + 0x10], 0xffffffffbf77caaf
call fcn.14093013d
mov bp, 0x3182
mov rbp, qword [rsp + 0x10]
mov rbp, qword [rbp + riz]
mov qword [rsp + 8], 0x28842204
mov qword [rsp + 0x10], 0x563062a3
call fcn.14091bf0d
jb 0x140883796
jae 0x14088bcd6
push rbp
movabs rbp, 0x4189e705eba05496
pushfq
test bpl, 0xb0
add qword [rsp + 0x10], 0xfffffffffffe45ea
movabs rbp, 0xc2b7021f198d7bb3
neg ebp
jb 0x14089c572
call fcn.1409229af

Function at 0x14096f33e
Capabilities:
Authenticate hmac

Disassembly:
cmp dword [rsp + 0x60], 0xc3845992
not byte [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
js 0x14088f8a4
ja 0x14088c8f6
int1
invalid

Function at 0x1409735d5
Capabilities:
Authenticate hmac

Disassembly:
mov r8d, 0xa8aa798d
push rbx
mov qword [rsp + 0x38], rdi
setl r8b
push r12
push r13
mov r13, r8
xor r8, 0xffffffffcfb9c618
movabs rbx, 0x550092a24fa5b691
shr r13w, 1
jns 0x14099963f

Function at 0x14098d341
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
ja 0x1408831e6
ja 0x1409358fb
shl r8, 0xd
neg r13
cmp r9d, r8d
lea r9, [r13*4 - 0x5dd0e3ff]
xchg qword [rsp + 0x50], rdx
mov r9, qword [rsp + 0x40]
jg fcn.1409868f5
lea r8, [r13 + r13*8 + 0x739b0534]
call fcn.140956623
shl byte [rsp + r11*2 - 0x406a17d0], 0x1f
push r9
add qword [rsp + 0x30], 0x26e0b

Function at 0x14099094b
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
movzx rdi, di
and byte [rsp + rdi - 0xc7], 6
xor di, word [rsp + rdi*2 - 0x1c4]
mov rdi, qword [rsp + rdi*8 - 0x6e720]
xor dword [rsp + 0x38], 0x43277d8a
sub qword [rsp + 0x38], 0x78312e31
and byte [rsp + 0x38], 5
and word [rsp + 0x38], 0x179c
js fcn.14091ea5c
Function at 0x14099f70e
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
mov rcx, qword [rsp + rcx*2 - 0x1b04a]
mov rcx, qword [rcx + r9*8]
call fcn.1409ae55b
call fcn.14091b40d
and dword [rax], eax
add byte [rax], al
mov al, 0x8d
mov byte [rax], al
retf 0x888d
mov r15, rbx
xchg qword [rsp + rdi - 0x76983fe9], rdx
mov r9, qword [rsp + rdi - 0x76984009]
mov bl, byte [rsp + rdi - 0x76983fef]
call fcn.140951317
xor byte [rbx], al
push rsp
and al, byte [rdi - 0x77d2f4a4]
add edx, dword [rdx + rbx + 0x13]
jge 0x1409487a8
bnd jmp 0x16759e83b
rep lodsd eax, dword [rsi]
invalid
cmova r13d, dword [rsp + r13 + 9]
setne byte [rsp + 0x68]
bswap r9
jne 0x140948749
shr ebp, 0x5b
cmovb r9w, bp
mov r9, qword [rsp + rbp + 0x12]
xor dword [rsp + r13 + 0x68], ebp
cmovbe ebp, r13d
jg 0x14088dbe2
not word [rsp + r13*4 + 0x68]
mov rbp, qword [rsp + rbp + 0x1a]
cmp word [rsp + r13*2 + 0x68], 0x9094
movsx r13d, byte [rsp + r13 + 0x6b]
sete byte [rsp + 0x68]
jo fcn.14088d7f3
not r13w
mov r13, qword [rsp + 0x50]
mov byte [rsp + 0x68], 0x9c
test byte [rsp + 8], 9
jge 0x1409ac478
cmp ah, byte [rcx + rax + 0x26836532]
or eax, 0x22a90c5a
jne 0x14099f811
invalid
outsb dx, byte [rsi]
xchg ebx, eax
push 0x21
rcl byte [rdi + 0x35], cl
sbb cl, byte [rax - 0x77]
invalid
jbe 0x14090ba3b

Function at 0x1409a65d1
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
xor qword [rsp + 0x58], 0xffffffffa2846233
jne 0x14001294c
pop rbp
call fcn.14088ea28
push rdx
push r15
movabs r15, 0xc025cf007185f60c
pushfq
neg r15d
jg 0x1409a9836
or r15, 0xffffffffb599e831
call fcn.140898804
jl 0x14099f6d6

Function at 0x1409a982f
Capabilities:
Authenticate hmac

Disassembly:
setne bl
push rbx
mov rcx, rsi
mov rbx, qword [rsp + 0x28]
mov rbx, qword [rbx]
jne 0x14095c73e

Function at 0x1409aaa69
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
je 0x140941424
jns 0x14098304a

Function at 0x1409ab51a
Capabilities:
Encode data using base64

Disassembly:
movabs r15, 0xd529a78623001935
cmovb r15, rsi
or esi, r15d
jbe fcn.140928367
shr esi, 0x4f
mov qword [rsp + rsi*4 - 0x117d8], r15
push r12
push r9
lea rdx, [rdx + rsi*2 - 0x546b16de]
ja 0x14099effc
sub rsi, 0x549ed59a
mov qword [rsp + 0x28], rdx
neg rsi
sub si, 0xf630
cmp rsi, 0x540c0d1d
movzx rsi, si
jb 0x1409ac0ed
shr rsi, 0xa4
push r15
add qword [rsp + 0x20], 0xffffffffffffd40b
shl esi, 0x3d
movabs rdx, 0x55133c8363197e0c
and dx, 0x33a5
push rcx
mov rdx, qword [rsp + rsi*4 + 0x28]
mov rdx, qword [rdx + rsi*2]
jae 0x140891c50
Function at 0x1413f6bde
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
cmp r11b, dl
xor edi, edi
xchg rbx, r10
mov r10d, r9d
movzx ebx, r8b
inc r9
not r8d
mov r11, rcx
movsx r10d, r13w
cmovle r9w, di
mov r9b, 0xa2
mov r8, rdi
nop
movsx r10d, ax
movzx r10w, r8b
movzx r9d, byte [r11]
movzx r10d, byte [rdx]
jmp 0x1413f6c26
inc r11
jmp 0x1413f6c2e
inc rdx
test cx, r11w
test r11w, 0xde27
clc
test bl, bl
je 0x1413f6c63
mov ecx, r8d
mov eax, 0xca81118b
stc
clc
rol eax, cl
add al, r8b
jmp 0x1413f6c58
xor r9b, al
jmp 0x1413f6c60
inc r8
test r9b, r9b
jmp 0x1413f6c6b
je 0x1413f6c7f
cmp r9b, r10b
jmp 0x1413f6c79
je 0x1413f6c19
cmp r9b, r10b
jmp 0x1413f6c87
jae 0x1413f6ca2
or eax, 0xffffffff
mov bl, r9b
cmovno rdi, r15
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
seta dil
cbw
lahf
cmovne rax, rbx
mov eax, edi
movzx di, r15b
mov rdi, qword [rsp + 0x10]
jmp 0x1413f6cc3
ret
Function at 0x180001390
Capabilities:
Hide thread from debugger

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtSetInformationThread
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800013d6
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
mov rcx, rbx
call rax
test eax, eax
jne 0x1800013d2
mov al, 1
jmp 0x1800013d6
jmp 0x1800013d6
add rsp, 0x20
pop rbx
ret

Function at 0x1800014e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18000151b
call fcn.180001390
xor eax, eax
lea r8, [0x1800013e0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180008e20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180008e7d
lea rbx, [0x1800b6da0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180008e64
cmp r10, 2
jb 0x180008e64
cmp byte [r9], r8b
jne 0x180008e64
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180008e40
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180008ebf
lea rbx, [0x1800b6da0]
cmp r8b, 0x23
jne 0x180008ea3
cmp byte [r9], r8b
jne 0x180008ea3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180008e90
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180009000
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18000901a
mov qword [r8], 0
lea rdx, [0x1800bc270]
call fcn.180008ed0
mov rbx, rax
test rax, rax
jne 0x18000903a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180009111
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180009111
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180009111
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180009111
cmp rdi, 0xffffffffffffffff
je 0x180009111
mov rax, qword [0x1800ce2f8]
test rax, rax
je 0x1800090ae
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180009111
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1800090fe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1800ce2f8]
test rax, rax
je 0x1800090f3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18000911a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18000910c
mov qword [r14], rdi
mov rax, rsi
jmp 0x18000911c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18000b950
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xf8]
lea r10, [0x1800b6da0]
mov r8, rdx
mov r9, rcx
movsxd rdx, dword [rcx + 0xf0]
mov ebx, dword [rax + rdx*4 - 4]
not ebx
movzx eax, r8b
movzx edx, bl
xor rdx, rax
shr ebx, 8
mov rax, r8
shr rax, 8
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x10
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x38
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x18000ba3f
mov edx, listen
mov ecx, ebx
call fcn.18001e3b0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18000ba50
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x1800b6da0]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x18000bae6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18001e3b0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x18000ef70
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18000efc0
lea r11, [0x1800b6da0]
nop dword [rax]
cmp r9b, 0x23
jne 0x18000efa3
cmp byte [r8], r9b
jne 0x18000efa3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18000ef90
mov rcx, qword [0x1800ce2f8]
not eax
movsxd rdx, dword [rcx + 0x3eb0]
mov r9, qword [rcx + 0x3eb8]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18000f021
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18000f019
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000f01c
mov rdx, r8
test rdx, rdx
jne 0x18000eff0
cmp r9, r10
je 0x18000f030
cmp dword [r9], eax
jne 0x18000f030
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x18001cd70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c80], 0
lea rbx, [rcx + 0x5c88]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18001ce17
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x18001cdca
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001f4e0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1800093b0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c80]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c90]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1800ce2f0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18001ce1f
mov rcx, rbx
call fcn.1800093b0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18001d2a0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1800ce2f8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18001d303
mov qword [rsp], rbx
lea rbx, [0x1800b6da0]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001d2e3
cmp byte [r8], r9b
jne 0x18001d2e3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18001d2d0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bf8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x18001d337
mov r10, qword [r10 + 0x5c00]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x18001d33e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x18001d324
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x18005d7c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xaaf], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x18005d88b
cmp qword [rcx + 0x260], 0
je 0x18005d83e
mov qword [rsp + 0x40], rbx
call fcn.18004b7c0
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.18004bb30
mov rcx, qword [rdi + 0x1d8]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x260]
movzx edx, bl
mov rcx, rdi
call fcn.18004bb30
mov rbx, qword [rsp + 0x40]
jmp 0x18005d88b
mov ecx, esi
test edx, edx
je 0x18005d84e
sub ecx, 1
je 0x18005d84e
cmp ecx, 1
jne 0x18005d88b
mov r9, qword [rdi + 0x1d0]
lea rax, [0x1800a8410]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x18005fa90
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x18005fda0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x18005fdca
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1800a8778]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x18005fe2a
mov rcx, rbx
test r14, r14
je 0x18005fe17
xor edx, edx
lea r8d, [rdx + 8]
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test r14, r14
je 0x18005fe61
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005fe61
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x18005ff28
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop word [rax + rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x18005fe90
lea ecx, [rax + 1]
add rcx, rdx
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x18005ff1a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18005ff1a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x18005fec0
mov word [rax + rdi], 0x5c
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x18005fed1
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x18005fef0
mov rcx, rdi
test r14, r14
je 0x18005ff11
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x18005ff17
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.1800a4296]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret