joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140171120
Capabilities:
Contain obfuscated stackstrings
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0xd8
call fcn.14028b850
sub rsp, rax
mov rax, qword [0x1403710d8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x30], 0x61707865
mov dword [rsp + 0x34], 0x3320646e
mov dword [rsp + 0x38], 0x79622d32
mov dword [rsp + 0x3c], 0x6b206574
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 4]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 8]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0xf8]
mov eax, dword [rax + 0x1c]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x100]
mov eax, dword [rax]
mov dword [rsp + 0x60], eax
mov rax, qword [rsp + 0x100]
mov eax, dword [rax + 4]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x100]
mov eax, dword [rax + 8]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x100]
mov eax, dword [rax + 0xc]
mov dword [rsp + 0x6c], eax
cmp qword [rsp + 0xf0], 0
jbe 0x14017131e
mov qword [rsp + 0x20], 0x40
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0xf0], rax
jae 0x140171259
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.140171340
mov qword [rsp + 0x28], 0
jmp 0x140171284
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x28], rax
jae 0x1401712c6
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0xe8]
add rax, rcx
movzx edx, byte [rax]
mov rax, qword [rsp + 0x28]
movzx eax, byte [rsp + rax + 0x80]
xor edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0xe0]
add rax, rcx
mov byte [rax], dl
jmp 0x140171276
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0xe0]
add rax, rcx
mov qword [rsp + 0xe0], rax
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0xe8]
add rax, rcx
mov qword [rsp + 0xe8], rax
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0xf0]
sub rax, rcx
mov qword [rsp + 0xf0], rax
mov eax, dword [rsp + 0x60]
add eax, 1
mov dword [rsp + 0x60], eax
jmp 0x140171225
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14028a900
add rsp, 0xd8
ret
Function at 0x14019e9e0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14028b850
sub rsp, rax
mov r8d, 0x80
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.MSVCR90.dll_memset
mov dword [rsp + 0x20], 0
jmp 0x14019ea19
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 8
jge 0x14019ea3f
movsxd r8, dword [rsp + 0x20]
lea rax, [0x1402e8960]
movsxd rdx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rax + r8*4]
mov dword [rcx + rdx*4], eax
jmp 0x14019ea0e
add rsp, 0x38
ret
Function at 0x1401a2f20
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14028b850
sub rsp, rax
mov r8d, 0xf0
xor edx, edx
mov rcx, qword [rsp + 0x40]
call sub.MSVCR90.dll_memset
mov dword [rsp + 0x20], 0
jmp 0x1401a2f59
mov eax, dword [rsp + 0x20]
add eax, 1
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 8
jge 0x1401a2f80
movsxd r8, dword [rsp + 0x20]
lea rax, [0x1402e8a20]
movsxd rdx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rax + r8*8]
mov qword [rcx + rdx*8], rax
jmp 0x1401a2f4e
add rsp, 0x38
ret
Function at 0x1401ccad0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x1c8
call fcn.14028b850
sub rsp, rax
mov rax, qword [0x1403710d8]
xor rax, rsp
mov qword [rsp + 0x1b8], rax
mov r8, qword [rsp + 0x200]
lea rdx, str.SHA512
mov rcx, qword [rsp + 0x1f8]
call fcn.140068f00
mov qword [rsp + 0x80], rax
call fcn.1400675e0
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x80], 0
je 0x1401ccb4c
cmp qword [rsp + 0x28], 0
jne 0x1401ccb51
jmp 0x1401ccd52
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
call fcn.140067e10
test eax, eax
je 0x1401ccba4
mov r8d, 0x20
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x28]
call fcn.140067e50
test eax, eax
je 0x1401ccba4
lea r8, [rsp + 0x1b0]
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x28]
call fcn.140068090
test eax, eax
jne 0x1401ccba9
jmp 0x1401ccd52
movzx eax, byte [rsp + 0x90]
and eax, 0xf8
mov byte [rsp + 0x90], al
movzx eax, byte [rsp + 0xaf]
and eax, 0x3f
mov byte [rsp + 0xaf], al
movzx eax, byte [rsp + 0xaf]
or eax, 0x40
mov byte [rsp + 0xaf], al
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
call fcn.140067e10
test eax, eax
je 0x1401ccc52
lea rdx, [rsp + 0xb0]
mov r8d, 0x20
mov rcx, qword [rsp + 0x28]
call fcn.140067e50
test eax, eax
je 0x1401ccc52
mov r8, qword [rsp + 0x1e0]
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x28]
call fcn.140067e50
test eax, eax
je 0x1401ccc52
lea r8, [rsp + 0x1b0]
lea rdx, [rsp + 0xd0]
mov rcx, qword [rsp + 0x28]
call fcn.140068090
test eax, eax
jne 0x1401ccc57
jmp 0x1401ccd52
lea rcx, [rsp + 0xd0]
call fcn.1401d1630
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x110]
call fcn.1401cf9b0
lea rdx, [rsp + 0x110]
mov rcx, qword [rsp + 0x1d0]
call fcn.1401ccdb0
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x28]
call fcn.140067e10
test eax, eax
je 0x1401ccd18
mov r8d, 0x20
mov rdx, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x28]
call fcn.140067e50
test eax, eax
je 0x1401ccd18
mov r8d, 0x20
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x28]
call fcn.140067e50
test eax, eax
je 0x1401ccd18
mov r8, qword [rsp + 0x1e0]
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x28]
call fcn.140067e50
test eax, eax
je 0x1401ccd18
lea r8, [rsp + 0x1b0]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call fcn.140068090
test eax, eax
jne 0x1401ccd1a
jmp 0x1401ccd52
lea rcx, [rsp + 0x40]
call fcn.1401d1630
mov rcx, qword [rsp + 0x1d0]
add rcx, 0x20
lea r9, [rsp + 0xd0]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x40]
call fcn.1401d3710
mov dword [rsp + 0x20], 1
mov edx, 0x40
lea rcx, [rsp + 0xd0]
call fcn.1400a6750
mov edx, 0x40
lea rcx, [rsp + 0x90]
call fcn.1400a6750
mov rcx, qword [rsp + 0x80]
call fcn.140069830
mov rcx, qword [rsp + 0x28]
call fcn.140067610
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x1b8]
xor rcx, rsp
call fcn.14028a900
add rsp, 0x1c8
ret
Function at 0x1401d9340
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x178
call fcn.14028b850
sub rsp, rax
mov rax, qword [0x1403710d8]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov r8d, 0x20
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x118]
call fcn.14028a8de
movzx eax, byte [rsp + 0x118]
and eax, 0xf8
mov byte [rsp + 0x118], al
movzx eax, byte [rsp + 0x137]
and eax, 0x7f
mov byte [rsp + 0x137], al
movzx eax, byte [rsp + 0x137]
or eax, 0x40
mov byte [rsp + 0x137], al
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x70]
call fcn.1401cf9b0
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x48]
call fcn.1401cff80
lea r8, [rsp + 0x98]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x20]
call fcn.1401cffe0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x138]
call fcn.1401ce830
lea r8, [rsp + 0x138]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1401cd320
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x180]
call fcn.1401cce60
mov edx, 0x20
lea rcx, [rsp + 0x118]
call fcn.1400a6750
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14028a900
add rsp, 0x178
ret
Function at 0x1401e1a80
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.14028b850
sub rsp, rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x68]
cmp dword [rsp + 0x70], eax
jne 0x1401e1ad6
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax]
cmp eax, 0x6a
je 0x1401e1b0f
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax]
cmp eax, 0x6b
je 0x1401e1b0f
call fcn.140088000
lea r8, str.RSA_padding_check_X931
mov edx, 0x43
lea rcx, str.....Srcopenssl_3.0.12crypto_rsa_rsa_x931.c
call fcn.1400881c0
xor r8d, r8d
mov edx, 0x89
mov ecx, 4
call fcn.140088360
mov eax, 0xffffffff
jmp 0x1401e1c85
mov rax, qword [rsp + 0x20]
movzx ecx, byte [rax]
mov rax, qword [rsp + 0x20]
add rax, 1
mov qword [rsp + 0x20], rax
cmp ecx, 0x6b
jne 0x1401e1c17
mov eax, dword [rsp + 0x68]
sub eax, 3
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x28], 0
jmp 0x1401e1b4e
mov eax, dword [rsp + 0x28]
add eax, 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2c]
cmp dword [rsp + 0x28], eax
jge 0x1401e1bca
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax]
mov byte [rsp + 0x30], al
mov rax, qword [rsp + 0x20]
add rax, 1
mov qword [rsp + 0x20], rax
movzx eax, byte [rsp + 0x30]
cmp eax, 0xba
jne 0x1401e1b80
jmp 0x1401e1bca
movzx eax, byte [rsp + 0x30]
cmp eax, 0xbb
je 0x1401e1bc5
call fcn.140088000
lea r8, str.RSA_padding_check_X931
mov edx, 0x4e
lea rcx, str.....Srcopenssl_3.0.12crypto_rsa_rsa_x931.c
call fcn.1400881c0
xor r8d, r8d
mov edx, 0x8a
mov ecx, 4
call fcn.140088360
mov eax, 0xffffffff
jmp 0x1401e1c85
jmp 0x1401e1b43
mov ecx, dword [rsp + 0x28]
mov eax, dword [rsp + 0x2c]
sub eax, ecx
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x28], 0
jne 0x1401e1c15
call fcn.140088000
lea r8, str.RSA_padding_check_X931
mov edx, 0x56
lea rcx, str.....Srcopenssl_3.0.12crypto_rsa_rsa_x931.c
call fcn.1400881c0
xor r8d, r8d
mov edx, 0x8a
mov ecx, 4
call fcn.140088360
mov eax, 0xffffffff
jmp 0x1401e1c85
jmp 0x1401e1c22
mov eax, dword [rsp + 0x68]
sub eax, 2
mov dword [rsp + 0x2c], eax
movsxd rcx, dword [rsp + 0x2c]
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + rcx]
cmp eax, 0xcc
je 0x1401e1c6d
call fcn.140088000
lea r8, str.RSA_padding_check_X931
mov edx, 0x5f
lea rcx, str.....Srcopenssl_3.0.12crypto_rsa_rsa_x931.c
call fcn.1400881c0
xor r8d, r8d
mov edx, 0x8b
mov ecx, 4
call fcn.140088360
mov eax, 0xffffffff
jmp 0x1401e1c85
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.14028a8de
mov eax, dword [rsp + 0x2c]
add rsp, 0x48
ret
Function at 0x1401f7b50
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.14028b850
sub rsp, rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 5
je 0x1401f7ba4
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
call fcn.1401f74d0
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jg 0x1401f7ba4
mov eax, dword [rsp + 0x20]
jmp 0x1401f7c02
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r11, qword [rsp + 0x40]
movsxd rcx, dword [r11 + 0x38]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, qword [rsp + 0x40]
call fcn.1400654e0
cmp dword [rsp + 0x20], 0
jg 0x1401f7bfe
mov ecx, dword [rsp + 0x20]
call fcn.14012ac70
test eax, eax
je 0x1401f7bfe
mov edx, 0xa
mov rcx, qword [rsp + 0x40]
call fcn.140065530
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x1401f8400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x48
call fcn.14028b850
sub rsp, rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
xor edx, edx
mov rax, qword [rsp + 0x68]
mov ecx, 8
div rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x68]
cmp qword [rsp + 0x60], rax
jb 0x1401f8558
mov qword [rsp + 0x28], 0
jmp 0x1401f8468
mov rax, qword [rsp + 0x28]
add rax, 1
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x28], rax
jae 0x1401f8537
mov rax, qword [rsp + 0x58]
movzx edx, byte [rax]
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 1]
shl rax, 8
or rdx, rax
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 2]
shl rax, 0x10
or rdx, rax
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 3]
shl rax, 0x18
or rdx, rax
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 4]
shl rax, 0x20
or rdx, rax
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 5]
shl rax, 0x28
or rdx, rax
mov rax, qword [rsp + 0x58]
movzx eax, byte [rax + 6]
shl rax, 0x30
or rdx, rax
mov rax, qword [rsp + 0x58]
movzx ecx, byte [rax + 7]
shl rcx, 0x38
mov rax, rdx
or rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
add rax, 8
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x38]
call fcn.1401f9200
mov r11, rax
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rax + rdx*8]
xor rdx, r11
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x28]
mov qword [rcx + rax*8], rdx
jmp 0x1401f845a
mov rcx, qword [rsp + 0x50]
call fcn.1401f8570
mov r11, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
sub rax, r11
mov qword [rsp + 0x60], rax
jmp 0x1401f843f
mov rax, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x140270750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x18
call fcn.14028b850
sub rsp, rax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax]
mov byte [rsp + 6], al
movzx eax, byte [rsp + 6]
sar eax, 7
mov byte [rsp + 5], al
mov dword [rsp], 0
jmp 0x14027079f
mov eax, dword [rsp]
add eax, 1
mov dword [rsp], eax
movzx eax, byte [rsp + 4]
mov byte [rsp + 6], al
mov eax, dword [rsp + 0x30]
sub eax, 1
cmp dword [rsp], eax
jge 0x1402707e0
mov eax, dword [rsp]
add eax, 1
movsxd rcx, eax
mov rax, qword [rsp + 0x28]
movzx eax, byte [rax + rcx]
mov byte [rsp + 4], al
movsxd rdx, dword [rsp]
movzx eax, byte [rsp + 4]
sar eax, 7
movzx ecx, byte [rsp + 6]
shl ecx, 1
or ecx, eax
mov rax, qword [rsp + 0x20]
mov byte [rax + rdx], cl
jmp 0x14027078d
cmp dword [rsp + 0x30], 0x10
jne 0x1402707f1
mov dword [rsp + 8], 0x87
jmp 0x1402707f9
mov dword [rsp + 8], 0x1b
movzx edx, byte [rsp + 6]
shl edx, 1
movzx ecx, byte [rsp + 5]
xor eax, eax
sub eax, ecx
and eax, dword [rsp + 8]
xor edx, eax
movsxd rcx, dword [rsp]
mov rax, qword [rsp + 0x20]
mov byte [rax + rcx], dl
add rsp, 0x18
ret
Function at 0x14027e490
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov rdi, r9
mov r10, rdx
mov r11, rcx
movsxd r9, r8d
test r8d, r8d
jle 0x14027e4f3
mov qword [rsp + 0x10], rbx
mov rbx, qword [rsp + 0x30]
sub r11, rdx
mov r8d, dword [rbx]
inc r10
mov edx, r8d
mov ecx, r8d
and r8d, 0xf
sar edx, 8
sar ecx, 4
add edx, 0xfffffffb
add ecx, 5
and edx, 0xf
and ecx, 0xf
movzx eax, byte [rdx + rdi]
sub al, byte [rcx + rdi]
add al, byte [r11 + r10 - 1]
xor al, byte [r8 + rdi]
mov byte [r10 - 1], al
inc dword [rbx]
sub r9, 1
jne 0x14027e4b0
mov rbx, qword [rsp + 0x10]
xor eax, eax
pop rdi
ret

Function at 0x14027f190
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rbp, r8
mov edi, edx
mov r12, rcx
test rcx, rcx
jne 0x14027f1c3
mov ebx, 0x22100003
mov eax, ebx
jmp 0x14027f2fa
mov ecx, reloc.WS2_32.dll_recv
call fcn.14027cfd0
mov rsi, rax
test rax, rax
jne 0x14027f1df
mov ebx, 0x22100004
jmp 0x14027f2e3
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call fcn.14027dfa0
cmp dword [0x1403778d0], 0
mov dword [rsi], 0x8f
jne 0x14027f21c
lea rcx, [0x1403778d4]
call fcn.14027f120
mov ebx, eax
test eax, eax
jne 0x14027f2e3
mov dword [0x1403778d0], 1
cmp dword [0x1403778d4], 1
mov ecx, 3
jne 0x14027f22f
mov r8d, ecx
jmp 0x14027f23d
mov r8d, 7
bt edi, 0x12
cmovb r8d, ecx
test dil, 1
je 0x14027f249
test dil, 2
jne 0x14027f24f
test dil, 4
je 0x14027f256
mov edx, 0xc0000000
jmp 0x14027f267
test dil, 2
mov edx, 0x80000000
mov eax, 0x40000000
cmovne edx, eax
bt edi, 8
jae 0x14027f27b
mov eax, edi
and eax, 0x400
neg eax
sbb ecx, ecx
add ecx, 2
bt edi, 0x10
jae 0x14027f285
and r8d, 0xfffffffe
bt edi, 0x11
jae 0x14027f28f
and r8d, 0xfffffffd
mov eax, 0x80
mov r9d, 0x180
mov qword [rsp + 0x30], 0
bt edi, 0x14
cmovb eax, r9d
xor r9d, r9d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14027f2f4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14027f2de
mov ebx, 0x22100005
cmp eax, 3
jne 0x14027f2e3
mov ebx, 0x22100009
test rsi, rsi
je 0x14027f2f0
mov rcx, rsi
call fcn.14027cfe0
mov eax, ebx
jmp 0x14027f2fa
mov qword [rbp], rsi
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x14027fab0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14027fac9
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x140332060]
cmp r11d, 8
jb 0x14027fbc2
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
sub rbx, 1
jne 0x14027faf0
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x14027fbf0
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r11d, 0xffffffff
jne 0x14027fbd0
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x1402834a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1403710d8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
test edx, edx
je 0x1402834ca
call qword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1402834e7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [rbx + 0x14]
cmp eax, edx
jb 0x1402834e7
mov ecx, eax
sub ecx, edx
cmp ecx, 0x927c0
jb 0x140283581
lea r8, [0x140299d48]
lea rdx, [0x1403328e0]
xor r9d, r9d
mov rcx, 0xffffffff80000002
mov dword [rbx + 0x14], eax
mov dword [rsp + 0x20], 1
call fcn.1402878f0
xor edx, edx
test eax, eax
mov ecx, edx
setne cl
cmp dword [rbx + 0x10], ecx
je 0x140283581
mov dword [rbx + 0x10], ecx
test ecx, ecx
mov rcx, rbx
je 0x14028357c
call fcn.1402829b0
lea rcx, [rsp + 0x32]
mov r8d, 0x206
mov word [rsp + 0x30], dx
call sub.MSVCR90.dll_memset
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r8, [0x1403328dc]
mov edx, 0xa
mov rcx, rbx
call fcn.1402830b0
lea r8, [rsp + 0x30]
mov edx, 0xa
mov rcx, rbx
call fcn.140283420
jmp 0x140283581
call fcn.140282980
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14028a900
add rsp, 0x250
pop rbx
ret
Function at 0x140286880
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1402868de
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x34], eax
jmp 0x140286905
cmp qword [rsp + 0x68], 0
je 0x140286905
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x60], eax
jae 0x1402868fa
mov dword [rsp + 0x34], 0x10dd
jmp 0x140286905
mov rcx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x30]
mov dword [rcx], eax
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x140286910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140286966
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x34], eax
jmp 0x140286979
cmp qword [rsp + 0x68], 0
je 0x140286979
mov rcx, qword [rsp + 0x68]
mov eax, dword [rsp + 0x30]
mov dword [rcx], eax
mov eax, dword [rsp + 0x34]
add rsp, 0x48
ret

Function at 0x140286a30
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x24], 0
xor edx, edx
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0xffffffff
jne 0x140286a6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x24], eax
jmp 0x140286a78
mov rcx, qword [rsp + 0x48]
mov eax, dword [rsp + 0x20]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
add rsp, 0x38
ret

Function at 0x140286a90
Capabilities:
Clear file content

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x2c]
mov rcx, qword [rsp + 0x40]
call fcn.140286a00
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x140286b29
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.140286990
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x140286b29
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140286b11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x40]
call fcn.140286990
jmp 0x140286b29
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsp + 0x40]
call fcn.140286990
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
add rsp, 0x38
ret