joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140175e44
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140232738]
mov edi, ecx
lea rdx, [0x140232738]
mov ecx, 3
lea r8, [0x140232730]
call fcn.140175bc4
mov rsi, rax
test rax, rax
je 0x140175e90
mov rcx, rax
call fcn.14017464c
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x140175e9b
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140176364
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140176138
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140176138
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140176138
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140176138
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140176138
cmp dword [rcx + 0x84], 0xe
jbe 0x140176138
cmp dword [rcx + 0xf8], esi
je 0x140176138
mov ecx, r14d
call fcn.140176280
mov ecx, 2
call fcn.14018dc8c
nop
cmp byte [0x14027ca80], 0
jne 0x140176202
mov r15d, 1
mov eax, r15d
xchg dword [0x14027ca70], eax
test ebx, ebx
jne 0x1401761ab
mov rdi, qword [0x140274dd0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14027ca78]
cmp rcx, rax
je 0x1401761a2
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x1401a4890]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14027d138]
jmp 0x1401761b7
cmp ebx, r15d
jne 0x1401761bd
lea rcx, [0x14027d150]
call fcn.14018d01c
nop
test ebx, ebx
jne 0x1401761d4
lea rdx, [0x1401a4c60]
lea rcx, [0x1401a4c40]
call fcn.14018ca00
lea rdx, [0x1401a4db0]
lea rcx, [0x1401a4c68]
call fcn.14018ca00
movzx eax, byte [0x14027ca80]
test esi, esi
cmove eax, r15d
mov byte [0x14027ca80], al
jmp 0x140176202
mov ecx, 2
call fcn.14018dce0
test esi, esi
jne 0x140176219
mov ecx, r14d
call fcn.140176234
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1401760c8
Function at 0x14018eb44
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x14018e9e4
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14018d65c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14018e9cc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x14018e9cc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14018ea16
lock or dword [rax + 0x14], 0x10
jmp 0x14018e9cc
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14018ea33
mov rcx, qword [rbp + 0x10]
call fcn.140194240
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140187034
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.14018acc8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x14018ea8a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x14018e9cc
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x14018eaf6
mov rcx, qword [rbp + 0x10]
call fcn.140187034
cmp eax, 0xffffffff
je 0x14018eadd
mov rcx, qword [rbp + 0x10]
call fcn.140187034
cmp eax, 0xfffffffe
je 0x14018eadd
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140187034
movsxd rdi, eax
lea rsi, [0x14027cbe0]
mov rcx, rbx
sar rdi, 6
call fcn.140187034
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x14018eae4
lea rax, [0x1402750c0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14018eaf6
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x14018eb2c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x14018eb28
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x14018eb28
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14018e9cf
jmp 0x14018e99c

Function at 0x1401903ec
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401903c9
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14018d65c
or eax, 0xffffffff
jmp 0x1401903e6
sub dword [rcx + 0x10], 1
jns 0x1401903d8
add rsp, 0x28
jmp fcn.14018eb44
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1401903a8
Function at 0x140191294
Capabilities:
Create thread
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.14018e67c
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x1401912e7
test rbx, rbx
je 0x1401912d8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x1401912e7
mov edi, 4
jmp 0x140191390
call fcn.14018e484
test al, al
jne 0x140191304
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x140191390
test bpl, bpl
je 0x140191367
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x14019126c]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140191390
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x140191361
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140191390
mov edi, dword [rsp + 0x44]
jmp 0x140191359
call fcn.14018e5a8
test al, al
jne 0x140191378
bts esi, 0x15
xor ecx, ecx
jmp 0x140191380
call fcn.14018e4e0
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.14018e370
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret

Function at 0x140198f30
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
cmp qword [0x14027d5f8], 0
je 0x140198feb
cmp dword [0x14027d614], 0
je 0x140198feb
call fcn.14019d080
test eax, eax
je 0x140198fb3
mov r9d, dword [0x14027d614]
lea rdx, [rsp + 0x30]
mov r8, qword [0x14027d608]
xor ecx, ecx
call fcn.14019c680
test rax, rax
je 0x140198fb3
movsxd rdx, dword [rsp + 0x30]
mov r8d, 1
mov r9, qword [0x14027d5f8]
mov rcx, rax
call fcn.14017e404
movsxd rax, dword [0x14027d614]
add qword [0x14027d600], rax
mov dword [0x14027d614], 0
call fcn.1401991c0
add rsp, 0x28
ret
movsxd rdx, dword [0x14027d614]
mov r8d, 1
mov r9, qword [0x14027d5f8]
mov rcx, qword [0x14027d608]
call fcn.14017e404
movsxd rax, dword [0x14027d614]
add qword [0x14027d600], rax
mov dword [0x14027d614], 0
add rsp, 0x28
ret

Function at 0x140199440
Capabilities:
Write file on windows

Disassembly:
cmp qword [0x14027d700], 0
jne fcn.14019b370
jmp fcn.140198f30
Function at 0x140199570
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp dword [0x14027d638], 0
mov rbp, rcx
movsxd rsi, edx
jne 0x1401995b2
call fcn.14019d080
test eax, eax
jne 0x1401995b2
mov r9, qword [0x14027d5f8]
lea r8d, [rax + 1]
mov rdx, rsi
mov rcx, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.14017e404
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
nop dword [rax]
movsxd rcx, dword [0x14027d614]
mov edi, esi
mov eax, dword [0x14027d618]
mov rdx, rbp
sub eax, ecx
cmp esi, eax
cmovge edi, eax
add rcx, qword [0x14027d608]
movsxd rbx, edi
mov r8, rbx
call fcn.140174c80
add dword [0x14027d614], edi
add rbp, rbx
sub esi, edi
je 0x140199610
cmp qword [0x14027d700], 0
je 0x140199609
call fcn.14019b370
jmp 0x1401995c0
call fcn.140198f30
jmp 0x1401995c0
cmp dword [0x14027d638], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jne 0x140199641
cmp qword [0x14027d700], 0
je 0x14019963c
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.14019b370
call fcn.140198f30
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret

Function at 0x14019b000
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
lea r8, [0x14019b780]
mov rbx, rdx
lea rcx, [rsp + 0x28]
sub rcx, 8
lea rdx, [rsp + 0x48]
call fcn.140028eb0
mov r8d, 0x80
mov qword [rsp + 0x48], rax
lea rdx, str.last__dKB_of_log_file:_n
mov dword [rsp + 0x40], 0x30400
mov rcx, rsi
xor edi, edi
call fcn.140021920
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call fcn.14002a250
mov rdx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x40]
mov rcx, rbx
mov rdx, qword [rdx]
call fcn.14002cab0
test eax, eax
jne 0x14019b121
mov r9, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rbx, qword [r9]
cmp ecx, 0x20000
jle 0x14019b108
mov edx, ebx
sub edx, ebx
add edx, ecx
mov rcx, rbx
call fcn.14019cea0
test rax, rax
je 0x14019b0f3
nop word [rax + rax]
mov r9, qword [rsp + 0x48]
mov rcx, rax
sub rcx, qword [r9]
cmp rcx, 0x10400
jge 0x14019b0e5
mov edx, dword [r9]
mov rdi, rax
inc rax
sub edx, eax
mov rcx, rax
add edx, dword [rsp + 0x40]
call fcn.14019cea0
test rax, rax
jne 0x14019b0b0
mov r9, qword [rsp + 0x48]
test rdi, rdi
je 0x14019b0f8
mov ecx, dword [rsp + 0x40]
mov rbx, rdi
jmp 0x14019b108
mov r9, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
lea eax, [rcx - 0x20000]
movsxd rdx, eax
add rbx, rdx
movsxd r8, ecx
mov edx, 1
sub r8, rbx
mov rcx, rbx
add r8, qword [r9]
mov r9, rsi
call fcn.14017e404
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14019c160
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.14019b900
lea rdi, [rsp + 0x28]
mov r8, rax
lea rcx, [rdi - 8]
mov rbx, rax
lea rdx, str._s.sending
call fcn.140029240
mov rcx, qword [rax]
call fcn.140171c70
mov r8, rbx
lea rdx, str._s.sent
lea rcx, [rdi - 8]
call fcn.140029240
lea rdx, [0x1401a4de0]
mov rcx, qword [rax]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14002cbd0
Function at 0x14019c950
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, r9d
mov rbx, rdx
cmp r9d, 0xffffffff
jne 0x14019c970
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x14019c966
mov r9d, eax
lea rdx, [rsp + 0x48]
call fcn.14019c680
test rax, rax
je 0x14019c99c
movsxd r8, dword [rsp + 0x48]
mov r9, rbx
mov edx, 1
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.14017e404
add rsp, 0x20
pop rbx
ret

Function at 0x14019ce10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov ebx, r8d
lea rdx, str.wbEe
call fcn.14002c460
mov qword [rsp + 0x20], rax
mov rsi, rax
test rax, rax
je 0x14019ce86
cmp ebx, 0xffffffff
jne 0x14019ce50
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14019ce47
mov r9d, ebx
lea rdx, [rsp + 0x58]
mov r8, rdi
xor ecx, ecx
call fcn.14019c680
test rax, rax
je 0x14019ce7c
movsxd r8, dword [rsp + 0x58]
mov r9, rsi
mov edx, 1
mov rcx, rax
call fcn.14017e404
lea rcx, [rsp + 0x20]
call fcn.14002c430
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180f10108
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180f1028f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180f10139
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180f1011f
add dl, dl
jne 0x180f10146
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180f101a6
xor eax, eax
add dl, dl
jne 0x180f10155
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180f1025d
add dl, dl
jne 0x180f10166
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180f10173
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180f10180
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180f1018d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180f1019a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180f1012e
mov eax, 1
add dl, dl
jne 0x180f101b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180f101c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180f101ab
sub eax, ebx
mov ebx, 1
jne 0x180f101fc
mov ecx, 1
add dl, dl
jne 0x180f101de
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180f101eb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180f101d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180f1012e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180f10218
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180f10225
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180f1020d
cmp eax, 0x7d00
jae 0x180f1024b
cmp eax, 0x500
jb 0x180f10246
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180f1012e
cmp eax, 0x7f
ja 0x180f1024e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180f1012e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180f10282
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180f1012e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140004500
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x13f0
call fcn.140025400
sub rsp, rax
mov rax, qword [0x140076190]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea r8d, [r12 + 0x3e]
lea rdx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea rcx, [rsp + 0x30]
call fcn.140007050
nop
call fcn.140023918
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [r12 + 1]
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x140004590
mov dword [rsp + 0x50], 0x270
mov ebx, dword [rsp + 0x40]
dec ebx
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov dword [rsp + 0x20], 1
mov ebp, 0x1b
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x30]
cmp ebx, 0xffffffff
jne 0x1400045f9
lea rcx, [rsp + 0x50]
call fcn.14000c030
mov edx, eax
jmp 0x140004642
lea edi, [rbx + 1]
nop dword [rax]
mov r9d, r12d
mov ecx, r12d
test ebx, ebx
je 0x14000461c
lea rcx, [rsp + 0x50]
call fcn.14000c030
mov r9d, eax
mov ecx, 0xffffffff
xor edx, edx
mov eax, ecx
div edi
mov r8d, eax
xor edx, edx
mov eax, r9d
div edi
cmp eax, r8d
jb 0x14000463b
xor edx, edx
mov eax, ecx
div edi
cmp edx, ebx
jne 0x140004600
xor edx, edx
mov eax, r9d
div edi
lea rcx, [rsp + 0x30]
cmp r15, 0x10
cmovae rcx, r14
movsxd rax, edx
movzx r9d, byte [rax + rcx]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x140004683
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140004678
mov rax, qword [rsi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140004692
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rsi
call fcn.140007150
sub rbp, 1
jne 0x1400045e6
cmp r15, 0x10
jb 0x1400046cf
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400046c7
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046fe
mov rcx, r14
call fcn.140024990
mov rax, rsi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.140024970
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.14003a764
int3
Function at 0x14000c030
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14000c091
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14000c050
mov ecx, dword [r10]
jmp 0x14000c17a
cmp ecx, 0x4e0
jb 0x14000c17a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14000c0b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14000c100
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14002302c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x14002305a
xor eax, eax
jmp 0x140023140
cmp qword [rcx + 0x68], 0
je 0x14002306b
call fcn.14002315c
jmp 0x140023140
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140023082
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140023084
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400230b6
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.140026b90
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x14002313a
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400230ed
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140023116
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.14003e2b4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x14002313a
cmp rsi, rbx
ja 0x1400230f4
test rsi, rsi
je 0x14002313a
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14003e2b4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140025848
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025892
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140025892
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140025892
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140025892
cmp dword [rcx + 0x84], 0xe
jbe 0x140025892
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140025894
xor al, al
add rsp, 0x28
ret

Function at 0x140033140
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140032f3c

Function at 0x140045eb4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140045ed4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003a9a0
or eax, 0xffffffff
jmp 0x140045ed6
xor eax, eax
add rsp, 0x28
ret
Function at 0x14004ab1c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140025400
sub rsp, rax
mov rax, qword [0x140076190]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140047000
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14004ab6b
mov rax, rbp
jmp 0x14004ac73
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x7b0b0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14004bc3c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x7b0b0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14004ac6f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004ac6f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14004bc3c
test rax, rax
js 0x14004ac6f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14004ac6f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14004ac61
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14004ac61
cmp byte [rcx], 0xd
jne 0x14004ac47
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14004ac56
cmp byte [rcx + 1], 0xa
jne 0x14004ac56
inc rcx
jmp 0x14004ac56
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x765a0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14004ac29
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14004ac73
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140024970
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14004ae94
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14004aeaa
mov al, 1
jmp 0x14004af0a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14004aebb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14004af08
mov ecx, dword [rcx + 0x18]
nop
call fcn.14004e68c
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004af08
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14004af08
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14004af08
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14004af0a
xor al, al
add rsp, 0x20
pop rbx
ret