joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001720
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.140001420
test eax, eax
js 0x140001984
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x1400017b3
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop dword [rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x140001760
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x140001982
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0x1475d0]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x1469d0]
movzx eax, byte [rdi + rax*4 + 0x1475d0]
xor r8d, dword [rdi + rax*4 + 0x1471d0]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x1475d0]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0x1465d0]
movzx ecx, byte [rdi + rax*4 + 0x1475d0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x146dd0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x1475d0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x146dd0]
movzx eax, byte [rdi + rcx*4 + 0x1475d0]
xor r8d, dword [rdi + rax*4 + 0x1469d0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1475d0]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x1471d0]
movzx ecx, byte [rdi + rax*4 + 0x1475d0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1465d0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0x1475d0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x146dd0]
movzx eax, byte [rdi + rcx*4 + 0x1475d0]
xor r8d, dword [rdi + rax*4 + 0x1469d0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1475d0]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x1471d0]
movzx ecx, byte [rdi + rax*4 + 0x1475d0]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x1465d0]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x1475d0]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x146dd0]
movzx eax, byte [rdi + rcx*4 + 0x1475d0]
xor r8d, dword [rdi + rax*4 + 0x1469d0]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x1475d0]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x1471d0]
movzx ecx, byte [rdi + rax*4 + 0x1475d0]
xor r8d, dword [rdi + rcx*4 + 0x1465d0]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400017e0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140006250
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x1400062fc
movzx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140006263
not eax
ret
Function at 0x140055c50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1020]
mov eax, 0x1120
call fcn.1400e6ea0
sub rsp, rax
mov rdi, rcx
xor esi, esi
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], sil
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], sil
jne 0x140055ca0
lea rcx, [rsp + 0x70]
call fcn.140004b80
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.140054cf0
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0x10
jb 0x140055d00
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055cfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055ee3
call fcn.1400e6098
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp - 0x60]
call fcn.1400e93f0
mov edx, esi
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x58]
sub r9, r8
je 0x140055d45
lea rcx, [rbp - 0x60]
lea rax, [rbp - 0x60]
sub r8, rax
nop dword [rax]
movzx eax, byte [r8 + rcx]
mov byte [rcx], al
inc edx
lea rcx, [rcx + 1]
movsxd rax, edx
cmp rax, r9
jb 0x140055d30
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x3a0]
call fcn.1400e93f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0xc20]
call fcn.1400e93f0
mov dword [rsp + 0x37], 0x41324443
mov word [rsp + 0x3b], 0x4537
mov dword [rsp + 0x47], 0x46434243
mov dword [rsp + 0x30], 0x37383843
mov word [rsp + 0x3e], 0x3646
mov word [rsp + 0x4f], 0x39
mov word [rsp + 0x34], 0x3444
mov dword [rsp + 0x43], 0x42413436
mov word [rsp + 0x4c], 0x4638
mov word [rsp + 0x41], 0x4232
mov byte [rsp + 0x4e], 0x39
mov byte [rsp + 0x36], 0x32
mov byte [rsp + 0x4b], 0x36
mov byte [rsp + 0x3d], 0x39
mov byte [rsp + 0x40], 0x44
lea r8, [rsp + 0x30]
mov edx, 0x400
lea rcx, [rbp + 0xc20]
call fcn.1400f6a30
lea rcx, [rbp + 0x7a0]
call fcn.1400a4640
nop
mov dword [rsp + 0x20], 0x10
mov r9d, 0x20
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0xc20]
lea rcx, [rbp + 0x7a0]
call fcn.1400a46b0
mov r9, qword [rsp + 0x60]
sub r9, qword [rsp + 0x58]
lea r8, [rbp + 0x3a0]
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x7a0]
call fcn.1400a5cf0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
lea rax, [rbp + 0x3b0]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140055e60
mov r8, rbx
lea rdx, [rbp + 0x3b0]
mov rcx, rdi
call fcn.140004b80
nop
lea rcx, [rbp + 0x7a0]
call fcn.1400a46a0
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140055ec1
mov rdx, qword [rsp + 0x68]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055ebc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055edd
call fcn.1400e6098
mov rax, rdi
lea r11, [rsp + 0x1120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400f6730
nop
call fcn.1400f6730
nop
int3
Function at 0x1400a5b80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x40
cmp byte [rcx + 8], 0
mov rbp, r9
mov r14, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400a5ca3
test r9, r9
je 0x1400a5c80
movsxd r8, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
mov rcx, r8
div r8
test rdx, rdx
jne 0x1400a5c80
mov rax, r9
mov qword [rsp + 0x68], r15
div rcx
xor r15d, r15d
test rax, rax
je 0x1400a5c6a
mov qword [rsp + 0x60], rdi
lea rdi, [rbx + 0x3f8]
nop word [rax + rax]
cmp byte [rbx + 8], 0
mov rax, rdi
je 0x1400a5cc6
xor edx, edx
test r8d, r8d
jle 0x1400a5c25
mov r8, rsi
sub r8, rdi
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
cmp edx, dword [rbx + 0x3d0]
jl 0x1400a5c10
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.1400a5480
movsxd r8, dword [rbx + 0x3d0]
mov rdx, r14
mov rcx, rdi
call fcn.1400e8d40
movsxd r8, dword [rbx + 0x3d0]
xor edx, edx
mov rax, rbp
inc r15d
div r8
add rsi, r8
movsxd rcx, r15d
add r14, r8
cmp rcx, rax
jb 0x1400a5bf0
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
lea rdx, str.Data_not_multiple_of_Block_Size
lea rcx, [rsp + 0x20]
call fcn.140021d80
lea rdx, [0x140160f68]
lea rcx, [rsp + 0x20]
call fcn.1400e8c70
int3
lea rdx, str.Object_not_Initialized
lea rcx, [rsp + 0x20]
call fcn.140021d80
lea rdx, [0x140160f68]
lea rcx, [rsp + 0x20]
call fcn.1400e8c70
int3
lea rdx, str.Object_not_Initialized
lea rcx, [rsp + 0x20]
call fcn.140021d80
lea rdx, [0x140160f68]
lea rcx, [rsp + 0x20]
call fcn.1400e8c70
int3
Function at 0x1400a5cf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
cmp byte [rcx + 8], 0
mov r14, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400a5e05
test r9, r9
je 0x1400a5de2
movsxd rcx, dword [rcx + 0x3d0]
xor edx, edx
mov rax, r9
div rcx
test rdx, rdx
jne 0x1400a5de2
mov rax, r9
mov qword [rsp + 0x68], r15
div rcx
xor r15d, r15d
test rax, rax
je 0x1400a5dcf
mov qword [rsp + 0x60], rbp
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1400a57f0
cmp byte [rbx + 8], 0
mov rax, rdi
je 0x1400a5e28
mov ecx, dword [rbx + 0x3d0]
xor edx, edx
test ecx, ecx
jle 0x1400a5d98
lea r8, [rbx + 0x3f8]
sub r8, rdi
movzx ecx, byte [r8 + rax]
inc edx
xor byte [rax], cl
lea rax, [rax + 1]
mov ecx, dword [rbx + 0x3d0]
cmp edx, ecx
jl 0x1400a5d81
movsxd r8, ecx
mov rdx, rsi
lea rcx, [rbx + 0x3f8]
call fcn.1400e8d40
movsxd rcx, dword [rbx + 0x3d0]
xor edx, edx
mov rax, r14
inc r15d
div rcx
add rsi, rcx
add rdi, rcx
movsxd rcx, r15d
cmp rcx, rax
jb 0x1400a5d50
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rdx, str.Data_not_multiple_of_Block_Size
lea rcx, [rsp + 0x20]
call fcn.140021d80
lea rdx, [0x140160f68]
lea rcx, [rsp + 0x20]
call fcn.1400e8c70
int3
lea rdx, str.Object_not_Initialized
lea rcx, [rsp + 0x20]
call fcn.140021d80
lea rdx, [0x140160f68]
lea rcx, [rsp + 0x20]
call fcn.1400e8c70
int3
lea rdx, str.Object_not_Initialized
lea rcx, [rsp + 0x20]
call fcn.140021d80
lea rdx, [0x140160f68]
lea rcx, [rsp + 0x20]
call fcn.1400e8c70
int3

Function at 0x1400a5e70
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x1400a90d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rbx, rcx
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x200
call fcn.1400e93f0
mov r10d, 0x6f
mov dword [rbp + 0x1d8], 0x200
lea rax, [rbp + 0x1e8]
mov dword [rsp + 0x70], 0x740066
mov r13d, 0x68
mov dword [rbp - 0x7a], 0x700061
mov r9d, 0x20019
mov dword [rsp + 0x74], 0x43005c
lea r8d, [r10 + 3]
mov dword [rsp + 0x6a], 0x73006f
lea rdx, [rsp + 0x50]
mov word [rsp + 0x68], r8w
mov word [rbp - 0x7c], r8w
lea r15d, [r10 - 0x22]
mov dword [rsp + 0x58], 0x410057
mov dword [rsp + 0x78], 0x790072
mov dword [rsp + 0x60], 0x4d005c
mov dword [rsp + 0x7c], 0x740070
mov dword [rsp + 0x64], 0x630069
mov dword [rbp - 0x80], 0x67006f
mov dword [rsp + 0x5c], 0x450052
mov dword [rsp + 0x50], 0x4f0053
mov dword [rsp + 0x54], 0x540046
mov dword [rbp - 0x74], 0x79
mov word [rsp + 0x6e], r10w
mov word [rbp - 0x76], r13w
mov qword [rsp + 0x20], rax
call fcn.140059a10
test eax, eax
jne 0x1400a92a6
mov rcx, qword [rbp + 0x1e8]
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e0]
lea rax, [rbp - 0x70]
mov dword [rsp + 0x38], 0x6e0069
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 0x64
mov dword [rsp + 0x3c], 0x470065
mov dword [rsp + 0x32], 0x630061
mov dword [rsp + 0x40], 0x690075
mov word [rsp + 0x30], r15w
mov word [rsp + 0x36], r13w
call fcn.140059ae0
test eax, eax
je 0x1400a9282
lea rax, [rbp + 0x1e8]
mov r9d, 0x20119
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.140059a10
test eax, eax
jne 0x1400a92a6
mov rcx, qword [rbp + 0x1e8]
lea rax, [rbp + 0x1d8]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x1e0]
lea rax, [rbp - 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140059ae0
test eax, eax
jne 0x1400a92a6
mov r9, 0xffffffffffffffff
lea r8, [rbp - 0x70]
mov edx, 0x800
mov rcx, rbx
call fcn.140105cf8
mov rcx, qword [rbp + 0x1e8]
call fcn.140059cd0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a9380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xcc0
lea rbp, [rsp + 0x30]
mov r13d, 0x72
mov qword [rbp + 0xcd0], rbx
mov eax, 0x43
mov dword [rbp + 0x6e], 0x720075
mov word [rbp + 0x6c], ax
mov rsi, rcx
mov eax, 0x52
mov dword [rbp + 0x56], 0x690057
mov word [rbp + 0x3c], ax
lea r11d, [r13 - 0xd]
mov eax, 0x4d
mov dword [rbp + 0x44], 0x630069
lea r10d, [r13 - 3]
mov word [rbp + 0x42], ax
xor edx, edx
mov dword [rbp + 0x38], 0x410057
mov r8d, 0x800
mov dword [rbp + 0x3e], 0x5c0045
lea rcx, [rbp + 0x490]
mov dword [rbp + 0x30], 0x4f0053
mov dword [rbp + 0x4a], 0x73006f
xor edi, edi
mov dword [rbp + 0x4e], 0x66006f
mov dword [rbp + 0x7e], 0x730072
mov dword [rbp + 0x34], 0x540046
mov dword [rbp + 0x64], 0x4e0020
mov dword [rbp + 0x74], 0x6e0065
mov dword [rbp + 0x82], 0x6f0069
mov dword [rbp + 0x52], 0x5c0074
mov dword [rbp + 0x68], 0x5c0054
mov dword [rbp + 0x78], 0x560074
mov dword [rbp + 0x60], 0x730077
mov dword [rbp + 0x5a], 0x64006e
mov word [rbp + 0x72], r13w
mov word [rbp + 0x48], r13w
mov dword [rbp + 0x86], 0x6e
mov word [rbp + 0x5e], r10w
mov word [rbp + 0x7c], r11w
mov dword [rbp + 0x12], 0x64006f
mov dword [rbp + 0x16], 0x630075
mov dword [rbp + 0xc], 0x50006c
mov dword [rbp + 8], 0x610074
mov dword [rbp + 0x1a], 0x490074
mov dword [rbp + 4], 0x690067
mov dword [rbp + 0x1e], 0x64
mov dword [rbp], 0x690044
mov word [rbp + 0x10], r13w
call fcn.1400e93f0
lea rax, [rbp + 0xce0]
mov dword [rbp + 0xcd8], 0x800
mov r9d, 0x101
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x30]
call fcn.140059a10
test eax, eax
jne 0x1400a95f8
mov rcx, qword [rbp + 0xce0]
lea rax, [rbp + 0xcd8]
mov qword [rsp + 0x28], rax
lea rdx, [rbp]
lea rax, [rbp + 0x490]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call fcn.140059ae0
test eax, eax
jne 0x1400a95ec
xor edx, edx
lea rcx, [rbp + 0x90]
mov r8d, 0x400
call fcn.1400e93f0
mov r8d, dword [rbp + 0xcd8]
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x490]
call fcn.1400a9310
lea rcx, [rbp + 0x90]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x1400a9560
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1400a95d5
movsxd rcx, eax
lea rcx, [rcx*2 + 2]
lea rax, [rcx + 0xf]
cmp rax, rcx
ja 0x1400a9592
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400e6ea0
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x1400a95d5
mov dword [rsp + 0x28], edx
lea r8, [rbp + 0x90]
xor edx, edx
mov word [rbx], di
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
cmove rbx, rdi
mov rdi, rbx
mov r9, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x800
mov rcx, rsi
call fcn.140105cf8
mov rcx, qword [rbp + 0xce0]
call fcn.140059cd0
mov rbx, qword [rbp + 0xcd0]
lea rsp, [rbp + 0xc90]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400ab1e0
Capabilities:
Check http status code

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov r14, rcx
xor sil, sil
call fcn.140006300
movzx edx, al
lea rcx, [rbp + 0x77]
call fcn.140006500
nop
mov rdx, qword [rax]
xor r15d, r15d
mov qword [rbp - 0x19], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], 0xf
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [rdx + r8], r15b
jne 0x1400ab230
lea rcx, [rbp - 0x19]
call fcn.140004b80
xor ecx, ecx
call fcn.1400aa030
mov r8d, eax
mov r12d, 1
mov r9d, r12d
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.1400a9e40
nop
mov rdx, qword [rbp + 0x77]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, r12d
jg 0x1400ab27d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp byte [r14 + 0x20], 0
je 0x1400ab38c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], eax
lea rcx, [rbp + 7]
call fcn.1400aa050
mov rdi, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400ab2ae
mov rdi, qword [rax]
lea rcx, [rbp - 0x39]
call fcn.1400b23d0
mov r9, rax
mov dword [rsp + 0x30], 0x4080000
lea r8, [0x14014c604]
mov rdx, rdi
mov rcx, qword [r14 + 0x30]
call fcn.14005b310
mov rbx, rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x1400ab313
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ab30e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ab3aa
call fcn.1400e6098
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], 0xf
mov byte [rbp + 7], 0
lea rdi, [rbp - 0x39]
xor eax, eax
mov ecx, 9
rep stosb byte [rdi], al
lea rdi, [rbp - 0x2f]
mov ecx, 0x12
rep stosb byte [rdi], al
test rbx, rbx
je 0x1400ab384
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14005b7e0
mov dword [rbp + 0x67], r15d
mov dword [rbp + 0x6f], 4
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x67]
mov edx, 0x20000013
mov rcx, rbx
call fcn.14005b650
movzx esi, sil
cmp dword [rbp + 0x67], 0xc8
cmove esi, r12d
mov rcx, rbx
call fcn.14005b4e0
mov rcx, r14
call fcn.1400a9ed0
movzx eax, sil
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400f6730
nop
Function at 0x1400b7ba0
Capabilities:
Create directory
Get disk size
Packed with generic packer

Disassembly:
jae 0x1400b7c01
jge 0x1400b7beb
sub dword [rcx + 0x47], esi
sub eax, 0x65353c39
cmp byte [rbp + 0x31], cl
imul ecx, dword [rbx + 0x3b], 0x73365153
xchg edx, eax
xchg edx, eax
invalid

Function at 0x1400b7c08
Capabilities:
Create directory
Get disk size

Disassembly:
movabs dword [0xa4e1a4d9a3d49adf], eax
xlatb

Function at 0x1400b7c12
Capabilities:
Create directory
Get disk size

Disassembly:
pop rsp
and al, 0x53
sub eax, 0x6a31717a
pop rax
insd dword [rdi], dx
sub al, 0x23
invalid

Function at 0x1400b7c30
Capabilities:
Create directory
Get disk size
Packed with generic packer

Disassembly:
test byte [rdi + 0x7b], ah
jbe 0x1400b7c96
sbb byte [rsi + 0x7c], 0x65
ja 0x1400b7ca0
sbb byte [rbx + 0x76], 0x5f
and dword [rsi + 0x7a], 0x78598567
pop rbx
jge 0x1400b7ca6
jg 0x1400b7cb3
jnp 0x1400b7cad
sbb dword [rsi + 0x79], 0x7a627a66
pop rbp
and dword [rcx + 0x79], 0x7c5b7e61
invalid
jnp 0x1400b7cfc
and dword [rsi - 0x7e], 0x63
and byte [rsi - 0x7f], 0x61
and byte [rbx + 0x79], 0x5b
test dword [rsi - 0x7c], ebx
js 0x1400b7d0f
test byte [rdi + 0x78], ah
jg 0x1400b7d12
jg 0x1400b7d12
js 0x1400b7d07
pop rcx
jge 0x1400b7d0f
sbb dword [rbp + 0x45], 0x7b5c3a70
push rbx
jo 0x1400b7cef
invalid
invalid
add bh, bh
and eax, 0x7d41a
jmp qword [sym.imp.KERNEL32.dll_FindNextStreamW]
sbb dl, ah

Function at 0x1400b7cb2
Capabilities:
Get disk size
Packed with generic packer

Disassembly:
jo 0x1400b7cef
pop rsp
jnp 0x1400b7d0b
push rsp
jne 0x1400b7d14
jbe 0x1400b7d06
cmp dword [rax], ebp
cmp edx, dword [rdx + 0x4f]
imul esp, dword [rdi + rbp*2], 0x56
push rax
invalid
cmp byte [r14 + 0x40], r10b
invalid
invalid
and eax, 0x7d428
jmp qword [sym.imp.KERNEL32.dll_FindActCtxSectionGuid]
invalid

Function at 0x1400daea8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1400c3706
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1400c36e9
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1400c36d4
Function at 0x140104760
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1401044b0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401044b0
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401044b0
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401044b0
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401044b0
cmp dword [rcx + 0x84], 0xe
jbe 0x1401044b0
cmp dword [rcx + 0xf8], esi
je 0x1401044b0
mov ecx, r14d
call fcn.140104674
mov ecx, 2
call fcn.140109798
nop
cmp byte [0x140164c28], 0
jne 0x14010457a
mov r15d, 1
mov eax, r15d
xchg dword [0x140164c18], eax
test ebx, ebx
jne 0x140104523
mov rdi, qword [0x140162038]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140164c20]
cmp rcx, rax
je 0x14010451a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140003d70]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1401651b0]
jmp 0x14010452f
cmp ebx, r15d
jne 0x140104535
lea rcx, [0x1401651c8]
call fcn.14011790c
nop
test ebx, ebx
jne 0x14010454c
lea rdx, [0x1401356b0]
lea rcx, [0x140135690]
call fcn.140117e98
lea rdx, [0x1401356c0]
lea rcx, [0x1401356b8]
call fcn.140117e98
movzx eax, byte [0x140164c28]
test esi, esi
cmove eax, r15d
mov byte [0x140164c28], al
jmp 0x14010457a
mov ecx, 2
call fcn.1401097ec
test esi, esi
jne 0x140104591
mov ecx, r14d
call fcn.1401045ac
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140104440