joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002982c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ce24
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ce24
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002997c
cmp rax, 0xffffffffffffffff
je 0x14002997c
xor edi, edi
test rbp, rbp
jle 0x140029927
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f738
mov rbx, rax
test rax, rax
jne 0x1400298b4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002991d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a758
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001db00
cmp eax, 0xffffffff
je 0x1400298fd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400298c4
mov edx, r15d
mov ecx, r14d
call fcn.14001a758
jmp 0x14002991d
cmp byte [rsi + 0x38], dil
je 0x140029914
cmp dword [rsi + 0x34], 5
jne 0x140029914
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002991d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b4ec
jmp 0x140029990
jns 0x140029990
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ce24
cmp rax, 0xffffffffffffffff
jne 0x140029948
cmp byte [rsi + 0x30], dil
je 0x140029990
mov edi, dword [rsi + 0x2c]
jmp 0x140029990
mov ecx, r14d
call fcn.140018c10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029990
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029989
mov eax, dword [rsi + 0x2c]
jmp 0x14002998e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ce24
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002aa80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002aaa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002aaa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140f86034
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f8603e
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f86067
pop rbp
sub rbp, 0x33
sub rbp, 0xf86034
sub rsp, 0x20
jmp 0x140f86086
invalid
mov rax, 0xf86034
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x2969d73c
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f860a5
jmp 0x140f860bc
je 0x140f86073
invalid
Function at 0x1400029d0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140016078]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r15, rax
test rax, rax
jne 0x140002a2c
mov qword [rdi], r12
mov qword [rdi + 8], r12
mov qword [rdi + 0x10], r12
jmp 0x140002b25
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov rbp, r12
mov qword [rsp + 0x38], r12
mov esi, 1
mov rbx, qword [rsp + 0x30]
cmp dword [rsp + 0x20], esi
jle 0x140002b0c
lea r14, [rax + 8]
nop word [rax + rax]
mov rdx, qword [r14]
lea rcx, [rsp + 0x48]
call fcn.140002b60
nop
cmp rbx, rbp
je 0x140002aa9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
add rbx, 0x20
mov qword [rsp + 0x30], rbx
jmp 0x140002ac3
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140002520
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140002afc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002af7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002b4e
call fcn.14000d9f4
inc esi
add r14, 8
cmp esi, dword [rsp + 0x20]
jl 0x140002a60
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbp
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000da90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
int3

Function at 0x1400032f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x58]
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x30], rax
lea r8, str.AppsUseLightTheme
xor ebx, ebx
lea rax, [rsp + 0x60]
mov rdi, rcx
mov qword [rsp + 0x28], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionThemesPersonalize
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000001
lea r9d, [rbx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140003363
cmp dword [rsp + 0x60], ebx
lea r9d, [rax + 4]
lea r8, [rsp + 0x68]
mov rcx, rdi
sete bl
lea edx, [rax + 0x14]
mov dword [rsp + 0x68], ebx
call qword [sym.imp.dwmapi.dll_DwmSetWindowAttribute]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14000e874
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e8be
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e8be
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e8be
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e8be
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e8be
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000e8c0
xor al, al
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x78
mov eax, 0x18
mov word [rsp + 0x58], ax
mov eax, 0x1a
mov word [rsp + 0x5a], ax
lea rax, [0x140002b10]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x28], 0
mov rax, qword [sym.imp.ntoskrnl.exe_IoDriverObjectType]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40
lea rcx, [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByName]
mov dword [rsp + 0x40], eax
cmp qword [rsp + 0x48], 0
je 0x14000107d
cmp dword [rsp + 0x40], 0
jge 0x1400010a7
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, 0xd3
lea rdx, [0x140002b30]
lea rcx, [0x140002b40]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400010e8
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + rax + 0x70]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [section..data], rax
mov rax, qword [rsp + 0x50]
lea rcx, [0x140001490]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
add rsp, 0x78
ret

Function at 0x140001c20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x138
jne 0x140001c42
mov rcx, qword [rsp + 0x40]
call fcn.140002050
jmp 0x140001c59
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jb 0x140001c59
mov rcx, qword [rsp + 0x40]
call fcn.140001e40
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx + rax*8 + 8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov rax, qword [rsp + 0x20]
shr rax, 0x1d
mov rcx, qword [rsp + 0x40]
and rax, qword [rcx + 0x1388]
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rax, rcx
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shl rax, 0x25
movabs rcx, 0xfff7eee000000000
and rax, rcx
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shr rax, 0x2b
mov rcx, qword [rsp + 0x20]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140001e40
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp], 0
jmp 0x140001e5e
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x9c
jae 0x140001efc
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
and rax, 1
test rax, rax
je 0x140001ec2
movabs rax, 0xb5026f5aa96619e9
mov qword [rsp + 0x10], rax
jmp 0x140001ecb
mov qword [rsp + 0x10], 0
mov rax, qword [rsp + 8]
shr rax, 1
xor rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor rax, qword [rcx + rdx*8 + 0xea8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140001e53
jmp 0x140001f09
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x137
jae 0x140001fa7
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov rcx, qword [rcx + rdx*8 + 0x9d0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
and rax, 1
test rax, rax
je 0x140001f6d
movabs rax, 0xb5026f5aa96619e9
mov qword [rsp + 0x20], rax
jmp 0x140001f76
mov qword [rsp + 0x20], 0
mov rax, qword [rsp + 0x18]
shr rax, 1
xor rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor rax, qword [rcx + rdx*8 - 0x4d8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140001efe
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov rax, qword [rax + rcx*8 + 0x9c8]
and rax, 0xffffffff80000000
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx + rcx + 8]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
and rax, 1
test rax, rax
je 0x140001fff
movabs rax, 0xb5026f5aa96619e9
mov qword [rsp + 0x30], rax
jmp 0x140002008
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x28]
shr rax, 1
xor rax, qword [rsp + 0x30]
mov ecx, 8
imul rcx, rcx, 0x9b
mov rdx, qword [rsp + 0x50]
xor rax, qword [rdx + rcx + 8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov qword [rcx + rdx*8 + 8], rax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140002050
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov qword [rsp], 0x138
jmp 0x14000206e
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0x270
jae 0x14000210c
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp]
mov rax, qword [rax + rcx*8 - 0x9b8]
and rax, 0xffffffff80000000
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp]
mov rcx, qword [rcx + rdx*8 - 0x9b0]
and rcx, 0x7fffffff
or rax, rcx
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
and rax, 1
test rax, rax
je 0x1400020d2
movabs rax, 0xb5026f5aa96619e9
mov qword [rsp + 0x10], rax
jmp 0x1400020db
mov qword [rsp + 0x10], 0
mov rax, qword [rsp + 8]
shr rax, 1
xor rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp]
xor rax, qword [rcx + rdx*8 - 0x4d8]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140002063
add rsp, 0x28
ret

Function at 0x140002120
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
movzx eax, byte [rsp + 0x10]
mov rcx, qword [rsp + 8]
xor rcx, rax
mov rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
ret

Function at 0x140002370
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x13d8
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rdx, qword [rsp + 0x13e8]
mov rcx, qword [rsp + 0x13e0]
call fcn.140002160
xor rax, qword [0x140004008]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140001a00
mov r8d, 0x5a
mov edx, 0x41
lea rcx, [rsp + 0x38]
call fcn.140001a80
mov r8, qword [rsp + 0x13e8]
mov rdx, qword [rsp + 0x30]
lea rcx, [0x140002b90]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x24], 0
jmp 0x1400023f9
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
cmp rax, qword [rsp + 0x13e8]
jae 0x140002427
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x13e0]
movzx eax, byte [rcx + rax]
mov edx, eax
lea rcx, [0x140002bd0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x1400023ef
lea rcx, [0x140002be0]
call sub.ntoskrnl.exe_DbgPrint
mov dword [rsp + 0x20], 0
jmp 0x140002447
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cmp rax, qword [rsp + 0x13e8]
jae 0x140002491
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x13e0]
movzx ecx, byte [rcx + rax]
call fcn.140002270
movzx eax, al
test eax, eax
je 0x14000248f
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.140001790
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x13e0]
mov byte [rdx + rcx], al
jmp 0x14000243d
mov dword [rsp + 0x28], 0
jmp 0x1400024a5
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
cmp rax, qword [rsp + 0x13e8]
jae 0x1400024d3
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x13e0]
movzx eax, byte [rcx + rax]
mov edx, eax
lea rcx, [0x140002bd0]
call sub.ntoskrnl.exe_DbgPrint
jmp 0x14000249b
lea rcx, [0x140002bf0]
call sub.ntoskrnl.exe_DbgPrint
add rsp, 0x13d8
ret
Function at 0x1400022b0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14010cfb0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x98]
mov rbx, r9
mov r15, r8
mov ebp, edx
mov r14, rcx
test rcx, rcx
je 0x1400024df
test rbx, rbx
je 0x1400024df
mov qword [rsp + 0x78], rsi
test rdi, rdi
je 0x14000230f
mov rax, qword [rdi + 8]
test rax, rax
je 0x140002322
mov rdx, qword [rdi]
mov ecx, 0x30
call rax
jmp 0x14000231a
mov ecx, 0x30
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x140002345
mov eax, 0xfffffffc
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c61b0
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0x90]
mov qword [rsi + 8], rax
lea rax, [rsi + 0x10]
mov qword [rsi], rbx
xor ebx, ebx
test rax, rax
je 0x1400023c1
test rdi, rdi
je 0x14000239d
cmp qword [rdi], rbx
jne 0x14000237b
cmp qword [rdi + 0x18], rbx
jne 0x140002381
cmp qword [rdi + 8], rbx
jne 0x14000237b
cmp qword [rdi + 0x10], rbx
je 0x14000239d
cmp qword [rdi + 0x18], rbx
je 0x1400023c1
cmp qword [rdi + 8], rbx
jne 0x14000238d
cmp qword [rdi + 0x10], rbx
je 0x1400023c1
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm1
jmp 0x1400023c1
mov qword [rax], rbx
lea rcx, [0x140001d00]
mov qword [rax + 8], rcx
lea rcx, [0x140001d10]
mov qword [rax + 0x10], rcx
lea rcx, [0x140001d20]
mov qword [rax + 0x18], rcx
lea rax, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x140002250]
mov rdx, r15
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r14], rax
mov r8, rax
test rax, rax
jne 0x140002434
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002130
mov ebx, eax
test eax, eax
je 0x1400024d8
test rdi, rdi
je 0x140002424
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x14000242d
mov rdx, qword [rdi]
mov rcx, rsi
call r8
mov eax, ebx
jmp 0x140002327
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
jmp 0x140002327
lea eax, [rbp + 5]
cmp eax, 6
ja case.0x140002453.2
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x24ec]
add rcx, rdx
jmp rcx
mov ebx, 0xfffffff1
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140002327
mov ebx, 0xfffffffe
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140002327
mov ebx, 0xffffffff
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140002327
mov ebx, 1
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140002327
mov ebx, 2
mov rcx, r8
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140002327
mov ebx, 0xf
mov edx, ebx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor eax, eax
jmp 0x140002327
mov eax, 0xfffffffe
jmp 0x14000232c
Function at 0x140028fc0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14010cfb0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0xa0]
xor esi, esi
mov rbp, r9
mov r12, r8
mov r15, rdx
test r14, r14
je 0x140028ff7
mov qword [r14], rsi
test r15, r15
je 0x1400290aa
test r12, r12
je 0x1400290aa
mov qword [rsp + 0x80], rbx
mov rbx, rsi
test rbp, rbp
je 0x140029096
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov r13d, 0xffffffff
nop dword [rax]
mov rdi, rbp
mov qword [rsp + 0x20], rsi
sub rdi, rbx
lea rdx, [rbx + r12]
cmp rdi, r13
lea r9, [rsp + 0x30]
mov rcx, r15
cmovae edi, r13d
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
cmp eax, 1
jne 0x140029064
test ecx, ecx
je 0x140029076
add rbx, rcx
cmp ecx, edi
jb 0x14002908c
test eax, eax
je 0x14002907d
cmp rbx, rbp
jb 0x140029030
jmp 0x14002908c
mov esi, 0xffffffef
jmp 0x14002908c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140002130
mov esi, eax
mov rdi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x14002909e
mov qword [r14], rbx
mov rbx, qword [rsp + 0x80]
mov eax, esi
jmp 0x1400290af
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c61b0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x14002ee10
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov eax, edx
mov r11d, edx
cdq
mov r10d, 0x2a
and edx, 3
add eax, edx
sar eax, 2
lea r8d, [rax*4]
movsxd r8, r8d
add r8, rcx
neg eax
movsxd rdx, eax
je 0x14002ee69
nop dword [rax]
imul eax, dword [r8 + rdx*4], 0xcc9e2d51
rol eax, 0xf
imul ecx, eax, 0x1b873593
xor r10d, ecx
rol r10d, 0xd
add r10d, 0xfaddaf14
lea r10d, [r10 + r10*4]
add rdx, 1
jne 0x14002ee40
mov ecx, r11d
xor edx, edx
and ecx, 3
sub ecx, 1
je 0x14002ee92
sub ecx, 1
je 0x14002ee88
cmp ecx, 1
jne 0x14002eeaa
movzx edx, byte [r8 + 2]
shl edx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [r8]
xor eax, edx
imul ecx, eax, 0xcc9e2d51
rol ecx, 0xf
imul eax, ecx, 0x1b873593
xor r10d, eax
xor r10d, r11d
mov eax, r10d
shr eax, 0x10
xor eax, r10d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x140064930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x140064964
cmp ecx, r10d
jge 0x140064952
mov rcx, rbx
call fcn.1400640c0
mov eax, dword [rbx + 0x18]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x18], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x14006499e
mov ecx, dword [rbx + 0x18]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x18], ecx
movzx r9d, cl
test eax, eax
jg 0x140064980
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x1400649c6
mov rax, qword gs:[0x58]
mov edx, 0x20
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1400649f5
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1400649df
xor dl, dl
jmp 0x1400649e8
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1400649d6
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1400649a2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x140064a5f
mov rax, qword gs:[0x58]
mov edx, 0x20
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x20]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x30]
jbe 0x140064a79
mov rcx, rbx
call fcn.140064210
test eax, eax
je 0x140064a52
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x20]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x20], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret