joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005b790
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x140180518]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14005b80c
mov rax, qword [rsi]
cmp rax, 2
jae 0x14005b821
mov dil, 1
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test dil, dil
jne 0x14005b802
cmp dword [rsi + 0x18], 1
jne 0x14005b802
mov eax, dword [0x1401bd520]
mov ecx, dword [0x1401bd448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005b85d
cmp byte [0x1401bd51d], 0
je 0x14005b802
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401213e0
nop
add rsp, 0x48
pop rdi
pop rsi
ret
movzx edx, word [rcx]
cmp edx, 0x5a4d
jne 0x14005b7ba
cmp rax, 0x40
jb 0x14005b7ba
mov edx, dword [rcx + 0x3c]
cmp rax, rdx
cmovb rdx, rax
sub rax, rdx
cmp rax, 4
jb 0x14005b7ba
cmp dword [rcx + rdx], 0x4550
jne 0x14005b7ba
xor edi, edi
jmp 0x14005b7bd
lea rcx, [0x1401bd520]
call fcn.140121230
cmp dword [0x1401bd520], 0xffffffff
jne 0x14005b7ef
movaps xmm0, xmmword [0x140127130]
movaps xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.14005e1d0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14005d5f0
mov byte [0x1401bd51d], al
lea rcx, [0x1401bd520]
call fcn.140121298
jmp 0x14005b7ef

Function at 0x14005b8c0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140180518]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401213e0
mov eax, esi
add rsp, 0x60
pop rsi
ret
Function at 0x14005c320
Capabilities:
Timestomp file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xb0
mov eax, r9d
mov rsi, rcx
mov edi, dword [rsp + 0xf0]
mov rcx, qword [0x140180518]
xor rcx, rsp
mov qword [rsp + 0xa8], rcx
mov r9d, 4
test dil, 4
jne 0x14005c363
movsxd rcx, r8d
lea r8, [0x140127228]
mov r9d, dword [r8 + rcx*4]
bswap eax
mov ecx, eax
and ecx, 0x1000000
shl ecx, 7
shl eax, 5
and eax, 0x40000000
or eax, ecx
mov ecx, edi
and ecx, 8
shl ecx, 0xd
or ecx, eax
mov eax, edi
and eax, 0x20
lea eax, [rcx + rax*8]
mov ecx, edi
and ecx, 0x10
shr ecx, 4
mov byte [rsp + 0x30], cl
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x90]
lea r8, [rsp + 0xa0]
call fcn.14005c4b0
cmp dword [rsp + 0x90], 0
je 0x14005c3f3
movups xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x70]
call fcn.140054270
or byte [rsi + 8], 1
mov rax, qword [rsp + 0x88]
mov qword [rsi], rax
jmp 0x14005c449
test dil, 0x20
jne 0x14005c403
mov rdi, qword [rsp + 0xa0]
jmp 0x14005c442
lea rdi, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rdi, qword [rsp + 0xa0]
test eax, eax
je 0x14005c467
lea r8, [rsp + 0x68]
mov rcx, rdi
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x14005c467
and byte [rsi + 8], 0xfe
mov qword [rsi], rdi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1401213e0
mov rax, rsi
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rsp + 0x40]
mov rcx, rdi
mov edx, ebx
call fcn.1400660f0
lea rcx, [rsp + 0x50]
mov rdx, rdi
call fcn.140054270
or byte [rsi + 8], 1
mov rax, qword [rsp + 0x50]
jmp 0x14005c3ee

Function at 0x14005cb00
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov r10, rdx
mov rsi, rcx
mov rax, qword [0x140180518]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rcx, qword [r8 + 8]
mov eax, 0xffffffff
cmp rcx, rax
cmovb rax, rcx
mov dword [rsp + 0x4c], 0
mov rdx, qword [r8]
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x4c]
mov rcx, r10
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005cb72
and byte [rsi + 8], 0xfe
mov eax, dword [rsp + 0x4c]
mov qword [rsi], rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401213e0
mov rax, rsi
add rsp, 0x58
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x14005cb50
cmp eax, 0x26
je 0x14005cb50
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov edx, eax
call fcn.1400660f0
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.140054270
or byte [rsi + 8], 1
mov rax, qword [rsp + 0x40]
jmp 0x14005cb58
Function at 0x14005d100
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rdx
mov rax, qword [0x140180518]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
xor edi, edi
lea r9, [rsp + 0x38]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x14005d185
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [0x14017cb78]
mov qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x28]
mov edx, 0xfde9
mov r8, rdi
mov r9, rax
call fcn.14005d320
mov edi, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
je 0x14005d178
xor edi, edi
jmp 0x14005d185
mov rcx, rsi
xor edx, edx
call fcn.1400567a0
mov dil, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401213e0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x14005dc10
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140180518]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1401bd528]
mov ecx, dword [0x1401bd448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005dc6a
and byte [rsi + 8], 0xfe
mov eax, dword [0x1401bd524]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401213e0
mov rax, rsi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1401bd528]
call fcn.140121230
cmp dword [0x1401bd528], 0xffffffff
jne 0x14005dc48
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x2c]
mov dword [0x1401bd524], eax
lea rcx, [0x1401bd528]
call fcn.140121298
jmp 0x14005dc48

Function at 0x14005e0c0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rax, qword [0x140180518]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x14005e12a
mov rdi, qword [rsp + 0x28]
lea r8, [rsp + 0x40]
mov rcx, rdi
mov edx, 4
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebx, eax
mov esi, dword [rsp + 0x40]
test rdi, rdi
je 0x14005e126
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test ebx, ebx
jne 0x14005e153
mov eax, dword [0x1401bd530]
mov ecx, dword [0x1401bd448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14005e16a
call qword [0x14017cb90]
mov esi, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401213e0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401bd530]
call fcn.140121230
cmp dword [0x1401bd530], 0xffffffff
jne 0x14005e14b
lea rsi, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x3c], eax
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x3c]
mov r8, rsi
call fcn.14005e360
mov ecx, dword [rsp + 0x30]
call qword [0x14017cb98]
lea rcx, [0x1401bd530]
call fcn.140121298
jmp 0x14005e14b
Function at 0x14006ed90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov edx, dword [rcx + 8]
cmp rdx, 0x40
ja 0x14006edc3
mov r8, qword [rax]
not r8
mov ecx, edx
neg cl
mov r9, 0xffffffffffffffff
shr r9, cl
test rdx, rdx
je 0x14006ee2d
and r9, r8
mov qword [rax], r9
inc qword [rax]
jmp 0x14006eebf
mov r9d, edx
add rdx, 0x3f
mov rcx, rdx
shr rcx, 6
mov r8, qword [rax]
cmp r9d, 0xc1
jae 0x14006ede2
xor r9d, r9d
jmp 0x14006ee32
mov r9d, ecx
and r9d, 0xfffffffc
shr rdx, 3
and edx, 0xffffffe0
xor r10d, r10d
pcmpeqd xmm0, xmm0
nop word [rax + rax]
movdqu xmm1, xmmword [r8 + r10]
movdqu xmm2, xmmword [r8 + r10 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [r8 + r10], xmm1
movdqu xmmword [r8 + r10 + 0x10], xmm2
add r10, 0x20
cmp rdx, r10
jne 0x14006ee00
jmp 0x14006ee39
xor r9d, r9d
jmp 0x14006edb5
not qword [r8 + r9*8]
inc r9
cmp rcx, r9
jne 0x14006ee32
mov edx, dword [rax + 8]
mov ecx, edx
neg cl
mov r8, 0xffffffffffffffff
shr r8, cl
test rdx, rdx
je 0x14006ef01
cmp edx, 0x41
jae 0x14006ee62
mov rdx, rax
jmp 0x14006ee78
add rdx, 0x3f
shr rdx, 6
mov ecx, 0xffffffff
add edx, ecx
shl rdx, 3
add rdx, qword [rax]
and qword [rdx], r8
mov ecx, dword [rax + 8]
cmp rcx, 0x40
ja 0x14006ee89
inc qword [rax]
jmp 0x14006eebf
mov rdx, qword [rax]
inc qword [rdx]
jne 0x14006eebf
inc qword [rdx + 8]
jne 0x14006eebf
add rcx, 0x3f
shr rcx, 6
mov r8d, 2
nop word cs:[rax + rax]
cmp rcx, r8
je 0x14006eebf
inc qword [rdx + r8*8]
lea r8, [r8 + 1]
je 0x14006eeb0
mov r8d, dword [rax + 8]
mov ecx, r8d
neg cl
mov rdx, 0xffffffffffffffff
shr rdx, cl
test r8, r8
je 0x14006eefb
cmp r8d, 0x41
jb 0x14006eef7
add r8, 0x3f
shr r8, 6
mov ecx, 0xffffffff
add r8d, ecx
shl r8, 3
add r8, qword [rax]
mov rax, r8
and qword [rax], rdx
ret
xor edx, edx
and qword [rax], rdx
ret
xor r8d, r8d
mov rdx, rax
jmp 0x14006ee78
Function at 0x140081d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x140180518]
xor rcx, rsp
mov qword [rsp + 0x40], rcx
movzx edx, byte [r8 - 1]
lea rcx, [0x14012bdb0]
movzx r8d, word [rcx + rdx*2]
and r8d, 2
mov ebp, r8d
shr ebp, 1
movzx r10d, byte [rdi]
mov rdx, qword [rsi + 0xa8]
test r8d, r8d
je 0x140081db2
lea r9, [rdi - 1]
test rdx, rdx
jne 0x140081db5
mov qword [rsi + 0xa8], r9
mov rdx, r9
jmp 0x140081db5
xor r9d, r9d
movzx r8d, byte [rsi + 0x18]
movzx r10d, r10b
jmp 0x140081dc8
movzx r10d, byte [rdi + 1]
inc rdi
movzx r10d, word [rcx + r10*2]
test r10b, 5
jne 0x140081dc0
test r10b, 2
je 0x140081e0d
test r8b, r8b
jne 0x140081f56
cmp byte [rdi], 0xa
jne 0x140081dfc
mov r9, rdi
test rdx, rdx
jne 0x140081dfc
mov qword [rsi + 0xa8], rdi
mov rdx, rdi
mov r9, rdi
movzx r10d, byte [rdi + 1]
inc rdi
mov bpl, 1
movzx r10d, r10b
jmp 0x140081dc8
cmp byte [rsi + 0x92], 2
jb 0x140081e46
mov ecx, dword [rsi + 0x98]
mov eax, edi
sub eax, ecx
mov dword [rbx + 4], eax
mov r8d, dword [rsi + 0x80]
mov r9d, dword [rsi + 0x98]
sub r9d, dword [rsi + 0x70]
test r8d, r8d
js 0x140081ed5
add r8d, r9d
jmp 0x140081eec
movzx edx, byte [rdi - 1]
movzx edx, word [rcx + rdx*2]
and edx, 2
movzx ecx, word [rbx + 0x12]
and ecx, 0xfffffffd
or ecx, edx
xor ecx, 2
mov word [rbx + 0x12], cx
test bpl, 1
je 0x140081f56
or ecx, 1
mov word [rbx + 0x12], cx
mov byte [rax], 1
mov rax, qword [rsi + 0xa8]
test rax, rax
je 0x140081f56
test r9, r9
je 0x140081f56
cmp rax, r9
je 0x140081f56
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x140081f56
mov rbx, qword [rdx + 0x2e8]
test rbx, rbx
je 0x140081f56
mov rcx, qword [rsi + 0x70]
sub r9d, ecx
mov r8d, dword [rsi + 0x80]
test r8d, r8d
js 0x140081f10
add r9d, r8d
mov dword [rsp + 0x30], r9d
sub eax, ecx
inc eax
jmp 0x140081f39
mov rdx, qword [rsi + 8]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x38]
call fcn.14007c560
mov r8d, dword [rsp + 0x38]
mov dword [rbx], r8d
mov word [rbx + 0x10], 0
mov qword [rsi + 0x98], rdi
mov dil, 1
test bpl, 1
je 0x140081f5f
mov word [rsi + 0xa0], 0x101
jmp 0x140081f5f
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
call fcn.14007c560
mov r8d, dword [rsi + 0x80]
mov eax, dword [rsi + 0xa8]
sub eax, dword [rsi + 0x70]
inc eax
test r8d, r8d
js 0x140081f77
add eax, r8d
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
mov edx, eax
or rdx, rcx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov qword [rsi + 0x98], rdi
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401213e0
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rdx, qword [rsi + 8]
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x28]
mov r9d, eax
call fcn.14007c560
mov eax, dword [rsp + 0x28]
jmp 0x140081f40
Function at 0x14009dc90
Capabilities:
Get number of processors

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xb8
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140180518]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0xa0], 0
mov eax, dword [0x1401bc800]
mov ecx, dword [0x1401bd448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009dd8f
mov rax, qword [0x1401bc7f8]
mov qword [rsp + 0xa8], rax
lea r14, [rsp + 0x70]
movzx eax, word [rbx]
lea r8, [rsp + 0x32]
mov word [rsp + 0x30], ax
mov qword [rsp + 0x28], 0
mov rax, qword [rdi]
mov qword [rsp + 0x20], rax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov r9, r14
call fcn.140052dd0
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x20], r14
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.14004a100
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401213e0
mov rax, rsi
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x1401bc800]
call fcn.140121230
cmp dword [0x1401bc800], 0xffffffff
jne 0x14009dd10
mov rax, qword [0x1401bdc70]
test rax, rax
movabs rcx, 0xff51afd7ed558ccd
cmovne rcx, rax
mov qword [0x1401bc7f8], rcx
lea rcx, [0x1401bc800]
call fcn.140121298
jmp 0x14009dd10
Function at 0x1400b58b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0xaf8]
cmp qword [rcx + 0xaf0], rax
je 0x1400b58e2
mov rax, qword [rax - 0x10]
cmp rax, qword [rdi + 0x450]
jne 0x1400b58e2
mov rcx, rdi
call fcn.1400d6040
mov ecx, dword [rdi + 0x91c]
lea rax, [rdi + 0x450]
cmp rcx, 8
jne 0x1400b5906
mov rbx, qword [rax]
mov qword [rax], 0
test rbx, rbx
jne 0x1400b5934
jmp 0x1400b5944
lea edx, [rcx + 1]
mov dword [rdi + 0x91c], edx
lea rcx, [rdi + rcx*8]
add rcx, 0x920
cmp rcx, rax
je 0x1400b5944
mov rdx, qword [rax]
mov qword [rax], 0
mov rbx, qword [rcx]
mov qword [rcx], rdx
test rbx, rbx
je 0x1400b5944
mov rcx, rbx
call fcn.1400dcf90
mov rcx, rbx
call fcn.140121124
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400b3a60
Function at 0x140013fd0
Capabilities:
Read file on windows

Disassembly:
mov rax, rdx
movsxd r8, r8d
mov r9, rcx
mov edx, 1
mov rcx, rax
jmp fcn.14022a270
Function at 0x14001bec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x14001bef4
cmp ecx, r10d
jge 0x14001bee2
mov rcx, rbx
call fcn.14001b660
mov eax, dword [rbx + 0x18]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x18], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x14001bf2e
mov ecx, dword [rbx + 0x18]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x18], ecx
movzx r9d, cl
test eax, eax
jg 0x14001bf10
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x14001bf56
mov rax, qword gs:[0x58]
mov edx, 0x48
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x14001bf85
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14001bf6f
xor dl, dl
jmp 0x14001bf78
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14001bf66
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14001bf32
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x14001bfef
mov rax, qword gs:[0x58]
mov edx, 0x48
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x20]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x30]
jbe 0x14001c009
mov rcx, rbx
call fcn.14001b7a0
test eax, eax
je 0x14001bfe2
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x20]
call fcn.140276ca0
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x20], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140033eb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140033ee1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x140033f5b
mov rdi, r14
mov rcx, rbx
call fcn.14003b860
test rax, rax
jle 0x140033f33
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140276ca0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140033f4b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140033f53
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140033ef5
sub r14, rdi
jmp 0x14003403f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140033f72
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140033f74
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140033fa6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140276ca0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14003403c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140033fe1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14003401d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14022a270
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14003403c
cmp rbp, rax
ja 0x140033ff0
test rbp, rbp
je 0x14003403c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14022a270
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400a3010
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1403360b0]
test rax, rax
je 0x1400a302b
mov rbx, qword [rax + 0x98]
jmp 0x1400a302d
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x1400a3058
mov dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400ad470
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14032f0c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, rdx
mov rdi, rcx
mov r8, qword [rdx + 0x18]
add rdx, 8
cmp qword [rsi + 0x20], 0xf
jbe 0x1400ad4a9
mov rdx, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1400ad4e3
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1400ad4d0
mov r8, rsi
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0xf0]
call fcn.14005ce00
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x1400ad507
mov rdx, qword [rdi + 0x100]
lea r8, [rdi + 0xf8]
lea rcx, [rsp + 0x40]
call fcn.140033170
lea r8, [rdi + 0xf8]
mov rdx, qword [r8 + 8]
lea rcx, [rsp + 0x68]
call fcn.140033170
lea rcx, [rsp + 0x68]
call fcn.140002360
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140002360
cmp rax, rbx
je 0x1400ad5a9
lea rax, str.list_iterators_incompatible
mov qword [rsp + 0x28], rax
lea rax, [0x1402e4364]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc2
lea rdx, [0x1402eec90]
lea ecx, [r9 + 2]
call fcn.1402033a0
cmp eax, 1
jne 0x1400ad580
int3
mov qword [rsp + 0x20], 0
mov r9d, 0xc2
lea r8, str.C:Program_FilesMicrosoft_Visual_Studio2022CommunityVCToolsMSVC14.39.33519includelist
lea rdx, [0x1402e44a4]
lea rcx, str._list_iterators_incompatible_
call fcn.140203dc0
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x78]
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.1401f1c90
lea rcx, [rsp + 0x68]
call fcn.1400023f0
lea rcx, [rsp + 0x30]
call fcn.1401f1d70
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.1401f1c90
lea rcx, [rsp + 0x40]
call fcn.1400023f0
lea rcx, [rsp + 0x30]
call fcn.1401f1d70
cmp rdi, rbx
jne 0x1400ad621
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401f4d70
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov r8, rsi
lea rdx, str.logger_with_name_
lea rcx, [rsp + 0x68]
call fcn.1400b1590
nop
lea r8, str._already_exists
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140041780
mov rcx, rax
call fcn.1400086e0
int3