joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ce620
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x48]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401ce6f1
xor eax, eax
lea rdx, [rsp + 0x64]
mov rcx, rsi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov word [rsp + 0x58], 0x208
mov dword [rsp + 0x5c], 0x6601
mov dword [rsp + 0x60], 8
mov dword [rsp + 0x68], eax
call fcn.1401ce580
lea rcx, [rsp + 0x64]
mov edx, 8
call fcn.1401d3be0
mov rcx, qword [rsp + 0x48]
xor r9d, r9d
lea r11, [rsp + 0x50]
lea r8d, [r9 + 0x14]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1401ce6f5
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x1401ce742
mov ecx, dword [rsp + 0x40]
mov rax, qword [rdi]
xor r9d, r9d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rbx], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14017ae40
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1401ce770
Capabilities:
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov r8, rcx
mov rdx, rdi
mov rcx, rsi
call fcn.1401ce620
lea r8, [rbx + 7]
lea rdx, [rdi + 8]
mov rcx, rsi
call fcn.1401ce620
lea r8, [rbx + 0xe]
lea rdx, [rdi + 0x10]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1401ce620
Function at 0x1401ce8c0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
mov rbx, r8
mov rbp, rdx
not rcx
dec rcx
mov rsi, rcx
add rcx, rcx
call qword [fcn.14017cf5c]
mov rdi, rax
test rax, rax
jne 0x1401ce907
lea eax, [rdi + 0x1b]
jmp 0x1401ce9c3
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.1401ce890
lea rcx, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1401ce9b0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1401ce9a3
mov rcx, qword [rsp + 0x30]
lea r8d, [rsi + rsi]
xor r9d, r9d
mov rdx, rdi
mov dword [rsp + 0x68], reloc.ODBC32.dll_SQLFreeStmt
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbx
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbx + 0x10], eax
mov byte [rbx + 0x14], al
call qword [fcn.14017cf1c]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1401d1420
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rdi, r8
cmp dword [rcx + 8], 3
mov rsi, rdx
jne 0x1401d146a
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x1401d145a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x1401d14b2
cmp qword [rbx + 0x10], 0
jne 0x1401d149e
mov rcx, qword [rcx + 0x10]
lea rdx, [0x140285b80]
call fcn.14017c0d0
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1401d149e
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx + 0x10]
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.14017caf0
mov rdi, rax
test rax, rax
jne 0x1401d14d5
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1401d14cc
call fcn.14017bf90
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1401d4700
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov r12d, r8d
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbp, rdx
lea rcx, [r9 + rax + 0x18]
call qword [fcn.14017cf5c]
mov rdi, rax
test rax, rax
jne 0x1401d4741
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rsp + 0x48], rsi
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x1401d4785
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + reloc.ODBC32.dll_SQLFreeStmt]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x1401d47e4
mov rsi, r12
nop dword [rax + rax]
movzx eax, byte [rbp]
lea rdx, [rsp + 0x40]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x40]
xor r11b, 0x5c
mov r8d, 1
inc rbp
mov byte [rsp + 0x40], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
dec r12
jne 0x1401d47a0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1401d4823
nop dword [rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14027bbc9]
mov r8d, 1
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14027bbca]
mov r8d, 1
call qword [rbx + reloc.ODBC32.dll_SQLDescribeCol]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1401d47f0
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret

Function at 0x1401d4b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x1401d4b7a
call fcn.14017df7c
and dword [rax], 0
call fcn.14017df5c
mov ebx, reloc.WLDAP32.dll_Ordinal_22
mov dword [rax], ebx
call main
mov eax, ebx
jmp 0x1401d4bca
test edx, 0xfffffff9
jne 0x1401d4b5d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1401d4ba3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14017df9c
call fcn.14017df5c
mov eax, dword [rax]
jmp 0x1401d4bca
test al, 0x10
jne 0x1401d4bc8
test al, 1
je 0x1401d4bc8
test bl, 2
je 0x1401d4bc8
call fcn.14017df7c
mov dword [rax], 5
call fcn.14017df5c
mov dword [rax], reloc.ODBC32.dll_SQLFetch
jmp 0x1401d4b9a
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1401d6250
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x1402ded38]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1401d6290
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1401d6290
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movzx eax, byte [rbx]
test al, al
je 0x1401d636c
mov qword [rsp + 0x270], rsi
mov rcx, rbx
mov rsi, rbx
nop dword [rax]
cmp al, 0x2f
je 0x1401d62b8
cmp al, 0x5c
jne 0x1401d62bb
mov rsi, rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1401d62b0
cmp rsi, rbx
je 0x1401d62f9
sub rsi, rbx
lea rcx, [rsp + 0x130]
mov rdx, rbx
mov r8, rsi
call fcn.14017b330
lea rdx, [rsp + 0x130]
mov rcx, rdi
mov byte [rsp + rsi + 0x130], 0
call fcn.1401d6250
mov rsi, qword [rsp + 0x270]
mov byte [rsp + 0x20], 0
test rdi, rdi
je 0x1401d632e
lea rcx, [rsp + 0x20]
sub rcx, rdi
nop word [rax + rax]
movzx eax, byte [rdi]
inc rdi
mov byte [rcx + rdi - 1], al
test al, al
jne 0x1401d6320
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x1401d6340
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1401d636c
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14017ae40
mov rbx, qword [rsp + 0x278]
add rsp, 0x250
pop rdi
ret

Function at 0x1401d65e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
mov rbp, rdx
mov r10, rcx
imul esi, edx
cmp byte [r9], 0
je 0x1401d6630
mov rdx, rcx
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, esi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401d662a
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x1401d6661
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
mov qword [rsp + 0x40], rbx
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x1401d6648
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov r8d, esi
mov rcx, r10
call fcn.14017b330
add dword [rdi + 0x2c], esi
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x58]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401d6af0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x1401d6b09
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x1402897c0]
cmp r11d, 8
jb 0x1401d6c01
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
dec rbx
jne 0x1401d6b30
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x1401d6c2f
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r11d
jne 0x1401d6c10
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x1401d7750
Capabilities:
Read file on windows

Disassembly:
push rsi
push r15
sub rsp, 0x68
cmp byte [rcx], 0
mov rsi, rcx
je 0x1401d7788
cmp byte [rcx + 1], 0
je 0x1401d777d
mov rcx, qword [rcx + 8]
mov r9d, 2
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1401d778e
or eax, 0xffffffff
add rsp, 0x68
pop r15
pop rsi
ret
mov eax, dword [rcx + 0x28]
mov dword [rcx + 0x2c], eax
cmp byte [rsi], 0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
je 0x1401d77d0
cmp byte [rsi + 1], 0
je 0x1401d77cb
mov rcx, qword [rsi + 8]
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r12d, eax
sub r12d, dword [rsi + 0x14]
jmp 0x1401d77d4
xor r12d, r12d
jmp 0x1401d77d4
mov r12d, dword [rsi + 0x2c]
mov ebp, 0xffff
mov r13d, 0x404
mov dword [rsp + 0x80], r12d
cmp r12d, ebp
mov ecx, r13d
cmovb ebp, r12d
mov dword [rsp + 0x98], ebp
call fcn.14017cf5c
mov rdi, rax
test rax, rax
jne 0x1401d780d
or eax, 0xffffffff
jmp 0x1401d7962
mov qword [rsp + 0x60], rbx
mov ebx, 4
or r15d, 0xffffffff
cmp ebp, ebx
jbe 0x1401d7952
mov qword [rsp + 0x38], r14
nop dword [rax + rax]
lea eax, [rbx + 0x400]
mov r14d, r12d
cmp eax, ebp
mov ebx, eax
cmova ebx, ebp
sub r14d, ebx
sub r12d, r14d
cmp r12d, r13d
cmova r12d, r13d
cmp byte [rsi], 0
je 0x1401d7875
cmp byte [rsi + 1], 0
je 0x1401d794d
mov eax, dword [rsi + 0x14]
mov rcx, qword [rsi + 8]
xor r9d, r9d
lea edx, [r14 + rax]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x1401d7879
mov dword [rsi + 0x2c], r14d
cmp byte [rsi], 0
mov ebp, r12d
mov r13d, r12d
je 0x1401d78b6
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x88]
mov r8d, ebp
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401d78ad
mov byte [rsi + 0x10], 1
mov eax, dword [rsp + 0x88]
jmp 0x1401d78e3
mov ecx, dword [rsi + 0x2c]
mov edx, dword [rsi + 0x28]
lea eax, [rcx + r12]
cmp eax, edx
jbe 0x1401d78ca
mov r13d, edx
sub r13d, ecx
mov rdx, rcx
mov r8d, r13d
mov rcx, rdi
add rdx, qword [rsi + 0x20]
call fcn.14017b330
add dword [rsi + 0x2c], r13d
mov eax, r13d
xor edx, edx
div rbp
cmp rax, 1
jne 0x1401d794d
lea ecx, [r12 - 3]
movsxd rax, ecx
test ecx, ecx
js 0x1401d792b
nop word [rax + rax]
dec rax
dec ecx
cmp byte [rax + rdi], 0x50
jne 0x1401d7920
cmp byte [rax + rdi + 1], 0x4b
jne 0x1401d7920
cmp byte [rax + rdi + 2], 5
jne 0x1401d7920
cmp byte [rax + rdi + 3], 6
je 0x1401d7927
test rax, rax
jns 0x1401d7900
jmp 0x1401d792b
lea r15d, [rcx + r14]
test r15d, r15d
jne 0x1401d794d
mov ebp, dword [rsp + 0x98]
mov r12d, dword [rsp + 0x80]
mov r13d, 0x404
cmp ebx, ebp
jb 0x1401d7830
mov r14, qword [rsp + 0x38]
mov rcx, rdi
call fcn.14017cf1c
mov rbx, qword [rsp + 0x60]
mov eax, r15d
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov r13, qword [rsp + 0x40]
add rsp, 0x68
pop r15
pop rsi
ret
Function at 0x1401d7990
Capabilities:
Read file on windows

Disassembly:
push rbx
push r12
sub rsp, 0x38
cmp byte [rcx], 0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rdi
mov edi, 1
mov r12, rdx
mov rbx, rcx
je 0x1401d79e0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401d79da
mov byte [rbx + 0x10], dil
mov esi, dword [rsp + 0x60]
jmp 0x1401d7a1a
mov qword [rsp + 0x58], rbp
mov ebp, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rbp + 1]
cmp eax, ecx
jbe 0x1401d79f6
mov edi, ecx
sub edi, ebp
mov rdx, rbp
lea rcx, [rsp + 0x50]
mov r8d, edi
add rdx, qword [rbx + 0x20]
mov esi, edi
call fcn.14017b330
lea r11d, [rbp + rdi]
mov rbp, qword [rsp + 0x58]
mov dword [rbx + 0x2c], r11d
mov rdi, qword [rsp + 0x30]
cmp esi, 1
mov rsi, qword [rsp + 0x68]
jne 0x1401d7a3c
movzx eax, byte [rsp + 0x50]
mov dword [r12], eax
xor eax, eax
add rsp, 0x38
pop r12
pop rbx
ret
cmp byte [rbx], 0
je 0x1401d7a32
cmp byte [rbx + 0x10], 0
je 0x1401d7a32
or eax, 0xffffffff
add rsp, 0x38
pop r12
pop rbx
ret

Function at 0x1401d7a60
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx + 8]
mov r10, rcx
movzx r11d, dl
mov edx, dword [rcx]
mov r8d, r9d
and r8d, 0xfffd
mov ecx, edx
shr edx, 8
or r8d, 2
mov eax, r8d
xor eax, 1
imul eax, r8d
lea r8, [0x1402897c0]
shr eax, 8
xor r11b, al
movsx rax, r11b
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
mov dword [r10], ecx
movzx ecx, r9b
add eax, dword [r10 + 4]
shr r9d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [r10 + 4], eax
movzx eax, byte [r10 + 7]
xor rcx, rax
mov eax, dword [r8 + rcx*4]
xor eax, r9d
mov dword [r10 + 8], eax
movzx eax, r11b
ret
Function at 0x1401da2b0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1401da2ce
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
cmp dword [rcx + 0x1c], 0
je 0x1401da2c2
cmp qword [rcx + 0x80], 0
je 0x1401da2e3
call fcn.1401d64e0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1401d9330
test eax, eax
je 0x1401da30a
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call fcn.14017cf5c
mov rbx, rax
test rax, rax
jne 0x1401da330
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call fcn.14017cf5c
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
mov dword [rbx + 0x6c], ecx
test rax, rax
jne 0x1401da376
mov rcx, rbx
call fcn.14017cf1c
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov dword [rbx + 0x64], ebp
mov eax, dword [rdi + 0x40]
mov ecx, ebp
cmp dword [rdi + 0x38], ecx
mov dword [rbx + 0x78], eax
mov dword [rbx + 0x74], ebp
mov eax, dword [rdi + 0x38]
sete cl
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x24], ebp
mov dword [rbx + 0x94], eax
test ecx, ecx
jne 0x1401da3cd
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.1401d9ee0
test eax, eax
jne 0x1401da3cd
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
movzx eax, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x1401da3f8
movzx eax, byte [rdi + 0x3d]
jmp 0x1401da3fc
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
movzx eax, byte [rbx + 0x98]
mov dword [rbx + 0x9c], 0x12345678
neg al
mov dword [rbx + 0xa0], 0x23456789
mov dword [rbx + 0xa4], 0x34567890
sbb ecx, ecx
and ecx, 0xc
mov dword [rbx + 0xa8], ecx
test rsi, rsi
je 0x1401da4a2
lea r8, [0x1402897c0]
movzx eax, byte [rsi]
test al, al
je 0x1401da4a2
mov edx, dword [rbx + 0x9c]
mov ecx, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
mov edx, dword [rbx + 0xa4]
movzx eax, cl
mov dword [rbx + 0x9c], ecx
movzx ecx, dl
add eax, dword [rbx + 0xa0]
shr edx, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0xa0], eax
movzx eax, byte [rbx + 0xa3]
xor rcx, rax
mov eax, dword [r8 + rcx*4]
xor eax, edx
inc rsi
mov dword [rbx + 0xa4], eax
jne 0x1401da440
mov ecx, dword [rdi + 0x7c]
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x10], ebp
mov rbp, qword [rsp + 0x20]
lea ecx, [rcx + rax + 0x1e]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401daec0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
jne 0x1401daf78
cmp dword [rcx + 8], 0xffffffff
jne 0x1401daf78
lea rdx, [rcx + 0x150]
mov ecx, 0x104
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 0x150]
repne scasb al, byte [rdi]
not rcx
movzx eax, byte [rcx + rbx + 0x14e]
cmp al, 0x5c
je 0x1401daf35
cmp al, 0x2f
je 0x1401daf35
xor eax, eax
lea rdi, [rbx + 0x150]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x14028baa8]
mov word [rdi - 1], ax
lea rcx, [rsp + 0x30]
call fcn.1401d67f0
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
test rax, rax
jne 0x1401daf58
mov eax, dword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rcx, rax
call fcn.1401da5f0
xor ecx, ecx
mov edx, 0x200
test rax, rax
mov qword [rbx], rax
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov eax, 0x1000000
add rsp, 0x20
pop rbx
ret
Function at 0x1401e1ea0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea r8, [rcx + 0x118]
mov rbx, rcx
mov rcx, rdi
mov edx, 0x40b
call fcn.140033de8
lea r8, [rbx + 0x1f0]
mov edx, 0x40f
mov rcx, rdi
call fcn.14003402c
lea r8, [rbx + 0x1f8]
mov edx, 0x3ed
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14003402c

Function at 0x1401e1f00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x20
mov rbp, rcx
lea rcx, str.C:UsersPublicUMlUmfcTo0g.dat
xor edx, edx
xor ebx, ebx
call fcn.1401d4bd0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbp
lea rdx, [0x140285b80]
repne scasb al, byte [rdi]
not rcx
lea r12, [rcx - 1]
lea rcx, str.C:UsersPublicUMlUmfcTo0g.dat
call fcn.14017c0d0
lea rdx, [0x14027df8c]
lea rcx, str.C:UsersPublicL78V3gUKHilu2km1RgBU.dat
mov rdi, rax
call fcn.14017c0d0
mov rcx, rdi
mov rsi, rax
call fcn.14017c7c0
test eax, eax
jne 0x1401e1fc5
nop
mov edx, 1
lea rcx, [rsp + 0x48]
mov r9, rdi
mov r8d, edx
call fcn.14017caf0
mov rcx, rdi
call fcn.14017c7c0
test eax, eax
jne 0x1401e1fb9
mov eax, ebx
mov r9, rsi
cdq
idiv r12d
movsxd rax, edx
mov edx, 1
movzx ecx, byte [rax + rbp]
mov r8d, edx
xor byte [rsp + 0x48], cl
lea rcx, [rsp + 0x48]
call fcn.14017c268
inc ebx
mov rcx, rdi
call fcn.14017c7c0
test eax, eax
je 0x1401e1f70
mov rcx, rdi
call fcn.14017bf90
mov rcx, rsi
call fcn.14017bf90
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r12
pop rdi
pop rsi
ret