joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005bc0
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x238
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x230], rax
cmp word [rcx], 0
je 0x140005c81
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005c3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140005c3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140005c3c
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005d0d
lea rdx, str.Could_not_delete_service_updater_path:__ls.
mov r8, rsi
call fcn.140008c60
lea rcx, [rsp + 0x20]
mov r8d, 0x20a
xor edx, edx
call fcn.14000b870
mov rcx, rsi
call fcn.140013abc
cmp rax, 0x104
ja 0x140005c81
lea rdi, [rsp + 0x20]
mov r8d, 0x105
mov rcx, rdi
mov rdx, rsi
call fcn.140013f84
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x140005c9c
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140018400
nop
add rsp, 0x238
pop rdi
pop rsi
ret
lea rdx, str.updater.ini
lea rcx, [rsp + 0x20]
call int.1400258a0
test eax, eax
je 0x140005c81
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140005c81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x140005c81
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140005c81
mov eax, dword [0x140038330]
mov ecx, dword [0x140036d60]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140005d4e
lea rdx, str.Could_not_delete_service_updater_INI_path:__ls.
lea r8, [rsp + 0x20]
call fcn.140008c60
jmp 0x140005c81
lea rcx, [0x140038330]
call fcn.14000a550
cmp dword [0x140038330], 0xffffffff
jne 0x140005c2d
mov qword [0x140038120], 0
lea rcx, [fcn.140001d00]
call fcn.14000a6e8
lea rcx, [0x140038330]
call fcn.14000a5b8
jmp 0x140005c2d
lea rcx, [0x140038330]
call fcn.14000a550
cmp dword [0x140038330], 0xffffffff
jne 0x140005cf7
mov qword [0x140038120], 0
lea rcx, [fcn.140001d00]
call fcn.14000a6e8
lea rcx, [0x140038330]
call fcn.14000a5b8
jmp 0x140005cf7
Function at 0x140008840
Capabilities:
Create directory
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x140027010]
xor esi, esi
lea r9, [rsp + 0x20]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x140008896
mov rbx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.140013abc
cmp rax, 0x105
jb 0x1400088ad
mov rcx, rbx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140018400
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov r8d, 0x105
mov rcx, rdi
mov rdx, rbx
call fcn.140013f84
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.Mozilla_Maintenance_Service
mov rcx, rdi
call int.1400258a0
test eax, eax
je 0x140008896
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400088fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140008896
lea rdx, str.UpdateLogs
mov rcx, rdi
call int.1400258a0
test eax, eax
je 0x140008896
xor esi, esi
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000892f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140008896
mov esi, 1
jmp 0x140008896

Function at 0x140008a00
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x468
mov esi, edx
mov rbx, rcx
mov rax, qword [0x140036030]
xor rax, rsp
mov qword [rsp + 0x460], rax
xor edi, edi
lea r14, [rsp + 0x40]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000b870
mov rcx, r14
call fcn.140008840
test eax, eax
je 0x140008a76
xor edi, edi
lea r14, [rsp + 0x250]
mov r8d, 0x20a
mov rcx, r14
xor edx, edx
call fcn.14000b870
lea rdx, str..status
mov rcx, rbx
mov r8, r14
call fcn.140008940
test eax, eax
jne 0x140008a95
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.140018400
mov eax, edi
add rsp, 0x468
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [rsp + 0x40]
lea rdx, [rsp + 0x250]
call int.1400258a0
test eax, eax
je 0x140008a76
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor edi, edi
lea rcx, [rsp + 0x40]
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140008a76
mov rbx, rax
lea rdi, [rsp + 0x250]
mov rcx, rdi
mov r8d, esi
call fcn.140025a00
mov rcx, rdi
call fcn.1400139a0
mov rsi, rax
mov qword [rsp + 0x20], 0
lea r14, [rsp + 0x3c]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
setne al
cmp dword [r14], esi
sete cl
and cl, al
movzx edi, cl
jmp 0x140008a76
Function at 0x1400a6370
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1400b0ae0
push rbp
push rsi
push rdi
sub rsp, 0x220
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x50
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14027ad00]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x140293107]
call fcn.1400a8ab7
movss xmm0, dword [0x1401ff270]
movss dword [rbp + 4], xmm0
movss xmm0, dword [0x1401ff260]
movss dword [rbp + 0x24], xmm0
xorps xmm0, xmm0
movss dword [rbp + 0x44], xmm0
movss xmm0, dword [0x1401ff268]
movss dword [rbp + 0x64], xmm0
mov rax, qword [0x14027b2e0]
add rax, 0x2454
mov r8d, 4
movss xmm1, dword [rbp + 4]
mov rcx, rax
call fcn.1400a77ac
mov rax, qword [0x14027b2e0]
add rax, 0x2458
mov r8d, 4
movss xmm1, dword [rbp + 0x24]
mov rcx, rax
call fcn.1400a77ac
mov rax, qword [0x14027b2e0]
add rax, 0x245c
mov r8d, 4
movss xmm1, dword [rbp + 0x44]
mov rcx, rax
call fcn.1400a77ac
mov rax, qword [0x14027b2e0]
add rax, 0x2460
mov r8d, 4
movss xmm1, dword [rbp + 0x64]
mov rcx, rax
call fcn.1400a77ac
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400b0bfb
movzx eax, byte [0x14025f004]
test eax, eax
je 0x1400b0bfb
movss xmm0, dword [0x14027b36c]
ucomiss xmm0, dword [0x1401ff26c]
jp 0x1400b0c02
jne 0x1400b0c02
xor al, al
jmp 0x1400b0d66
lea rax, [rbp + 0x1e0]
lea rcx, [0x14027b2f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
lea r8, [rbp + 0x1e0]
lea rdx, [rbp + 0x88]
lea rcx, [0x14027b360]
call fcn.1400a7978
movss xmm0, dword [rbp + 0x88]
mulss xmm0, dword [rbp + 0x88]
movss xmm1, dword [rbp + 0x8c]
mulss xmm1, dword [rbp + 0x8c]
addss xmm0, xmm1
movss xmm1, dword [rbp + 0x90]
mulss xmm1, dword [rbp + 0x90]
addss xmm0, xmm1
call qword [sym.imp.ucrtbased.dll_sqrtf]
movss dword [rbp + 0xb4], xmm0
movss xmm0, dword [rbp + 0x90]
divss xmm0, dword [rbp + 0xb4]
call qword [sym.imp.ucrtbased.dll_acosf]
mulss xmm0, dword [0x1401ff25c]
subss xmm0, dword [0x1401ff264]
xorps xmm0, xmmword [0x1401ff280]
movss dword [rbp + 0xd4], xmm0
movss xmm1, dword [rbp + 0x88]
movss xmm0, dword [rbp + 0x8c]
call qword [sym.imp.ucrtbased.dll_atan2f]
mulss xmm0, dword [0x1401ff25c]
movss dword [rbp + 0xf4], xmm0
mov rax, qword [0x14027b2e0]
add rax, 0x2454
mov r8d, 4
movss xmm1, dword [rbp + 0xd4]
mov rcx, rax
call fcn.1400a77ac
mov rax, qword [0x14027b2e0]
add rax, 0x2458
mov r8d, 4
movss xmm1, dword [rbp + 0xd4]
mov rcx, rax
call fcn.1400a77ac
mov rax, qword [0x14027b2e0]
add rax, 0x245c
mov r8d, 4
movss xmm1, dword [rbp + 0xf4]
mov rcx, rax
call fcn.1400a77ac
mov rax, qword [0x14027b2e0]
add rax, 0x2460
mov r8d, 4
movss xmm1, dword [rbp + 0xf4]
mov rcx, rax
call fcn.1400a77ac
mov al, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1401fee90]
call fcn.1400a835f
mov rax, rdi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.1400a741e
lea rsp, [rbp + 0x200]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a7752
Capabilities:
Terminate process

Disassembly:
jmp 0x1401f1e00
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400a7ae0
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400e6350
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x140293760]
call fcn.1400a8ab7
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400a7c75
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400e62e0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x140293760]
call fcn.1400a8ab7
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400a7c8e
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400e81f0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x140293760]
call fcn.1400a8ab7
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x140200b30]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x1400e8335
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x1400e8289
mov dword [rbp + 0x160], 1
jmp 0x1400e8293
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x1400e8330
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x1400e830a
cmp qword [rbp + 0x198], 2
jb 0x1400e830a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400e830a
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400e830a
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400e8254
jmp 0x1400e83cf
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x1400e83cf
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x1400e83a6
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400e83a6
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x1400e83a6
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x1400e8335
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400a7d9c
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401f3040
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401f3060
xor al, al
jmp 0x1401f30e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1401f3073
xor al, al
jmp 0x1401f30e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401f309d
xor al, al
jmp 0x1401f30e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401f30b1
xor al, al
jmp 0x1401f30e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401f30c3
xor al, al
jmp 0x1401f30e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401f30df
xor al, al
jmp 0x1401f30e1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400a8774
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400e80d0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x140293760]
call fcn.1400a8ab7
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x140200b30]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x1400e814f
mov dword [rbp + 0x120], 1
jmp 0x1400e8159
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x1400e81a2
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x1400e811a
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x1400a87b0
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x1400b97f0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x708
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x12a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x728]
mov rax, qword [0x14027ad00]
xor rax, rbp
mov qword [rbp + 0x6d8], rax
lea rcx, [0x1402936c3]
call fcn.1400a8ab7
mov qword [rbp + 8], 0
mov edx, dword [rbp + 0x700]
mov ecx, 0x18
call fcn.1400a73a6
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x1400b98ba
lea rax, [rbp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x438
rep stosb byte [rdi], al
mov dword [rbp + 0x50], 0x438
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400a7a04
test eax, eax
je 0x1400b98ba
mov rdx, qword [rbp + 0x708]
lea rcx, [rbp + 0x80]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1400b98a9
mov rax, qword [rbp + 0x68]
mov qword [rbp + 8], rax
jmp 0x1400b98ba
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400a6645
test eax, eax
jne 0x1400b9887
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 8]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140200a70]
call fcn.1400a835f
mov rax, rdi
mov rcx, qword [rbp + 0x6d8]
xor rcx, rbp
call fcn.1400a741e
lea rsp, [rbp + 0x6e8]
pop rdi
pop rbp
ret
Function at 0x1400a8c47
Capabilities:
Enumerate processes

Disassembly:
jmp 0x1400b9940
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x14027ad00]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x1402936c3]
call fcn.1400a8ab7
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.1400a73a6
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
je 0x1400b99ed
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400a7950
test eax, eax
je 0x1400b99ed
mov rdx, qword [rbp + 0x440]
lea rcx, [rbp + 0x7c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x1400b99dc
mov eax, dword [rbp + 0x58]
mov dword [rbp + 4], eax
jmp 0x1400b99ed
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.1400a84a4
test eax, eax
jne 0x1400b99bf
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140200af0]
call fcn.1400a835f
mov eax, edi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.1400a741e
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140005668
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x14005c794], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x1400056c8
movdqa xmm0, xmmword [0x140034af0]
movdqa xmm1, xmmword [0x140034ae0]
movdqa xmmword [0x1400473c0], xmm0
movdqa xmm0, xmmword [0x140034ac0]
movdqa xmmword [0x1400473d0], xmm1
movdqa xmm1, xmmword [0x140034ad0]
movdqa xmmword [0x1400473e0], xmm0
movdqa xmmword [0x1400473f0], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140020be0
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x140034aa0]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x1400056e4
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x14000697c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x830
mov rax, rdx
mov rdi, r8
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov rcx, rax
mov r8d, 0x400
call fcn.14001398c
mov esi, 1
mov ecx, esi
call fcn.140026350
cmp rbx, rax
jne 0x1400069c1
cmp byte [0x14004841c], 0
jne 0x1400069e3
mov ebp, 2
mov ecx, ebp
call fcn.140026350
cmp rbx, rax
jne 0x140006aa6
cmp byte [0x14004841d], 0
je 0x140006aa6
mov ecx, esi
call fcn.140026350
sub rbx, rax
neg rbx
sbb ecx, ecx
add ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
call fcn.140004148
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdi, [0x14004ac20]
mov esi, 0x1800
mov rdx, rdi
mov rcx, qword [rax]
mov r8d, esi
call fcn.140025cf8
mov eax, dword [0x140048418]
mov rcx, rdi
cmp eax, 3
jne 0x140006a49
call fcn.1400237c0
mov rdx, rdi
lea r8d, [rax + rax]
jmp 0x140006a8d
lea rbx, [0x14004dc20]
mov r8, rsi
mov rdx, rbx
cmp eax, 4
jne 0x140006a62
call fcn.140015cf8
jmp 0x140006a67
call fcn.140015c74
test dword [0x140048418], 0xfffffffd
jne 0x140006a7f
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharToOemA]
mov rcx, rbx
call fcn.140023830
mov r8, rax
mov rdx, rbx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x850]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140006b13
call fcn.140004148
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdi, [0x14004ac20]
mov r8d, 0x1800
mov rdx, rdi
mov rcx, qword [rax]
call fcn.140025cf8
mov ecx, ebp
call fcn.140026350
xor ecx, ecx
cmp rbx, rax
setne cl
add ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rdi
mov rbx, rax
call fcn.1400237c0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x868]
mov r8, rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rbx, qword [rsp + 0x858]
add rsp, 0x830
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006db8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [0x14004f420]
mov r10, r8
mov rbx, rdx
mov r11d, ecx
test r8, r8
je 0x140006e01
test bl, 7
je 0x140006e01
movzx ecx, byte [rbx]
inc rbx
movzx eax, r11b
xor rcx, rax
mov eax, r11d
shr eax, 8
mov r11d, dword [rsi + rcx*4]
xor r11d, eax
sub r10, 1
jne 0x140006ddc
cmp r10, 8
jb 0x140006eab
mov rdi, r10
shr rdi, 3
imul rax, rdi, 0xfffffffffffffff8
add r10, rax
xor r11d, dword [rbx]
mov r9d, dword [rbx + 4]
add rbx, 8
mov eax, r9d
shr eax, 0x18
movzx edx, al
mov eax, r9d
shr eax, 0x10
movzx ecx, al
mov eax, r9d
shr eax, 8
mov r8d, dword [rsi + rdx*4]
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r11d
shr eax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
movzx ecx, al
mov eax, r11d
shr eax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1000]
movzx ecx, al
mov eax, r11d
shr eax, 8
xor r8d, dword [rsi + rcx*4 + 0x1400]
movzx ecx, al
movzx eax, r9b
xor r8d, dword [rsi + rcx*4 + 0x1800]
xor r8d, dword [rsi + rax*4 + 0xc00]
movzx eax, r11b
mov r11d, r8d
xor r11d, dword [rsi + rax*4 + 0x1c00]
sub rdi, 1
jne 0x140006e19
test r10, r10
je 0x140006ed0
movzx ecx, byte [rbx]
inc rbx
movzx eax, r11b
xor rcx, rax
mov eax, r11d
shr eax, 8
mov r11d, dword [rsi + rcx*4]
xor r11d, eax
sub r10, 1
jne 0x140006eb0
mov rbx, qword [rsp + 8]
mov eax, r11d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140006ee4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x140006f2b
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x140006ef9
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x140006ef0
ret

Function at 0x140007098
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rdi
sub rsp, 0x70
cmp dword [rcx], 2
mov rdi, rdx
mov rbx, rcx
mov ebp, 0x20
jne 0x14000711a
and qword [r11 - 0x38], 0
lea r9d, [rbp - 0x1c]
mov eax, dword [rcx + 4]
lea r8, [r11 + 8]
and qword [r11 - 0x40], 0
mov edx, ebp
and qword [r11 - 0x48], 0
mov rcx, rdi
and qword [r11 - 0x50], 0
mov dword [r11 + 8], eax
lea rax, [r11 - 0x28]
mov qword [r11 - 0x58], rax
call fcn.14000799c
and dword [rbx + 4], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
movzx eax, byte [r9]
mov ecx, r8d
and ecx, 3
inc r8d
shl ecx, 3
inc r9
shl eax, cl
xor edx, eax
cmp r8d, ebp
jb 0x1400070fb
mov dword [rbx + 4], edx
cmp dword [rbx], 3
jne 0x140007164
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
and qword [rsp + 0x38], 0
lea r8, [rbx + 4]
and qword [rsp + 0x30], 0
mov r9, rbp
and qword [rsp + 0x28], 0
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.14000799c
mov r8, rbp
lea rdx, [rsp + 0x50]
lea rcx, [rbx + 4]
call fcn.140020790
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret