joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026f30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140026f8d
lea rbx, [0x140147eb0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140026f74
cmp r10, 2
jb 0x140026f74
cmp byte [r9], r8b
jne 0x140026f74
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140026f50
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140026fcf
lea rbx, [0x140147eb0]
cmp r8b, 0x23
jne 0x140026fb3
cmp byte [r9], r8b
jne 0x140026fb3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140026fa0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140027110
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14002712a
mov qword [r8], 0
lea rdx, [0x140154250]
call fcn.140026fe0
mov rbx, rax
test rax, rax
jne 0x14002714a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1400b83b8
mov esi, eax
cmp eax, 0xffffffff
je 0x140027218
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1400b7a38
test eax, eax
jne 0x140027218
mov rcx, rbx
call fcn.1400b83b8
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140027218
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400b7a38
test eax, eax
jne 0x140027218
cmp rdi, 0xffffffffffffffff
je 0x140027218
mov rax, qword [0x140178ac0]
test rax, rax
je 0x1400271ba
inc dword [rax + 0xec]
mov rcx, rdi
call fcn.1400bb334
mov rsi, rax
test rax, rax
je 0x140027218
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1400b7668
mov rcx, rbx
cmp rax, rdi
je 0x140027206
call fcn.1400aff78
mov rax, qword [0x140178ac0]
test rax, rax
je 0x1400271fc
dec dword [rax + 0xec]
mov rcx, rsi
call fcn.1400abb90
jmp 0x140027220
call fcn.1400aff78
test r14, r14
je 0x140027213
mov qword [r14], rdi
mov rax, rsi
jmp 0x140027222
mov rcx, rbx
call fcn.1400aff78
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400299f0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xc8]
mov rax, qword [rcx + 0xd0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x140147eb0]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x140178ac0]
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rax + 0x3ef4], ebx
jne 0x140029a7d
mov dword [rax + 0x3ef8], ebx
cmp dword [rax + 0x3f40], ebx
jne 0x140029a8c
mov byte [rax + 0x3f44], 1
cmp dword [rax + 0x3edc], ebx
jne 0x140029aa3
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.14003c2f0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140029ab0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm2, dword [rcx + 0xe8]
lea r8, [0x140147eb0]
movss xmm3, dword [rcx + 0xec]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xd0]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xc8]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
movss dword [rsp + 4], xmm1
subss xmm0, xmm2
movss xmm1, dword [rdx + 0xc]
mov edx, dword [rax + rcx*4 - 4]
subss xmm1, xmm3
movzx eax, byte [rsp]
not edx
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 1]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 2]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 3]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 4]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 5]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 6]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 7]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 8]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 9]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xa]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xb]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xc]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xd]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xe]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xf]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140178ac0]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x3ef4], edx
jne 0x140029c4f
mov dword [rax + 0x3ef8], edx
cmp dword [rax + 0x3f40], edx
jne 0x140029c5e
mov byte [rax + 0x3f44], 1
mov eax, edx
add rsp, 0x18
ret
Function at 0x140034080
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x140178ac0]
lea r10, [0x140147eb0]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3ea8]
add rbx, 0xc8
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
not edi
cmp dword [r8 + 0x3edc], edi
jne 0x140034125
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.14003c2f0
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x140034159
inc r8d
test ecx, ecx
je 0x140034142
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140034147
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.14003d310
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140035d00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401710c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140178ac0]
mov edi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x140035d61
cmp byte [rbx + 0x424e], 0
jne 0x140035d61
movsx r9d, word [rbx + 0x532e]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140026eb0
test dil, 1
je 0x140035e88
jmp 0x140035dea
movss xmm1, dword [rbx + 0x38b0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x532e]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140156aa4]
mulss xmm1, dword [0x140156a88]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
mov qword [rbx + 0x3fc8], rax
mov dword [rbx + 0x3fb4], 1
movss dword [rbx + 0x3fc0], xmm0
movss dword [rbx + 0x3fc4], xmm1
movss xmm0, dword [rbx + 0x390c]
mulss xmm0, dword [0x1401569a8]
or dword [rbx + 0x3fb0], 0x41
movss dword [rbx + 0x4010], xmm0
call fcn.140026eb0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140035e40
lea r11, [0x140147eb0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140035e23
cmp byte [r8], r9b
jne 0x140035e23
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140035e10
not ecx
call fcn.14002ed30
test rax, rax
je 0x140035e88
cmp byte [rax + 0x8e], 0
je 0x140035e88
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x532e]
mov edx, 0x10
movsx r9d, word [rbx + 0x532e]
call fcn.140026eb0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140031410
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a4dc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400687b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1401710c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r10, rcx
test al, al
je 0x1400687f0
cmp al, 0x25
jne 0x1400687e4
cmp byte [r10 + 1], al
jne 0x1400687f0
inc r10
movzx eax, byte [r10 + 1]
inc r10
test al, al
jne 0x1400687d7
cmp byte [r10], 0x25
jne 0x140068919
cmp byte [r10 + 1], 0x25
je 0x140068919
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.140059b20
mov r8, rax
cmp r10, rax
jae 0x140068850
movabs r9, 0x800000000000009
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x140068845
bt r9, rcx
jb 0x14006884b
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x140068830
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140026eb0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140068888
inc rcx
cmp byte [rcx], 0x20
je 0x140068880
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140068908
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1400688a3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x1400688b9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x1400688f6
movss xmm2, dword [0x140156a90]
cmp al, 0x39
ja 0x1400688f6
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400688d0
cmp r9b, 0x2d
jne 0x140068914
xorps xmm1, xmmword [0x140156f70]
movaps xmm0, xmm1
jmp 0x14006891c
call fcn.1400bb4a4
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14006891c
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a4dc0
add rsp, 0x90
pop rbx
ret
Function at 0x140068940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1401710c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r10, rcx
test al, al
je 0x140068980
cmp al, 0x25
jne 0x140068974
cmp byte [r10 + 1], al
jne 0x140068980
inc r10
movzx eax, byte [r10 + 1]
inc r10
test al, al
jne 0x140068967
cmp byte [r10], 0x25
jne 0x140068aa3
cmp byte [r10 + 1], 0x25
je 0x140068aa3
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.140059b20
mov r8, rax
cmp r10, rax
jae 0x1400689e0
movabs r9, 0x800000000000009
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x1400689d5
bt r9, rcx
jb 0x1400689db
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x1400689c0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140026eb0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140068a18
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140068a10
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140068a96
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x140068a33
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x140068a49
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x140068a84
movsd xmm2, qword [0x140156a38]
cmp al, 0x39
ja 0x140068a84
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140068a60
cmp r9b, 0x2d
jne 0x140068a9e
xorps xmm1, xmmword [0x140156f60]
movaps xmm0, xmm1
jmp 0x140068aa6
call fcn.1400bb4a4
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140068aa6
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400a4dc0
add rsp, 0x90
pop rbx
ret
Function at 0x140072b90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1401710c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14, rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.1400d70c0
mov dword [rsp + 0x58], 0x104
call fcn.140071eb0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x1a]
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rsp + 0x20]
call fcn.1400028b0
nop
call fcn.14008b540
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x140072c65
movabs r10, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140072c52
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.140072770
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140072c8a
cmp rdx, qword [rsi + 8]
je 0x140072c8a
mov rbx, qword [rdx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x20]
call fcn.1400027c0
test rbx, rbx
je 0x140072cbd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
xor edx, edx
call rbx
jmp 0x140072ccf
mov r8d, dword [rsp + 0x58]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140072cf0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140070ac0
nop
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.140072a80
nop
lea rcx, [rsp + 0x20]
call fcn.140070270
mov rax, r14
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1400a4dc0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140075450
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x1401710c0]
xor rax, rsp
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x108
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.1400d70c0
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
test rbx, rbx
je 0x14007553e
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x40]
mov r9d, 0x40
mov rdx, rbx
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x14007553e
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x14007553e
movsxd rdx, dword [rsp + 0x7c]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
add rdx, rbx
je 0x14007553e
mov rax, qword [rax + 0x70]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov r9d, 0x108
lea r8, [rsp + 0x80]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x14007553e
cmp dword [rsp + 0x80], 0x4550
sete al
jmp 0x140075540
xor al, al
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400a4dc0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rdi
ret

Function at 0x140075900
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1401710c0]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbx, rcx
movsxd rsi, r8d
lea rcx, [rsp + 0x40]
call fcn.140072970
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140072f80
xor edi, edi
lea rcx, [rsp + 0x60]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov dword [rsp + 0xa0], esi
call fcn.140070270
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x80]
movdqa xmm0, xmm1
movq rcx, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 7
movabs rax, 0xcbf29ce484222325
lea r8, [rcx + rcx]
cmova rdx, qword [rsp + 0x20]
test r8, r8
je 0x1400759e3
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx ecx, byte [rdi + rdx]
inc rdi
xor rax, rcx
imul rax, r9
cmp rdi, r8
jb 0x1400759d0
mov r9, rsi
lea r8, [rsp + 0x80]
xor r9, rax
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x18]
call fcn.140076bb0
cmp qword [rax + 8], 0
je 0x140075a17
lea rdx, [rsp + 0x80]
lea rcx, [rbx + 0x18]
call fcn.140075e00
lea rcx, [rsp + 0x80]
call fcn.140070270
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1400a4dc0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140075e00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 7
mov r8, rdx
mov r10, qword [rdx + 0x10]
mov rdi, rcx
mov r9, rdx
jbe 0x140075e21
mov r9, qword [rdx]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r10, r10
je 0x140075e54
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [r9 + rcx]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r10
jb 0x140075e40
movsxd r9, dword [r8 + 0x20]
mov rcx, rdi
xor r9, rdx
lea rdx, [rsp + 0x20]
call fcn.140076bb0
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x140075eec
mov rdx, qword [rdi + 0x30]
and rdx, r9
shl rdx, 4
add rdx, qword [rdi + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x140075ea5
cmp rax, rbx
jne 0x140075e9b
mov rax, qword [rdi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140075eb0
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x140075eb0
cmp rax, rbx
jne 0x140075eb0
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rdi + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
call fcn.140076c90
mov edx, 0x48
mov rcx, rbx
call fcn.1400a5020
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x140078530
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
xor esi, esi
mov rcx, qword [rcx + 0x10]
movzx edi, dl
test rcx, rcx
je 0x14007855c
jle 0x140078558
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140078571
jle 0x14007856d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x140078584
jle 0x140078581
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140078599
jle 0x140078595
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
test dil, dil
jne 0x1400785f8
lea rax, [rbx + 0xf8]
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 7
jbe 0x1400785bb
mov rax, qword [rax]
mov word [rax], si
cmp byte [rbx + 0x1c], sil
je 0x1400785e0
add rbx, 0x118
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400785d8
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400785e7
add rbx, 0x118
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 7
jbe 0x1400785f5
mov rbx, qword [rbx]
mov word [rbx], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140079380
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x1401710c0]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov rdi, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x70]
call fcn.1400d70c0
xor ebx, ebx
mov dword [rsp + 0x78], ebx
mov qword [rsp + 0x40], 0x38
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rbx
lea r8, [rsi + 0x50]
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.1400795e0
mov r12, rax
test rax, rax
je 0x140079594
test rdi, rdi
jne 0x140079512
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x190]
call fcn.1400d70c0
lea rdx, [rbp + 0x190]
mov ecx, 0x100
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea r9, [rbp - 0x70]
xor r8d, r8d
lea rdx, str.ImageManifest
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x140079464
mov eax, 0xc0150002
jmp 0x140079596
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 4
xor r9d, r9d
xor r8d, r8d
mov edx, 0x120116
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
setg r14b
test rax, rax
jle 0x1400794fe
mov dword [rbp - 0x80], ebx
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x80]
mov r8d, dword [rsp + 0x78]
mov rdx, r12
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r14b, r14b
je 0x1400794c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x78], rbx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400794e0
lea rcx, [rsi + 0x118]
lea rdx, [rbp - 0x70]
call fcn.1400702e0
nop
jmp 0x14007954e
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x140079596
mov dword [rsp + 0x44], 8
movzx eax, word [rsi + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rdi
lea rdx, [rsi + 0xf8]
lea rcx, [rsi + 0x118]
cmp rcx, rdx
je 0x14007954e
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 7
jbe 0x140079549
mov rdx, qword [rdx]
call fcn.1400702e0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov rdi, rax
mov rcx, qword [rsi + 0x48]
cmp rax, rcx
je 0x140079577
test rcx, rcx
jle 0x140079570
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rsi + 0x48], rdi
mov rcx, rdi
test rcx, rcx
jg 0x140079594
mov rax, qword gs:[0x30]
cmp dword [rax + 0x1250], 0xc0000022
jne 0x1400795c1
mov dword [rsi + 0x50], ebx
xor eax, eax
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.1400a4dc0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x140079596