joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add al, 2
add bh, bh
add al, 2
add bh, bh
add al, 2
add bh, bh
add al, 2
add bh, bh
add al, 2
add bh, bh
add al, 2
add bh, bh
add al, 2
add bh, bh
add al, 2
add bh, bh
add al, 2
add bh, bh
add byte [rax], al
add bh, bh
add eax, dword [rbx]
add bh, bh
add byte [rax], al
add bh, bh
push 0xffffffffd0ff4e5a
sal byte [rsp + rbx*4 - 0x69543b01], 1
sal byte [rsp + rbx*4 - 0x69543b01], 1
invalid
add edi, edi
or dword [rbx + rax], eax
dec dword [rcx]
add al, 3
dec dword [rcx]
add al, 3
dec dword [rbx]
add eax, 0xff05
add byte [rax], al
add byte [rax], al
add bh, bh
jle 0x14003f6ea
pop rbp
invalid
invalid
jl 0x14003f6fb
pop rdi
inc dword [rax]
add byte [rax], al
dec dword [rcx]
invalid
add al, 0xff
invalid
add al, 0xff
or byte [rbx], al
add al, 0xff
invalid
or al, 0xff
and dword [rdx], edx
or edi, edi
cmp dword [0x19c82f60f], esp
ljmp [r10]
inc dword [rax]
add byte [rax], al
inc dword [rdx]
add dword [rcx], eax
inc dword [rax]
add byte [rax], al
inc dword [0x14902f90e]
add al, byte [rdi + rdi*8]
invalid

Function at 0x140007284
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x14000734a
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x14000730e
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000730b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x1400205b8]
mov rdx, rsi
call fcn.140011c68
jmp 0x14000730e
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072db
mov rdx, qword [0x14001f118]
lea rcx, [0x1400205b8]
mov rdi, rdx
inc rdx
mov qword [0x14001f118], rdx
lea edx, [rbx + 0x20]
call fcn.140011cb0
lea rcx, [0x140021170]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret
Function at 0x140010008
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx + 0x258]
xor ebx, ebx
mov esi, edx
cmp rcx, 0xffffffffffffffff
jne 0x14001003b
lea ebx, [rcx + 2]
jmp 0x140010115
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rdi + 0x258], 0xffffffffffffffff
test esi, esi
je 0x140010115
cmp dword [rdi + 0x18], ebx
jne 0x140010115
and qword [rsp + 0x30], rbx
and dword [rsp + 0x28], ebx
lea rcx, [rdi + 0x34]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, 0x80070000
mov qword [rdi + 0x258], rax
cmp rax, 0xffffffffffffffff
jne 0x1400100a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010115
mov rdx, qword [rdi + 0x248]
mov rcx, qword [rdi + 0x258]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400100d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010115
mov rcx, qword [rdi + 0x258]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400100fd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, esi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140010115
mov rcx, qword [rdi + 0x28]
mov rdx, qword [rdi + 0x248]
mov r9, qword [rcx]
mov r8, rdx
call qword [r9 + 0xa0]
mov rcx, qword [rdi + 0x258]
cmp rcx, 0xffffffffffffffff
je 0x140010130
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rdi + 0x258], 0xffffffffffffffff
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400104a8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov r11d, dword [r8]
mov rbx, rdx
mov r9, rcx
and r11d, 0xfffffff8
test byte [r8], 4
mov r10, rcx
je 0x1400104d6
mov eax, dword [r8 + 8]
movsxd r10, dword [r8 + 4]
neg eax
add r10, rcx
movsxd rcx, eax
and r10, rcx
movsxd rax, r11d
mov rdx, qword [rax + r10]
mov rax, qword [rbx + 0x10]
mov ecx, dword [rax + 8]
add rcx, qword [rbx + 8]
test byte [rcx + 3], 0xf
je 0x1400104fa
movzx eax, byte [rcx + 3]
and eax, 0xfffffff0
cdqe
add r9, rax
xor r9, rdx
mov rcx, r9
add rsp, 0x20
pop rbx
jmp fcn.140010528

Function at 0x14001110c
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140010f7c
Function at 0x140001a20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140001a41
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001a6e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001a70
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001ac9
test ecx, ecx
jle 0x140001aa9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001ac9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001ac9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140001af0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001b12
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140001b21
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001b44
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001b46
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001b82
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001c1e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001bbd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140001bfe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140001c1e
cmp rbx, rax
ja 0x140001bd0
test rbx, rbx
je 0x140001c1e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400020ad
xor eax, eax
jmp 0x140002219
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400020e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400020e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002219
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000220c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000212a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002155
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002211
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400021c4
sub eax, 1
je 0x1400021c4
cmp eax, 2
jne 0x14000220c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002211
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400021f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000220c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002211
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140002d00
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400026a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140007040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002773
cmp byte [rcx + 0x71], 0
je 0x140002773
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000276f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002734
sub eax, 1
je 0x140002738
cmp eax, 2
jne 0x14000276f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002d00
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002766
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000276f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000271c
xor al, al
jmp 0x14000271c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140002d00
add rsp, 0x60
pop rbx
ret

Function at 0x140003680
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400036ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400036ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400036ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400036ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400036ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400036cc
xor al, al
add rsp, 0x28
ret
Function at 0x140f88058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140f881df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f88089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f8806f
add dl, dl
jne 0x140f88096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f880f6
xor eax, eax
add dl, dl
jne 0x140f880a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f881ad
add dl, dl
jne 0x140f880b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f880c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f880d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f880dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f880ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f8807e
mov eax, 1
add dl, dl
jne 0x140f88106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f88113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f880fb
sub eax, ebx
mov ebx, 1
jne 0x140f8814c
mov ecx, 1
add dl, dl
jne 0x140f8812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f8813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f88123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f8807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f88168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f88175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f8815d
cmp eax, 0x7d00
jae 0x140f8819b
cmp eax, 0x500
jb 0x140f88196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f8807e
cmp eax, 0x7f
ja 0x140f8819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f8807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f881d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f8807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000654c
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x14006efd4], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x1400065ac
movdqa xmm0, xmmword [0x140045b20]
movdqa xmm1, xmmword [0x140045b10]
movdqa xmmword [0x140059d00], xmm0
movdqa xmm0, xmmword [0x140045af0]
movdqa xmmword [0x140059d10], xmm1
movdqa xmm1, xmmword [0x140045b00]
movdqa xmmword [0x140059d20], xmm0
movdqa xmmword [0x140059d30], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140031590
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x140045ad0]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x1400065c8
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x1400074e8
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov bpl, dl
mov word [rcx + 0x9512], r14w
mov rsi, rcx
mov byte [rcx + 0x9509], r14b
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.140006b5c
mov rdi, rax
test rax, rax
je 0x14000756d
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.140034408
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.140006b5c
mov rdi, rax
test rax, rax
je 0x14000756d
mov rbx, qword [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
test bpl, bpl
je 0x140007566
call fcn.140007690
jmp 0x140007532
call fcn.140007228
jmp 0x140007532
test bpl, bpl
jne 0x14000757a
mov rcx, rsi
call fcn.140007590
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140009ad8
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x850
mov rax, qword [0x1400592c0]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov rax, rdx
mov rdi, r8
mov rbx, rcx
lea rdx, [rsp + 0x40]
mov rcx, rax
mov r8d, 0x400
call fcn.1400213f4
mov esi, 1
mov ecx, esi
call fcn.140037a90
xor r14d, r14d
cmp rbx, rax
jne 0x140009b31
cmp byte [0x14005ad5d], r14b
jne 0x140009b53
mov ebp, 2
mov ecx, ebp
call fcn.140037a90
cmp rbx, rax
jne 0x140009c1b
cmp byte [0x14005ad5e], r14b
je 0x140009c1b
mov ecx, esi
call fcn.140037a90
sub rbx, rax
neg rbx
sbb ecx, ecx
add ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
call fcn.140004fe8
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x40]
mov esi, 0x1800
mov qword [rsp + 0x20], r14
lea rdi, [0x14005d560]
mov r8d, esi
mov rcx, qword [rax]
mov rdx, rdi
call fcn.140036840
mov ecx, dword [0x14005ad58]
cmp ecx, 3
jne 0x140009bbd
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r14w
jne 0x140009bab
add r8d, r8d
mov rdx, rdi
jmp 0x140009c06
lea rbx, [0x140060560]
cmp ecx, 4
mov rdx, rbx
mov r8, rsi
mov rcx, rdi
jne 0x140009bd9
call fcn.140023aa0
jmp 0x140009bde
call fcn.140023a1c
test dword [0x14005ad58], 0xfffffffd
jne 0x140009bf6
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharToOemA]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], r14b
jne 0x140009bfa
mov rdx, rbx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140009c84
call fcn.140004fe8
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x40]
lea rdi, [0x14005d560]
mov qword [rsp + 0x20], r14
mov r8d, 0x1800
mov rdx, rdi
mov rcx, qword [rax]
call fcn.140036840
mov ecx, ebp
call fcn.140037a90
mov ecx, r14d
cmp rbx, rax
setne cl
add ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r14w
jne 0x140009c64
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.14002f020
add rsp, 0x850
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140009f64
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [0x140061d60]
mov r11, r8
mov rbx, rdx
mov r10d, ecx
test r8, r8
je 0x140009fa8
test bl, 7
je 0x140009fa8
movzx ecx, byte [rbx]
inc rbx
movzx eax, r10b
xor rcx, rax
shr r10d, 8
xor r10d, dword [rsi + rcx*4]
sub r11, 1
jne 0x140009f88
cmp r11, 8
jb 0x14000a04e
mov rdi, r11
shr rdi, 3
imul rax, rdi, 0xfffffffffffffff8
add r11, rax
xor r10d, dword [rbx]
mov r9d, dword [rbx + 4]
add rbx, 8
mov eax, r9d
mov edx, r9d
shr eax, 0x10
movzx ecx, al
mov eax, r9d
shr eax, 8
shr rdx, 0x18
mov r8d, dword [rsi + rdx*4]
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr eax, 0x10
movzx ecx, al
mov eax, r10d
shr eax, 8
xor r8d, dword [rsi + rcx*4 + 0x1400]
movzx ecx, al
movzx eax, r9b
xor r8d, dword [rsi + rcx*4 + 0x1800]
xor r8d, dword [rsi + rax*4 + 0xc00]
movzx eax, r10b
mov r10d, r8d
xor r10d, dword [rsi + rax*4 + 0x1c00]
sub rdi, 1
jne 0x140009fc0
test r11, r11
je 0x14000a06e
movzx ecx, byte [rbx]
inc rbx
movzx eax, r10b
xor rcx, rax
shr r10d, 8
xor r10d, dword [rsi + rcx*4]
sub r11, 1
jne 0x14000a053
mov rbx, qword [rsp + 8]
mov eax, r10d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x14000a0a4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x14000a0eb
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
test cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x14000a0b9
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x14000a0b0
ret

Function at 0x14000a258
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1400592c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp dword [rcx], 2
lea rbx, [rcx + 4]
mov rsi, rdx
mov rdi, rcx
mov r14d, 0x20
jne 0x14000a2f0
and qword [r11 - 0x58], 0
lea r9d, [r14 - 0x1c]
and qword [r11 - 0x60], 0
lea r8, [r11 - 0x48]
mov eax, dword [rbx]
mov edx, r14d
and qword [r11 - 0x68], 0
mov rcx, rsi
and qword [r11 - 0x70], 0
mov dword [rsp + 0x50], eax
lea rax, [r11 - 0x40]
mov qword [r11 - 0x78], rax
call fcn.14000b3b8
xor r9d, r9d
lea r10, [rsp + 0x58]
xor r8d, r8d
movzx edx, byte [r10]
mov ecx, r9d
and ecx, 3
inc r9d
shl ecx, 3
inc r10
shl edx, cl
xor edx, r8d
mov r8d, edx
cmp r9d, r14d
jb 0x14000a2ce
mov dword [rbx], edx
cmp dword [rdi], 3
jne 0x14000a339
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
and qword [rsp + 0x38], 0
mov r9, r14
and qword [rsp + 0x30], 0
mov r8, rbx
and qword [rsp + 0x28], 0
mov rdx, r14
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.14000b3b8
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14002f020
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rdi
pop rsi
ret