joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d220
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42d4a6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42d49a
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x005c3492], 0
jne 0x42d27a
xor edx, edx
xor ebx, ebx
jmp 0x42d2c0
xor edx, edx
jmp 0x42d2a5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call sym.runtime.shade
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42d27e
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42d434
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42d2bb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call sym.runtime.findObject
test rax, rax
jne 0x42d30c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42d2bb
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42d34c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42d2bb
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42d48d
lea r10, [0x00595878]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42d3cf
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42d405
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42d2bb
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42d485
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42d2bb
cmp rbx, 0x200
ja 0x42d474
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call sym.runtime._gcWork_.putBatch
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call sym.runtime._wbBuf_.reset
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call sym.runtime.panicSliceAcap
mov rax, r8
call sym.runtime.panicIndex
mov rax, r8
mov ecx, 0x40
call sym.runtime.panicIndexU
mov edx, 0x200
nop
call sym.runtime.panicSliceAlenU
nop
mov qword [rsp + 8], rax
call sym.runtime.morestackc.abi0
mov rax, qword [rsp + 8]
jmp sym.runtime.wbBufFlush1
Function at 0x442140
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4422a7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x442152
cmp edx, ecx
jne 0x442295
nop word [rax + rax]
test rsi, rsi
jne 0x442295
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x4421b4
nop
call sym.runtime.nanotime1.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c36b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call sym.runtime.updateTimerPMask
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x442290
mov rdx, qword [0x005705d8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x442285
mov rcx, qword [0x005705d0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00571110]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00571110], rax
nop
mov edx, 1
lea rsi, [0x00571118]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x442273
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004cd0ef]
mov ebx, 0x28
nop
call sym.runtime.throw
mov rax, rsi
mov rcx, rdx
call sym.runtime.panicIndex
call sym.runtime.panicshift
lea rax, [0x004cc442]
mov ebx, 0x23
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.pidleput
Function at 0x44d2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44d457
movzx edx, byte [rax]
test edx, edx
jne 0x44d314
nop dword [rax]
test r8b, r8b
jne 0x44d314
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44d327
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44d417
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44d405
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44d3f7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44d37d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44d3c0
mov eax, 1
cmp rax, rbx
ja 0x44d3ab
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44d3ef
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44d3b3
mov rcx, r11
mov eax, r12d
jmp 0x44d382
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44d44d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44d410
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44d32d
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3
Function at 0x454860
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45490f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c36b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45dee0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005c348b], 0
je 0x45deee
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45df00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005c348b], 0
je 0x45df15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45df20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005c348b], 0
je 0x45df55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005c3a20]
aesenc xmm0, xmmword [0x005c3a30]
aesenc xmm0, xmmword [0x005c3a40]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x45df60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005c348b], 0
je 0x45df96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005c3a20]
aesenc xmm0, xmmword [0x005c3a30]
aesenc xmm0, xmmword [0x005c3a40]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x45f880
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x45fc80
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45fcb4
mov rcx, 0x28
jmp 0x45fcbf
shl rcx, 3
add rcx, 0x1480
mov qword [0x005c36b0], rcx
pop rbp
ret
Function at 0x478320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4783ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c36b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4783cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004aed20]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x4783be
mov edi, 1
lea rsi, [0x004aed20]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004e9920]
lea rsi, [0x004e91c0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140015010
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001126c
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012d20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012d40
xor al, al
jmp 0x140012dc1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012d53
xor al, al
jmp 0x140012dc1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012d7d
xor al, al
jmp 0x140012dc1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012d91
xor al, al
jmp 0x140012dc1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012da3
xor al, al
jmp 0x140012dc1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012dbf
xor al, al
jmp 0x140012dc1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001be14
Capabilities:
Delete directory

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, rcx
lea rdi, [rcx + 8]
mov rax, qword [rcx + 0x10]
cmp dword [rax - 8], 0
je 0x14001be57
mov rcx, qword [rdi]
call fcn.140039400
nop
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
nop
lea rcx, [rbx + 0x128]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocumentView::AddRef]
nop dword [rax + rax]
nop
lea rcx, [rbx + 0x100]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocumentView::AddRef]
nop dword [rax + rax]
nop
lea rcx, [rbx + 0xf8]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef]
nop dword [rax + rax]
nop
lea rcx, [rbx + 0xf0]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef]
nop dword [rax + rax]
nop
lea rcx, [rbx + 0xc8]
call fcn.1400216a0
nop
lea rcx, [rbx + 0xa0]
call fcn.1400216a0
nop
lea rcx, [rbx + 0x78]
call fcn.140021384
nop
lea rcx, [rbx + 0x50]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocumentView::AddRef]
nop dword [rax + rax]
nop
lea rcx, [rbx + 0x48]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef]
nop dword [rax + rax]
nop
lea rcx, [rbx + 0x20]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocumentView::AddRef]
nop dword [rax + rax]
nop
lea rcx, [rbx + 0x18]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef]
nop dword [rax + rax]
nop
lea rcx, [rbx + 0x10]
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef]
nop dword [rax + rax]
nop
mov rcx, rdi
call qword [sym.imp.MFC42u.dll_CDocObjectServer::XOleDocument::AddRef]
nop dword [rax + rax]
nop
mov rcx, rbx
call qword [sym.imp.MFC42u.dll_CMonthCalCtrl::SetFirstDayOfWeek]
nop dword [rax + rax]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400304a0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
mov edi, r8d
xor r10d, r10d
mov r8, rdx
mov r9, rcx
test edi, edi
je 0x140030677
mov edx, dword [r9 + 8]
movzx ecx, byte [r10 + r8]
shr rdx, 2
mov eax, dword [r9 + rdx*4 + 0x20]
shl eax, 8
or ecx, eax
mov dword [r9 + rdx*4 + 0x20], ecx
inc dword [r9 + 8]
cmp dword [r9 + 8], 0x40
jne 0x14003066b
lea rcx, [r9 + 0x28]
mov edx, 0x40
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x140030504
mov r12d, dword [r9 + 0xc]
lea r14, [r9 + 0x20]
mov r13d, dword [r9 + 0x10]
lea ebp, [rdx + 0x14]
mov r8d, dword [r9 + 0x14]
mov esi, r12d
mov ebx, dword [r9 + 0x18]
mov r11d, r13d
mov r15d, dword [r9 + 0x1c]
mov eax, r8d
mov edx, r11d
and eax, r11d
not edx
and edx, ebx
mov ecx, esi
rol ecx, 5
or edx, eax
add ecx, r15d
mov r15d, ebx
add ecx, edx
mov ebx, r8d
add ecx, dword [r14]
mov r8d, r11d
ror r8d, 2
lea r14, [r14 + 4]
mov r11d, esi
lea esi, [rcx + 0x5a827999]
sub rbp, 1
jne 0x14003053f
lea r14d, [rbp + 0x14]
mov ebp, r14d
lea rdx, [r9 + 0x70]
mov eax, ebx
mov ecx, esi
xor eax, r8d
rol ecx, 5
xor eax, r11d
add eax, ecx
add eax, dword [rdx]
lea rdx, [rdx + 4]
add eax, r15d
mov r15d, ebx
mov ebx, r8d
mov r8d, r11d
ror r8d, 2
mov r11d, esi
lea esi, [rax + 0x6ed9eba1]
sub rbp, 1
jne 0x140030586
lea rbp, [r9 + 0xc0]
mov edx, esi
mov ecx, r8d
or ecx, r11d
rol edx, 5
and ecx, ebx
mov eax, r8d
and eax, r11d
or ecx, eax
add ecx, dword [rbp]
lea eax, [r15 + rdx]
add eax, 0x8f1bbcdc
lea rbp, [rbp + 4]
add eax, ecx
mov r15d, ebx
mov ebx, r8d
mov r8d, r11d
ror r8d, 2
mov r11d, esi
mov esi, eax
sub r14, 1
jne 0x1400305c1
lea rdx, [r9 + 0x110]
lea ebp, [r14 + 0x14]
mov eax, ebx
mov ecx, esi
xor eax, r8d
rol ecx, 5
xor eax, r11d
add ecx, r15d
add eax, 0xca62c1d6
mov r15d, ebx
add eax, dword [rdx]
mov ebx, r8d
mov r8d, r11d
lea rdx, [rdx + 4]
add eax, ecx
ror r8d, 2
mov r11d, esi
mov esi, eax
sub rbp, 1
jne 0x14003060b
add dword [r9 + 0x14], r8d
add eax, r12d
add dword [r9 + 0x18], ebx
add dword [r9 + 0x1c], r15d
add qword [r9], 0x200
and dword [r9 + 8], ebp
mov r8, qword [rsp + 0x38]
mov dword [r9 + 0xc], eax
lea eax, [r11 + r13]
mov dword [r9 + 0x10], eax
inc r10d
cmp r10d, edi
jne 0x1400304d0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140030a68
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
mov r8, rcx
mov edx, 0x40
add rcx, 0x28
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x140030a8f
mov r15d, dword [r8 + 0xc]
lea ebx, [rdx + 0x14]
mov r12d, dword [r8 + 0x10]
lea r14, [r8 + 0x20]
mov r13d, dword [r8 + 0x14]
mov ebp, ebx
mov r11d, dword [r8 + 0x18]
mov edi, r15d
mov esi, dword [r8 + 0x1c]
mov r10d, r12d
mov r9d, r13d
mov eax, r9d
mov edx, r10d
and eax, r10d
not edx
and edx, r11d
mov ecx, edi
rol ecx, 5
or edx, eax
add ecx, esi
mov esi, r11d
add ecx, edx
mov r11d, r9d
add ecx, dword [r14]
mov r9d, r10d
ror r9d, 2
lea r14, [r14 + 4]
mov r10d, edi
lea edi, [rcx + 0x5a827999]
sub rbp, 1
jne 0x140030acf
lea rdx, [r8 + 0x70]
mov rbp, rbx
mov eax, r11d
mov ecx, edi
xor eax, r9d
rol ecx, 5
xor eax, r10d
add eax, ecx
add eax, dword [rdx]
lea rdx, [rdx + 4]
add eax, esi
mov esi, r11d
mov r11d, r9d
mov r9d, r10d
ror r9d, 2
mov r10d, edi
lea edi, [rax + 0x6ed9eba1]
sub rbp, 1
jne 0x140030b12
lea rbp, [r8 + 0xc0]
mov r14, rbx
mov edx, edi
mov ecx, r9d
or ecx, r10d
rol edx, 5
and ecx, r11d
mov eax, r9d
and eax, r10d
or ecx, eax
add ecx, dword [rbp]
lea eax, [rsi + rdx]
add eax, 0x8f1bbcdc
lea rbp, [rbp + 4]
add eax, ecx
mov esi, r11d
mov r11d, r9d
mov r9d, r10d
ror r9d, 2
mov r10d, edi
mov edi, eax
sub r14, 1
jne 0x140030b50
lea rdx, [r8 + 0x110]
mov eax, r11d
mov ecx, edi
xor eax, r9d
rol ecx, 5
xor eax, r10d
add ecx, esi
add eax, 0xca62c1d6
mov esi, r11d
add eax, dword [rdx]
mov r11d, r9d
mov r9d, r10d
lea rdx, [rdx + 4]
add eax, ecx
ror r9d, 2
mov r10d, edi
mov edi, eax
sub rbx, 1
jne 0x140030b96
add dword [r8 + 0x1c], esi
add eax, r15d
add dword [r8 + 0x18], r11d
add qword [r8], 0x200
and dword [r8 + 8], ebx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [r8 + 0xc], eax
lea eax, [r12 + r10]
mov dword [r8 + 0x10], eax
lea eax, [r9 + r13]
mov dword [r8 + 0x14], eax
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400328e0
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x168]
cmp dword [rcx - 8], 0
je case.default.0x14003290a
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.MFC42u.dll_CDaoRecordset::Find]
Function at 0x140038710
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003875c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140038754
cmp dword [rcx + 0x3c], edx
jl 0x140038754
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140038754
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14003875c
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400389b4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ebx, r8d
mov rcx, qword [rcx]
mov rdi, rdx
cmp dword [rcx - 8], 0
jne 0x140038a0d
test ebx, ebx
je 0x1400389ee
lea rcx, str.No_PDB_file_to_parse_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140038a06
xor r8d, r8d
lea rcx, str.No_PDB_file_to_parse
xor edx, edx
call qword [sym.imp.MFC42u.dll_Ordinal_1499]
nop dword [rax + rax]
xor al, al
jmp 0x140038a94
mov rdx, qword [rdx]
cmp dword [rdx - 8], 0
jne 0x140038a56
mov edx, 0x1f4
mov rcx, rdi
call qword [sym.imp.MFC42u.dll_CDatabase::GetConnectInfo]
nop dword [rax + rax]
mov rdx, rax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.MFC42u.dll_CCmdUI::SetCheck]
nop dword [rax + rax]
mov rdx, qword [rdi]
mov rcx, qword [rsi]
call fcn.140069f1c
test eax, eax
je 0x140038a92
test ebx, ebx
je 0x140038a7a
mov edx, eax
lea rcx, str.Failed_to_parse_PDB:_status__d_n
call qword [sym.imp.msvcrt.dll_wprintf]
nop dword [rax + rax]
jmp 0x140038a92
xor r8d, r8d
lea rcx, str.Failed_to_parse_PDB
xor edx, edx
call qword [sym.imp.MFC42u.dll_Ordinal_1499]
nop dword [rax + rax]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140039184
Capabilities:
Get file size

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
xor esi, esi
mov r12, rdx
mov qword [rax - 0x38], rsi
xor r9d, r9d
mov dword [rax - 0x40], 0x80
mov edx, 0x80000000
mov r15, rcx
mov dword [rax - 0x48], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
lea r14, [rax + 1]
cmp r14, 1
jbe 0x1400392a8
lea rdx, [rsp + 0x84]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
nop dword [rax + rax]
mov dword [rsp + 0x80], eax
test eax, eax
je 0x140039293
mov r9d, dword [rsp + 0x84]
lea r8d, [rsi + 2]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
nop dword [rax + rax]
mov rdi, rax
lea rbp, [rax + 1]
cmp rbp, 1
jbe 0x140039293
mov eax, dword [rsp + 0x80]
lea edx, [rsi + 4]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
nop dword [rax + rax]
test rax, rax
je 0x14003927e
mov r8d, dword [rsp + 0x80]
mov r9, r12
mov rdx, rax
mov rcx, r15
call fcn.140039020
mov sil, al
cmp rbp, 1
jbe 0x140039293
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp r14, 1
jbe 0x1400392a8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x70]
mov al, sil
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret