joyce8/EMBER2024-capa huggingface dataset:
Function at 0x185859
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r8, 0
jmp 0x185a85
pop word [rsp]
lea rsp, [rsp + 2]
lea rsp, [rsp + 1]
jmp 0x185860
lea rsp, [rsp + 4]
jmp 0x18582a
lea rsp, [rsp + 1]
mov qword [rsp + 0x48], r15
lea rsp, [rsp + 0x48]
jmp 0x185cfa
mov di, 0x35d8
sub rsp, 0x16
ja 0x185885
bt ebx, r9d
jmp 0x1858fe
mov r11b, 0x1a
lea rsp, [rsp + 6]
jmp 0x1858d0
mov ecx, r8d
mov r10b, 5
push r8
jmp 0x1858a3
pushfq
jmp 0x183768

Function at 0x185d4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
sub rsp, 6
jno 0x185f8b
bsf rsi, rdi
mov byte [rsp + 0xa], bl
pop rbx
lea rsp, [rsp + 4]
jmp 0x185d80
xchg ebx, r15d
jmp 0x185d99
xchg ebx, r15d
lea rsp, [rsp + 2]
add r14b, 0x70
mov rdx, 0xffffffffabc7be15
cmc
jmp 0x185f07
lea r9, [rax + rsi]
add dx, 0x5fc7
mov r9b, byte [rsp]
pushfq
jmp 0x185dd9
mov byte [rsp + 0xa], bl
pop rbx
lea rsp, [rsp + 4]
jmp 0x185d96
sub r13b, r14b
mov r14, 0x4830421
cpuid
bt rax, rsp
jmp 0x185e0c
mov r9b, byte [rsp]
pushfq
jmp 0x185dd9
lea r9, [r11 + riz - 0x66f8]
mov dx, r11w
jmp 0x185e47
ja 0x185e27
xchg r15, rbx
jmp 0x185e2a
xchg r15, rbx
inc rdi
neg dl
jmp 0x185e5e
mov ecx, 0xdf33de3a
push rbp
dec rax
jns 0x185ecb
js 0x185e93
invalid
bt r14w, sp
btc ebx, ebx
mov rsi, 0xffffffff820b0295
jmp 0x185e31
ja 0x185df6
lea r9, [r11 + riz - 0x66f8]
mov dx, r11w
bt r14w, sp
btc ebx, ebx
mov rsi, 0xffffffff820b0295
jmp 0x185e31
rdtsc
jmp 0x185eda
neg rdx
mov rcx, qword [rsp + 2]
mov r8b, byte [rsp + 6]
jmp 0x185e7d
rcl rdx, 0x37
rol edx, 0xd
clc
jmp 0x185f31
clc
xchg r15b, cl
jmp 0x185f34
neg rdx
mov rcx, qword [rsp + 2]
mov r8b, byte [rsp + 6]
rdtsc
lea rsp, [rsp + 8]
dec r10b
mov dl, byte [rsp]
bts edx, r15d
jmp 0x185eef
ja 0x185ea2
rcl rdx, 0x37
rol edx, 0xd
jmp 0x185eb0
jno 0x185db0
lea r9, [rax + rsi]
add dx, 0x5fc7
jmp 0x185def
mov r9, 0x4eefea5c
mov r8w, 0x46c7
rdtsc
jmp 0x185f56
xchg r15b, cl
not r10b
mov rcx, r10
setne r14b
jmp 0x185f1b
mov r9b, byte [rsp]
mov al, 0xea
jmp 0x185f68
add r14b, cl
jl 0x185f40
mov r9b, byte [rsp]
mov al, 0xea
jmp 0x185f68
not r10b
mov bl, byte [rsp]
not ebx
lea r15, [rax + r9]
mov r12b, byte [rsp]
call fcn.00185faa
sbb dword [rax + 0x7a98690e], ebx
jno 0x185f7a
add byte [rax], al
add byte [rcx], bl
cwde
invalid
or al, 0xff
or byte [rdi + rdx*4 + 0x48], ah
bsf esi, edi
bsf rsi, rdi
jmp 0x185dcd

Function at 0x2bcfae
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap rax
pop di
xchg r15d, r10d
jmp 0x2bcf94

Function at 0x2bd0cc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg rdi, rbx
mov byte [rsp + 0x15], r13b
jmp 0x2bd117
not r13w
mov r11d, 0xac0be162
lea rsi, [rcx + riz - 0x44]
jmp 0x2bd12d
mov eax, 0xcf063ca
sub rsp, 0x1f
pop rax
xchg r15, r8
xchg dword [rsp + 0x2b], edi
pop dx
jmp 0x2bd101
push r12
neg r8b
cpuid
not cx
mov qword [rsp + 0x2b], rbp
rdtsc
jmp 0x2bd159
Function at 0x2bd4a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt r9, r10
mov qword [rsp + 0xf], rcx
xchg r9b, al
rdtsc
xchg esi, ebx
jmp 0x2bd502
inc rbx
bswap rax
sub rsp, 8
rol dil, cl
mov r11d, esp
mov dword [rsp + 0x1c], edx
jmp 0x2bd474
pop di
mov si, 0x470e
mov bl, al
xchg r15w, di
jmp 0x2bd48a
mov r9b, 0x5d
mov qword [rsp + 0xd], rcx
mov r12b, 0x82
mov cx, word [rsp + 0x16]
xchg rsi, r12
jmp 0x2bd4e9
mov qword [rsp + 1], rsi
pop qword [rsp + 3]
mov byte [rsp + 0x11], r9b
rdtsc
pop word [rsp + 0xb]
mov bl, cl
jmp 0x2bd4b6
mov ebx, esi
xchg rdi, rax
sub rsp, 0x1e
xchg dword [rsp + 0x16], r8d
mov edi, ecx
add rsp, 0x1f
jmp 0x2bd518
inc r15w
xchg r10w, bx
not r15d
setl r8b
cpuid
mov cl, bpl
jmp 0x2bd4cf
xchg r9d, r11d
mov r8, qword [rsp + 0xd]
push qword [rsp + 5]
jmp 0x2bd53c

Function at 0x2be327
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop r15w
not r12w
xchg word [rsp + 0x24], dx
jmp 0x2bd9fd
mov dil, al
rdtsc
neg r12
mov r9w, r8w
mov byte [rsp + 5], spl
bt si, r14w
jmp 0x2bd9b9
xchg rbx, r9
xchg qword [rsp + 0xc], r13
rdtsc
mov byte [rsp + 7], r14b
jmp 0x2bda53
mov r8w, si
rdtsc
lea rcx, [0x42a5cf67]
pop qword [rsp + 0x16]
mov r15b, byte [rsp + 8]
bsf r15d, edi
jmp 0x2bd9e7
mov word [rsp + 0x20], r15w
neg r11w
call fcn.002bda6a
invalid
lea r13, [r10 + r14]
mov byte [rsp + 0x13], al
lea r15, [rdi + riz - 0x73d6575d]
mov r13b, 0xc
mov rdx, 0x1251a19d
jmp 0x2bda1b
lea r8, [rdi + r13]
mov r9, rsp
push qword [rsp + 0x10]
mov r13b, dil
mov dl, byte [rsp + 0x17]
rdtsc
jmp 0x2bda31
sub rsp, 0x12
pop si
xchg qword [rsp + 0x57], r8
lea rsp, [rsp + 0x4b]
xchg dword [rsp + 0x18], r9d
lea r12, [rdi + r8]
jmp 0x2bd9cf
push rcx
mov r9, 0xffffffffaf93f774
bswap edi
sub rsp, 0x13
mov word [rsp + 0xb], bx
mov dil, al
jmp 0x2bda92
neg r13w
mov r10w, 0xff8c
cpuid
push qword [rsp + 0x2b]
xchg bl, cl
cld
jmp 0x2bdadb
bsr r10d, edi
mov dx, cx
xchg al, r10b
bswap rcx
mov r9b, dil
pop word [rsp + 0x35]
jmp 0x2bdb75
bsr edi, esi
dec dil
rdtsc
mov rdx, rbp
mov eax, dword [rsp + 0x22]
mov r9, qword [rsp + 0x11]
jmp 0x2bdbe8
xchg cx, r8w
push si
xchg qword [rsp + 0x12], r8
std
xchg dword [rsp + 0x22], eax
jmp 0x2bdd3c
Function at 0x140072940
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14007294d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14007295d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140072945
lea eax, [rcx + 1]
jmp 0x14007296b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14007297e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140072964
sub eax, 3
jb 0x14007299e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400729ed
sar eax, 1
movsxd rbp, eax
jb 0x1400729d4
jmp 0x1400729ac
add ebx, ebx
jne 0x1400729aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400729d4
inc ecx
add ebx, ebx
jne 0x1400729ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400729d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400729cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400729bc
add ecx, 2
jmp 0x1400729d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140072902
jmp 0x14007294d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x27800
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140072a39
cmp rsi, rcx
jae 0x140072a41
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140072a20
cmp al, 0x8f
ja 0x140072a20
cmp byte [rsi - 2], 0xf
je 0x140072a26
sub al, 0xe8
cmp al, 1
ja 0x140072a0a
cmp rsi, rcx
jae 0x140072a41
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140072a10
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140072a41
lodsb al, byte [rsi]
jmp 0x140072a20
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x6f000]
mov eax, dword [rdi]
or eax, eax
je 0x140072aaa
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x9a9ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140072a4e
jns 0x140072a83
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140072a8d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140072aa4
mov qword [rbx], rax
add rbx, 8
jmp 0x140072a6e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140072ae4
cmp al, 0xef
ja 0x140072ad6
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140072ab6
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140072ac5
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140072b38
sub rsp, 0xffffffffffffff80
jmp 0x1400163c0
Function at 0x140016235
Capabilities:
Write file on windows

Disassembly:
jmp 0x140039c80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140063115]
call fcn.1400173e2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140039cd7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140039de3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140039d7c
cmp qword [rbp + 0x28], 0
jle 0x140039d7c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x140039d1c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.1400172a2
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140039dd2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140039dd2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140016b63
Capabilities:
Terminate process

Disassembly:
jmp 0x140040250
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140016d07
Capabilities:
Get geographical location

Disassembly:
jmp 0x14003a500
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14003a53d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1400173c4
add rsp, 0x58
ret

Function at 0x140016dcf
Capabilities:
Parse pe header

Disassembly:
jmp 0x140040d80
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140040da0
xor al, al
jmp 0x140040e21
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140040db3
xor al, al
jmp 0x140040e21
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140040ddd
xor al, al
jmp 0x140040e21
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140040df1
xor al, al
jmp 0x140040e21
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140040e03
xor al, al
jmp 0x140040e21
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140040e1f
xor al, al
jmp 0x140040e21
mov al, 1
add rsp, 0x38
ret
Function at 0x140017036
Capabilities:
Get disk information

Disassembly:
jmp 0x140035ab0
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x3e0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x90
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x408]
mov dword [rbp + 0x374], 0
lea rcx, [0x14006312b]
call fcn.1400173e2
mov edx, 0x20
mov rcx, qword [rbp + 0x3e0]
call fcn.1400161f9
mov rcx, qword [rbp + 0x3e0]
call fcn.1400167df
mov qword [rbp + 0x3a8], rax
mov eax, dword [rbp + 0x374]
or eax, 1
mov dword [rbp + 0x374], eax
mov qword [rbp + 0x228], 0x104
mov rcx, qword [rbp + 0x228]
call fcn.1400168d4
mov qword [rbp + 0x248], rax
cmp qword [rbp + 0x248], 0
je 0x140035b70
mov rdi, qword [rbp + 0x248]
xor eax, eax
mov rcx, qword [rbp + 0x228]
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x248]
mov qword [rbp + 0x3a8], rax
jmp 0x140035b7b
mov qword [rbp + 0x3a8], 0
mov rax, qword [rbp + 0x3a8]
mov qword [rbp + 0x48], rax
mov rdx, qword [rbp + 0x48]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x140035cbd
mov dword [rbp + 0x64], 0
jmp 0x140035baf
mov eax, dword [rbp + 0x64]
add eax, 4
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0x64
jge 0x140035cbd
movsxd rax, dword [rbp + 0x64]
mov rcx, qword [rbp + 0x48]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x140035cb8
lea rcx, [rbp + 0x2a4]
call fcn.1400164e7
mov qword [rbp + 0x3a8], rax
movsxd rax, dword [rbp + 0x64]
mov rcx, qword [rbp + 0x48]
movzx eax, byte [rcx + rax]
mov byte [rbp + 0x394], al
mov eax, dword [rbp + 0x64]
inc eax
cdqe
mov rcx, qword [rbp + 0x48]
movzx eax, byte [rcx + rax]
mov byte [rbp + 0x395], al
mov eax, dword [rbp + 0x64]
add eax, 2
cdqe
mov rcx, qword [rbp + 0x48]
movzx eax, byte [rcx + rax]
mov byte [rbp + 0x396], al
lea rax, [rbp + 0x397]
mov r8, rax
lea rdx, [rbp + 0x394]
lea rcx, [rbp + 0x2c8]
call fcn.1400167da
lea rcx, [rbp + 0x2f8]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x350]
lea rcx, [rbp + 0x2f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rbp + 0x3a8]
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x268]
call fcn.140016abe
mov qword [rbp + 0x3b0], rax
mov rax, qword [rbp + 0x3b0]
mov qword [rbp + 0x3b8], rax
mov rdx, qword [rbp + 0x3b8]
mov rcx, qword [rbp + 0x3e0]
call fcn.1400166fe
nop
lea rcx, [rbp + 0x268]
call fcn.1400163f2
jmp 0x140035ba6
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x328], rax
mov rcx, qword [rbp + 0x328]
call fcn.1400169a1
cmp qword [rbp + 0x328], 0
jne 0x140035ceb
mov qword [rbp + 0x3a8], 0
jmp 0x140035cfe
mov qword [rbp + 0x48], 0x8123
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x3a8], rax
mov rax, qword [rbp + 0x3e0]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14004bf10]
call fcn.140017077
mov rax, rdi
lea rsp, [rbp + 0x3c0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017397
Capabilities:
Write file on windows

Disassembly:
jmp 0x14002d270
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140058040]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x140063115]
call fcn.1400173e2
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x14002d2d6
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14002d2dd
mov al, 1
jmp 0x14002d44d
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.1400165c3
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.1400165c3
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.140016f9b
movzx eax, al
test eax, eax
je 0x14002d340
xor al, al
jmp 0x14002d44d
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x14002d3b3
cmp dword [rbp + 0x160], 1
je 0x14002d3be
cmp dword [rbp + 0x160], 3
je 0x14002d43c
jmp 0x14002d44b
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14002d40e
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14002d40e
xor al, al
jmp 0x14002d44d
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14002d429
mov dword [rbp + 0x154], 1
jmp 0x14002d433
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14002d44d
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14002d44d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14004ba60]
call fcn.140017077
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.1400169ba
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180002700
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800027a7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800027a7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0xa99e1dad
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800027a2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002780
cmp r8d, 0x364ed9ff
je 0x1800027ac
test r9d, r9d
jne 0x180002760
mov rax, qword [rax]
jmp 0x180002730
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r10
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.180011000
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002875
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002875
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0xa68f0e6a
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x180002870
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x180002850
cmp edx, 0x7608afde
je 0x18000287a
test r9d, r9d
jne 0x180002830
mov rcx, qword [rcx]
jmp 0x180002800
mov ecx, dword [r11 + 0x24]
mov r8, rsi
add rcx, r10
mov rdx, rbp
movzx r9d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800028c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002967
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002967
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x83add3d7
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002962
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002940
cmp r8d, 0x2116893b
je 0x18000296c
test r9d, r9d
jne 0x180002920
mov rax, qword [rax]
jmp 0x1800028f0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret