joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e150
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, rcx
mov rbx, rdx
mov rbp, r8
cmp qword [rcx + 0x50], rdx
jbe 0x14002e178
mov rax, qword [r8 + 0x20]
mov r8, qword [rax + rdx*8]
test r8, r8
jne 0x14002e1f0
mov r13, qword [r12 + 0x40]
lea rdi, [rbx + 4]
lea rcx, [r13 + rdi]
call sym.strlen
movzx r9d, word [r13 + rbx + 2]
mov rcx, qword [rbp]
lea rdx, str._thb_xvmStaticName___hu___hu_
movzx r8d, byte [r13 + rbx + 1]
mov rsi, rax
call sym.fprintf
add rdi, qword [r12 + 0x40]
mov rcx, qword [rbp]
movzx r8d, si
mov rdx, rdi
movzx esi, si
call sym.hb_compGenCString
mov r9, qword [rbp]
mov r8d, 4
mov edx, 1
lea rcx, str.____n
call sym.fwrite
lea rax, [rsi + 5]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, qword [rbp]
lea rdx, str.lab_05I64u:___n
call sym.fprintf
jmp 0x14002e178

Function at 0x14002e210
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x40]
mov r9, qword [r8]
movzx ebx, byte [rax + rdx + 1]
mov rdi, rcx
mov rsi, rdx
mov rbp, r8
sub ebx, 1
cmp qword [rcx + 0x50], rdx
jbe 0x14002e243
mov rax, qword [r8 + 0x20]
mov r8, qword [rax + rdx*8]
test r8, r8
jne 0x14002e295
mov r8d, 0x18
mov edx, 1
lea rcx, str._thb_xvmPushStringConst_
call sym.fwrite
mov rax, qword [rdi + 0x40]
mov rcx, qword [rbp]
movzx r8d, bx
movzx ebx, bx
lea rdx, [rax + rsi + 2]
call sym.hb_compGenCString
mov rcx, qword [rbp]
mov r8d, ebx
lea rdx, str.___hu____n
add ebx, 3
call sym.fprintf
movsxd rax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, r9
lea rdx, str.lab_05I64u:___n
call sym.fprintf
mov r9, qword [rbp]
jmp 0x14002e243

Function at 0x14002e2b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rbx, rdx
mov rdi, r8
cmp qword [rcx + 0x50], rdx
jbe 0x14002e2d4
mov rax, qword [r8 + 0x20]
mov r8, qword [rax + rdx*8]
test r8, r8
jne 0x14002e340
mov rcx, qword [rbp + 0x40]
add rbx, 1
add rcx, rbx
call sym.strlen
mov r9, qword [rdi]
mov r8d, 0x13
mov edx, 1
lea rcx, str._thb_xvmModuleName_
mov rsi, rax
call sym.fwrite
mov rdx, qword [rbp + 0x40]
mov rcx, qword [rdi]
movzx r8d, si
movzx esi, si
add rdx, rbx
call sym.hb_compGenCString
mov r9, qword [rdi]
mov r8d, 4
mov edx, 1
lea rcx, str.____n
call sym.fwrite
lea rax, [rsi + 2]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, qword [rdi]
lea rdx, str.lab_05I64u:___n
call sym.fprintf
jmp 0x14002e2d4
Function at 0x14002e360
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, rcx
mov rbp, rdx
mov rdi, r8
cmp qword [rcx + 0x50], rdx
jbe 0x14002e388
mov rax, qword [r8 + 0x20]
mov r8, qword [rax + rdx*8]
test r8, r8
jne 0x14002e3f5
mov r13, qword [r12 + 0x40]
lea rsi, [rbp + 3]
lea rcx, [r13 + rsi]
call sym.strlen
movzx r8d, word [r13 + rbp + 1]
mov rcx, qword [rdi]
lea rdx, str._thb_xvmLocalName___hu_
mov rbx, rax
call sym.fprintf
add rsi, qword [r12 + 0x40]
mov rcx, qword [rdi]
movzx r8d, bx
mov rdx, rsi
movzx ebx, bx
call sym.hb_compGenCString
mov r9, qword [rdi]
mov r8d, 4
mov edx, 1
lea rcx, str.____n
call sym.fwrite
lea rax, [rbx + 4]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, qword [rdi]
lea rdx, str.lab_05I64u:___n
call sym.fprintf
jmp 0x14002e388

Function at 0x14002e410
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [rcx + 0x40]
mov rdi, qword [r8]
movzx ebx, word [rbp + rdx + 1]
sub ebx, 1
mov r12, rcx
mov rsi, rdx
mov r13, r8
movsxd rbx, ebx
cmp qword [rcx + 0x50], rdx
jbe 0x14002e44a
mov rax, qword [r8 + 0x20]
mov r8, qword [rax + rdx*8]
test r8, r8
jne 0x14002e4b1
mov r9, rdi
mov r8d, 0x11
mov edx, 1
lea rcx, str._thb_xvmPushString
call sym.fwrite
mov r9, rdi
mov r8d, 7
mov edx, 1
lea rcx, str.Const_
call sym.fwrite
lea rdx, [rbp + rsi + 3]
mov r8, rbx
mov rcx, rdi
call sym.hb_compGenCString
mov r8, rbx
lea rdx, str.___I64u____n
mov rcx, rdi
call sym.fprintf
lea rax, [rbx + 4]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rdi
lea rdx, str.lab_05I64u:___n
call sym.fprintf
mov rbp, qword [r12 + 0x40]
mov rdi, qword [r13]
jmp 0x14002e44a

Function at 0x14002e4d0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, qword [rcx + 0x40]
mov rsi, qword [r8]
mov rdi, rdx
lea rdx, [rbp + rdx + 1]
mov r12, rcx
mov r13, r8
movzx eax, byte [rdx + 1]
movzx ecx, byte [rdx + 2]
movzx edx, byte [rdx]
shl eax, 8
shl ecx, 0x10
or eax, ecx
or eax, edx
lea ebx, [rax - 1]
cmp qword [r12 + 0x50], rdi
jbe 0x14002e51d
mov rax, qword [r8 + 0x20]
mov r8, qword [rax + rdi*8]
test r8, r8
jne 0x14002e584
mov r9, rsi
mov r8d, 0x11
mov edx, 1
lea rcx, str._thb_xvmPushString
call sym.fwrite
mov r9, rsi
mov r8d, 7
mov edx, 1
lea rcx, str.Const_
call sym.fwrite
lea rdx, [rbp + rdi + 4]
mov r8, rbx
mov rcx, rsi
call sym.hb_compGenCString
mov r8, rbx
lea rdx, str.___I64u____n
mov rcx, rsi
call sym.fprintf
lea rax, [rbx + 5]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
lea rdx, str.lab_05I64u:___n
call sym.fprintf
mov rbp, qword [r12 + 0x40]
mov rsi, qword [r13]
jmp 0x14002e51d
Function at 0x14002e5b0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
xor eax, eax
cmp dword [rcx + 0x1b0], 2
sete al
mov rbx, r8
mov qword [rsp + 0x20], r8
mov r8, qword [rdx + 0x50]
mov rsi, rdx
mov dword [rsp + 0x28], eax
lea rax, sym.hb_p_and_1
mov qword [rsp + 0x2c], 0
mov qword [rsp + 0x34], 0
mov qword [rsp + 0x48], rax
test r8, r8
jne 0x14002e6b1
mov qword [rsp + 0x40], 0
lea rdi, [rsp + 0x20]
mov edx, 1
mov r9, rbx
mov r8d, 2
lea rcx, [0x1400b1563]
call sym.fwrite
mov edx, dword [rsp + 0x30]
test edx, edx
jne 0x14002e710
mov r9, rbx
mov r8d, 8
mov edx, 1
lea rcx, str.___do__n
call sym.fwrite
mov r8, rdi
lea rdx, sym.hb_p_and_1
mov rcx, rsi
call sym.hb_compPCodeEval
mov r9, rbx
mov r8d, 0x11
mov edx, 1
lea rcx, str.____while__0____n
call sym.fwrite
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x14002e6f0
lea rcx, [0x1400b15ab]
mov r9, rbx
mov r8d, 2
mov edx, 1
call sym.fwrite
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002e6a9
call sym.hb_xfree
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
lea rdi, [r8*8]
mov rcx, rdi
call sym.hb_xgrab
mov r8, rdi
xor edx, edx
lea rdi, [rsp + 0x20]
mov rcx, rax
call sym.memset
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x40], rax
call sym.hb_compGenLabelTable
jmp 0x14002e60b
mov r9, rbx
mov r8d, 0x15
mov edx, 1
lea rcx, str.___hb_xvmExitProc____n
call sym.fwrite
jmp 0x14002e67f
mov r9, rbx
mov r8d, 0x13
mov edx, 1
lea rcx, str.___HB_BOOL_fValue__n
call sym.fwrite
jmp 0x14002e631

Function at 0x14002e900
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2b8
cmp qword [rdx + 0x10], 0
mov rbx, rcx
je 0x14002e9e0
lea rsi, [rsp + 0x40]
mov rcx, rsi
call sym.hb_fsFNameMerge
lea rdx, [0x1400b1b85]
mov rcx, rsi
call sym.hb_fopen
mov rdi, rax
test rax, rax
je 0x14002ea40
mov edx, dword [rbx + 0x1c4]
lea rbp, [rsp + 0x150]
test edx, edx
je 0x14002ea10
lea r8, [rsp + 0x38]
mov rdx, rbp
mov rcx, rbx
call sym.hb_compGenBufPortObj
mov rdx, qword [rsp + 0x38]
mov r9, rdi
mov rcx, qword [rsp + 0x150]
mov r8d, 1
call sym.fwrite
cmp rax, 1
jne 0x14002e9b3
mov rcx, qword [rsp + 0x150]
call sym.hb_xfree
mov rcx, rdi
call sym.fclose
mov eax, dword [rbx + 0x1c4]
test eax, eax
je 0x14002e9f0
add rsp, 0x2b8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsp + 0x20], rsi
mov rdx, qword [str._B_v_]
mov r9d, 0x45
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov r8d, 0x45
call sym.hb_compGenError
jmp 0x14002e988
lea rax, str..hrb
mov qword [rdx + 0x10], rax
jmp 0x14002e919
lea rdx, str.Done._n
mov rcx, rbx
call sym.hb_compOutStd
nop
add rsp, 0x2b8
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
mov r9, rsi
mov edx, 0x157
lea r8, str.Generating_Harbour_Portable_Object_output_to__s...
call sym.hb_snprintf
mov rdx, rbp
mov rcx, rbx
call sym.hb_compOutStd
jmp 0x14002e957
mov qword [rsp + 0x20], rsi
mov rdx, qword [str._B_v_]
mov r9d, 0x20
mov rcx, rbx
mov qword [rsp + 0x28], 0
mov r8d, 0x45
call sym.hb_compGenError
jmp 0x14002e9a7
Function at 0x14004a420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor ebx, ebx
test rcx, rcx
je 0x14004a453
call sym.hb_fsNameConvU16
xor ebx, ebx
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
test rsi, rsi
je 0x14004a453
mov rcx, rsi
call sym.hb_xfree
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x14004a460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor ebx, ebx
test rcx, rcx
je 0x14004a497
call sym.hb_fsNameConvU16
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004a48a
xor ebx, ebx
test al, 0x50
sete bl
test rsi, rsi
je 0x14004a497
mov rcx, rsi
call sym.hb_xfree
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x14004a4a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor ebx, ebx
test rcx, rcx
je 0x14004a4d8
call sym.hb_fsNameConvU16
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14004a4cb
shr eax, 4
and eax, 1
mov ebx, eax
test rsi, rsi
je 0x14004a4d8
mov rcx, rsi
call sym.hb_xfree
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x14004a510
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor edi, edi
call sym.hb_osStrU16Encode
xor r8d, r8d
xor edx, edx
mov rbp, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rbx, rax
mov rcx, rax
call rbp
mov esi, eax
test eax, eax
je 0x14004a566
mov ecx, eax
add rcx, rcx
call sym.hb_xgrab
mov r8d, esi
mov rcx, rbx
mov r12, rax
mov rdx, rax
call rbp
mov rcx, r12
call sym.hb_osStrU16Decode
mov rcx, r12
mov rdi, rax
call sym.hb_xfree
mov rcx, rbx
call sym.hb_xfree
mov rax, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14004a580
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x2b8
mov rbp, rcx
mov rdi, rdx
mov ebx, r8d
test rdx, rdx
je 0x14004a660
test r8d, r8d
je 0x14004a660
lea rsi, [rsp + 0xa0]
cmp r8d, 0x108
jbe 0x14004a662
movsxd rcx, r8d
add rcx, rcx
call sym.hb_xgrab
mov rcx, rbp
mov rsi, rax
call sym.strlen
cmp rax, 0x3f
jbe 0x14004a674
nop
mov rcx, rbp
xor r13d, r13d
call sym.hb_osStrU16Encode
mov r8d, ebx
mov rdx, rsi
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
mov ebp, eax
lea rax, [rsp + 0x20]
setne r13b
cmp r12, rax
je 0x14004a617
mov rcx, r12
call sym.hb_xfree
test rsi, rsi
je 0x14004a639
test ebp, ebp
jne 0x14004a6a0
lea rax, [rsp + 0xa0]
cmp rsi, rax
je 0x14004a639
mov rcx, rsi
call sym.hb_xfree
test rdi, rdi
setne dl
test ebx, ebx
setne al
test dl, al
je 0x14004a64c
test ebp, ebp
je 0x14004a692
mov eax, r13d
add rsp, 0x2b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor esi, esi
mov rcx, rbp
call sym.strlen
cmp rax, 0x3f
ja 0x14004a5e0
lea rcx, [rsp + 0x20]
mov r8d, ebx
mov rdx, rsi
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
mov ebp, eax
setne r13b
jmp 0x14004a617
mov byte [rdi], 0
jmp 0x14004a64c
movsxd rax, ebx
xor edx, edx
lea r8d, [rbx - 1]
mov rcx, rsi
mov word [rsi + rax*2 - 2], dx
movsxd r8, r8d
mov rdx, rdi
call sym.hb_osStrU16Decode2
lea rax, [rsp + 0xa0]
cmp rsi, rax
jne 0x14004a631
jmp 0x14004a64c

Function at 0x14004a6e0
Capabilities:
Set environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebx, ebx
mov rdi, rdx
test rcx, rcx
je 0x14004a731
call sym.hb_osStrU16Encode
mov rsi, rax
test rdi, rdi
je 0x14004a740
mov rcx, rdi
xor ebx, ebx
call sym.hb_osStrU16Encode
mov rcx, rsi
mov rdi, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne bl
test rdi, rdi
je 0x14004a729
mov rcx, rdi
call sym.hb_xfree
mov rcx, rsi
call sym.hb_xfree
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor edx, edx
mov rcx, rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
setne bl
jmp 0x14004a729
Function at 0x14004fba0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [r8]
mov rbx, r8
mov esi, ecx
lea rcx, [rax + 1]
mov rdi, rdx
call sym.hb_xgrab
mov rbx, qword [rbx]
mov rdx, rdi
mov rcx, rax
mov r8, rbx
call sym.memcpy
mov r9, rax
mov byte [rax + rbx], 0
cmp esi, 1
je 0x14004fbe3
mov rax, r9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test rbx, rbx
je 0x14004fbd8
lea rax, [rbx - 1]
cmp rax, 0xe
jbe 0x14004fd2f
mov rdx, rbx
movdqa xmm1, xmmword [0x1400bbb40]
mov rax, r9
and rdx, 0xfffffffffffffff0
add rdx, r9
nop dword [rax + rax]
movdqu xmm0, xmmword [rax]
add rax, 0x10
pxor xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
cmp rax, rdx
jne 0x14004fc10
mov rax, rbx
and rax, 0xfffffffffffffff0
cmp rbx, rax
je 0x14004fbd8
lea rdx, [rax + 1]
xor byte [r9 + rax], 0xf3
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 2]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 3]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 4]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 5]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 6]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 7]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 8]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 9]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 0xa]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 0xb]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 0xc]
cmp rbx, rdx
jbe 0x14004fbd8
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 0xd]
cmp rbx, rdx
jbe 0x14004fbd8
add rax, 0xe
xor byte [r9 + rdx], 0xf3
cmp rbx, rax
jbe 0x14004fbd8
xor byte [r9 + rax], 0xf3
jmp 0x14004fbd8
xor eax, eax
jmp 0x14004fc31
Function at 0x14004fd40
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [r8]
mov rbx, r8
mov esi, ecx
lea rcx, [rax + 1]
mov rdi, rdx
call sym.hb_xgrab
mov rbx, qword [rbx]
mov rdx, rdi
mov rcx, rax
mov r8, rbx
call sym.memcpy
mov r9, rax
mov byte [rax + rbx], 0
cmp esi, 1
je 0x14004fd83
mov rax, r9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test rbx, rbx
je 0x14004fd78
lea rax, [rbx - 1]
cmp rax, 0xe
jbe 0x14004fecf
mov rdx, rbx
movdqa xmm1, xmmword [0x1400bbb40]
mov rax, r9
and rdx, 0xfffffffffffffff0
add rdx, r9
nop dword [rax + rax]
movdqu xmm0, xmmword [rax]
add rax, 0x10
pxor xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
cmp rax, rdx
jne 0x14004fdb0
mov rax, rbx
and rax, 0xfffffffffffffff0
cmp rbx, rax
je 0x14004fd78
lea rdx, [rax + 1]
xor byte [r9 + rax], 0xf3
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 2]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 3]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 4]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 5]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 6]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 7]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 8]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 9]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 0xa]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 0xb]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 0xc]
cmp rbx, rdx
jbe 0x14004fd78
xor byte [r9 + rdx], 0xf3
lea rdx, [rax + 0xd]
cmp rbx, rdx
jbe 0x14004fd78
add rax, 0xe
xor byte [r9 + rdx], 0xf3
cmp rbx, rax
jbe 0x14004fd78
xor byte [r9 + rax], 0xf3
jmp 0x14004fd78
xor eax, eax
jmp 0x14004fdd1
Function at 0x1400523b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
lea rax, [rbp - 0x28]
mov qword [rbp - 0x58], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
call sym.fwrite
mov rbx, qword [rbp - 0x58]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp - 0x30]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x140052fc6
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1400c71e8]
test eax, eax
je 0x140053054
lea rcx, [0x1400c71c0]
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1400c71f0]
mov qword [rbp - 8], rax
jmp 0x14005303b
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x14005302f
cmp qword [rbp - 0x10], 0
je 0x14005302f
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rdx, qword [rbp - 0x10]
mov rcx, rdx
call rax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140052ff5
lea rcx, [0x1400c71c0]
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140053055
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140053140
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140053168
mov eax, 0
jmp 0x1400531b6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140053191
mov eax, 0
jmp 0x1400531b6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400531b1
mov eax, 0
jmp 0x1400531b6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400531bc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14005323a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140053231
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140053231
mov rax, qword [rbp - 8]
jmp 0x14005324f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140053204
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180004730
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x420
mov rax, qword [0x1800a3248]
xor rax, rsp
mov qword [rsp + 0x410], rax
xor r8d, r8d
lea r11, [rsp + 4]
mov r9d, r8d
mov rbx, rdx
mov rdi, rcx
mov eax, r9d
mov r10d, 8
nop dword [rax]
mov edx, eax
mov ecx, eax
shr edx, 1
mov eax, edx
xor eax, 0xedb88320
and cl, 1
cmove eax, edx
add r10d, 0xffffffff
jne 0x180004770
mov dword [r11], eax
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x180004760
mov dword [rsp], r8d
test rbx, rbx
je 0x1800047dd
nop word [rax + rax]
movzx edx, byte [rdi]
lea rdi, [rdi + 1]
movzx eax, byte [rsp]
mov ecx, r8d
xor rdx, rax
shr ecx, 8
mov r8d, dword [rsp + rdx*4 + 4]
xor r8d, ecx
xor r8d, 0xd202ef8d
mov dword [rsp], r8d
sub rbx, 1
jne 0x1800047b0
mov eax, r8d
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.18006a240
mov rbx, qword [rsp + 0x430]
add rsp, 0x420
pop rdi
ret

Function at 0x180004a40
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x218
mov rax, qword [0x1800a3248]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov dword [rsp + 0x20], 3
lea rdx, [rsp + 0x60]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x180004a83
mov dword [rsp + 0x24], 0
jmp 0x180004a8b
mov dword [rsp + 0x24], 3
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x180004b4b
call fcn.180006090
xor ecx, ecx
call fcn.180004810
mov ecx, 8
call fcn.18006a950
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180004add
mov rax, qword [rsp + 0x220]
mov edx, dword [rax + 4]
mov rcx, qword [rsp + 0x28]
call fcn.180005a40
mov qword [rsp + 0x30], rax
jmp 0x180004ae6
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.180005e20
mov ecx, 0x40
call fcn.18006a950
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180004b2c
mov rax, qword [rsp + 0x220]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x38]
call fcn.180007000
mov qword [rsp + 0x40], rax
jmp 0x180004b35
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [0x1800a7a90], rax
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.18006a240
add rsp, 0x218
ret
Function at 0x180006090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1800a3248]
xor rax, rsp
mov qword [rbp + 0x47], rax
cmp qword [0x1800a7aa8], 0
jne 0x1800061a2
cmp qword [0x1800a7ab0], 0
mov qword [rsp + 0xd0], rbx
jne 0x1800060dd
mov ecx, 1
call fcn.18006a950
mov qword [0x1800a7ab0], rax
xor eax, eax
mov dword [rbp + 7], 0x6e72656b
lea rcx, [rbp + 7]
mov qword [rbp + 0x13], rax
mov qword [rbp + 0x1b], rax
mov qword [rbp + 0x23], rax
mov qword [rbp + 0x2b], rax
mov qword [rbp + 0x33], rax
mov qword [rbp + 0x3b], rax
mov dword [rbp + 0x43], eax
mov qword [rbp - 0x2b], rax
mov qword [rbp - 0x23], rax
mov qword [rbp - 0x1b], rax
mov qword [rbp - 0x13], rax
mov qword [rbp - 0xb], rax
mov qword [rbp - 3], rax
mov word [rbp + 5], ax
mov dword [rbp + 0xb], 0x32336c65
mov dword [rbp + 0xf], 0x6c6c642e
mov dword [rbp - 0x39], 0x54746547
mov dword [rbp - 0x35], 0x436b6369
mov dword [rbp - 0x31], 0x746e756f
mov word [rbp - 0x2d], 0x3436
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, 0x38
mov qword [0x1800a7aa0], rax
call fcn.18006a950
mov rbx, rax
mov qword [rbp - 0x49], rax
lea rcx, [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
rdtsc
shl rdx, 0x20
or rax, rdx
mov dword [rbx + 0xc], 4
mov qword [rbx + 4], rax
mov qword [0x1800a7aa8], rbx
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18006a240
add rsp, 0xc0
pop rbp
ret

Function at 0x1800065f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x180006608
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbx + 0x20]
mov byte [rbx + 8], 1
mov qword [rsp + 0x28], rax
lea r8, [0x1800066b0]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
add rsp, 0x30
pop rbx
ret