joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d445c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d44da
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d44d1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d44d1
mov rax, qword [rbp - 8]
jmp 0x2fc4d44ef
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d44a4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400037e0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x140009008]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
xor r12d, r12d
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
movups xmmword [rbp - 0x21], xmm0
movups xmm0, xmmword [0x140006570]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [0x140006580]
movups xmmword [rbp - 1], xmm1
mov rax, rdx
sub rax, rcx
mov ecx, r12d
add dword [rbp - 0x21], eax
mov edx, r12d
nop dword [rax]
nop word [rax + rax]
add ecx, dword [rbp + rdx*4 - 0x21]
mov dword [rbp + rdx*4 - 0x21], ecx
cmp ecx, 0x10000
jb 0x140003892
shr ecx, 0x10
mov word [rbp + rdx*4 - 0x1f], r12w
inc rdx
cmp rdx, 4
jb 0x140003870
mov rsi, qword [rbp - 0x31]
cmp r14, rbx
je 0x1400038d8
nop dword [rax + rax]
movzx eax, byte [r14]
mov byte [rbp - 0x49], al
cmp rsi, qword [rbp - 0x29]
je 0x1400038bc
mov byte [rsi], al
mov rsi, qword [rbp - 0x31]
inc rsi
mov qword [rbp - 0x31], rsi
jmp 0x1400038d0
lea r8, [rbp - 0x49]
mov rdx, rsi
lea rcx, [rbp - 0x39]
call fcn.140003f40
mov rsi, qword [rbp - 0x31]
inc r14
cmp r14, rbx
jne 0x1400038a0
mov r14, r12
mov rax, rsi
mov rbx, qword [rbp - 0x39]
sub rax, rbx
cmp rax, 0x40
jb 0x140003918
nop dword [rax + rax]
lea rdx, [rbx + r14]
lea rcx, [rbp - 0x11]
call fcn.140003a40
add r14, 0x40
mov rsi, qword [rbp - 0x31]
mov rcx, rsi
mov rbx, qword [rbp - 0x39]
sub rcx, rbx
lea rax, [r14 + 0x40]
cmp rax, rcx
jbe 0x1400038f0
lea rdx, [rbx + r14]
cmp rbx, rdx
je 0x140003937
sub rsi, rdx
mov r8, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rsi + rbx]
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x39]
call fcn.140001280
lea r9, [rbp - 0x11]
mov rax, r12
cmp rdi, r15
je 0x14000396b
mov ecx, 3
sub cl, al
shl cl, 3
mov r8d, dword [r9]
shr r8d, cl
mov byte [rdi], r8b
inc rdi
inc rax
cmp rax, 4
jb 0x140003947
add r9, 4
lea rax, [rbp + 0xf]
cmp r9, rax
jne 0x140003944
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1400039b5
mov rdx, qword [rbp - 0x29]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400039b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004300
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400042e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400041f0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, str.SeSecurityPrivilege
call fcn.140004140
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, str.SeDebugPrivilege
call fcn.140004140
lea rcx, [rsp + 0x20]
call fcn.140001410
cmp qword [rax + 0x18], 0x10
jb 0x140004232
mov rax, qword [rax]
mov rdx, rax
lea rcx, [0x1400066e4]
call fcn.1400040e0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140004281
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000427c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000427c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004300
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
add rsp, 0x48
ret

Function at 0x140004c74
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004cbe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004cbe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004cbe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004cbe
cmp dword [rcx + 0x84], 0xe
jbe 0x140004cbe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004cc0
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4d3790
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d4870
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d4192
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f6108]
test eax, eax
je 0x2fc4d422a
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f6110]
mov qword [rbp - 8], rax
jmp 0x2fc4d420e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d4202
cmp qword [rbp - 0x10], 0
je 0x2fc4d4202
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d41c8
lea rax, [0x2fc4f60e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d422b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d4330
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4358
mov eax, 0
jmp 0x2fc4d43a6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4381
mov eax, 0
jmp 0x2fc4d43a6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d43a1
mov eax, 0
jmp 0x2fc4d43a6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d43ac
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d442a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4421
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4421
mov rax, qword [rbp - 8]
jmp 0x2fc4d443f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d43f4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1405b5a34
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, 0x5a4d
xor edi, edi
mov rbx, r8
mov rsi, rcx
cmp word [rdx], ax
je 0x1405b5a75
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov rdx, qword [r8 + 0x18]
cmp rdx, 0x10
jb 0x1405b5b27
mov rcx, qword [r8]
jmp 0x1405b5afe
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1405b5a8d
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
jmp 0x1405b5a5f
movzx r11d, word [rcx + 0x14]
movzx ebp, word [rcx + 6]
add r11, rcx
movzx ecx, di
cmp di, bp
jae 0x1405b5aea
mov r14d, 1
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
jb 0x1405b5ab4
mov rdx, qword [rbx]
movzx eax, cx
lea r10, [rax + rax*4]
lea rax, [r11 + 0x18]
lea rax, [rax + r10*8]
sub rdx, rax
movzx r8d, byte [rax]
movzx r9d, byte [rax + rdx]
sub r8d, r9d
jne 0x1405b5adc
add rax, r14
test r9d, r9d
jne 0x1405b5ac6
test r8d, r8d
je 0x1405b5b4c
add cx, r14w
cmp cx, bp
jb 0x1405b5aa7
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1405b5b27
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1405b5b22
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1405b5b5f
mov rcx, r8
call fcn.140668354
mov rbp, qword [rsp + 0x58]
mov rax, rsi
mov byte [rbx], dil
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov eax, dword [r11 + r10*8 + 0x20]
mov qword [rsi], rax
mov eax, dword [r11 + r10*8 + 0x24]
mov qword [rsi + 8], rax
jmp 0x1405b5af1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1405ba3cc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1405ba3fc
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1405ba474
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1405ba413
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1405ba415
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1405ba46e
test ecx, ecx
jle 0x1405ba44e
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1405ba46e
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1405ba46e
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1405ba490
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1405ba4b0
xor eax, eax
jmp 0x1405ba599
cmp qword [rcx + 0x68], 0
je 0x1405ba4c2
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1405ba599
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1405ba4d9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1405ba4db
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1405ba50d
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1405ba593
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1405ba544
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1405ba56e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x1405ba593
cmp rdi, rbx
ja 0x1405ba54b
test rdi, rdi
je 0x1405ba593
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1405ba974
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1406df080]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1405ba9ad
xor eax, eax
jmp 0x1405baacd
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1405ba9e7
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x1405ba9e7
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x1405baacd
cmp qword [rbx + 0x80], 0
je 0x1405baacb
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1405baa22
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1405baa43
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x1405baac8
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1405baa91
sub eax, 1
je 0x1405baa91
cmp eax, 2
jne 0x1405baacb
movsx ecx, byte [rbp - 0x30]
jmp 0x1405baa2f
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1405baabc
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x1405baacb
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140668060
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1405bb1e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1406df080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1405bb24f
cmp byte [rcx + 0x71], 0
je 0x1405bb24f
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x1405bb2a4
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1405bb269
sub eax, 1
je 0x1405bb26d
cmp eax, 2
jne 0x1405bb2a4
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140668060
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1405bb29b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1405bb2a4
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1405bb251
xor al, al
jmp 0x1405bb251
Function at 0x1405bd660
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1406df080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x30], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1405bd757
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1405bd757
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
xor r8d, r8d
mov qword [rbp - 0x18], r8
mov edi, dword [rax + rdx + 0xb0]
add rdi, rdx
mov rdx, qword [rbp - 0x20]
mov eax, dword [rdi]
test eax, eax
je 0x1405bd72e
add rax, rsi
mov qword [rbp - 0x48], rax
lea rax, [rdi + 8]
mov qword [rbp - 0x40], rax
mov eax, dword [rdi + 4]
sub rax, 8
shr rax, 1
mov dword [rbp - 0x38], eax
cmp rdx, r8
je 0x1405bd711
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rbp - 0x38]
movsd qword [rdx + 0x10], xmm1
mov rdx, qword [rbp - 0x20]
add rdx, 0x18
mov qword [rbp - 0x20], rdx
jmp 0x1405bd722
lea r8, [rbp - 0x48]
lea rcx, [rbp - 0x28]
call fcn.1405be02c
mov rdx, qword [rbp - 0x20]
mov eax, dword [rdi + 4]
add rdi, rax
mov r8, qword [rbp - 0x18]
jmp 0x1405bd6cb
and qword [rbp - 0x18], 0
and qword [rbp - 0x20], 0
mov rcx, qword [rbp - 0x28]
and qword [rbp - 0x28], 0
mov qword [rbx], rcx
mov qword [rbx + 8], rdx
mov qword [rbx + 0x10], r8
lea rcx, [rbp - 0x28]
call fcn.1405b9f10
jmp 0x1405bd765
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140668060
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x1405bfc9c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x1405bfcf6
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rdi, [0x140682490]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x1405bfce0
cmp rdx, 2
jb 0x1405bfce0
cmp byte [r10], r11b
jne 0x1405bfce0
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x1405bfcbe
jmp 0x1405bfd37
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x1405bfd37
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rdi, [0x140682490]
cmp dl, r11b
jne 0x1405bfd1b
cmp byte [r10], r11b
jne 0x1405bfd1b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x1405bfd09
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x1405bfe6c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x1405bfe8c
and qword [r8], 0
lea rdx, [0x1406cd968]
call fcn.1405bfd48
mov rbx, rax
test rax, rax
je 0x1405bff7d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1405bff74
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1405bff74
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1405bff74
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1405bff74
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x1405bff74
mov rax, qword [0x1406e0940]
test rax, rax
je 0x1405bff11
inc dword [rax + 0x3b0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1405bff74
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1405bff61
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1406e0940]
test rax, rax
je 0x1405bff56
dec dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1405bff7d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1405bff6f
mov qword [rsi], rbp
mov rax, rdi
jmp 0x1405bff7f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1405c1d3c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
movsxd rdx, dword [rcx + 0x108]
mov r9d, 4
mov rax, qword [rcx + 0x110]
mov r8d, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x38]
not r8d
movzx eax, byte [rdx]
inc rdx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x140682490]
xor r8d, dword [rax + rcx*4]
sub r9, 1
jne 0x1405c1d65
not r8d
mov ecx, r8d
call fcn.1405c1e9c
mov eax, r8d
add rsp, 0x28
ret

Function at 0x1405cbd14
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1406df080]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x1406e0940]
mov r10d, 4
mov dword [rsp + 0x20], ecx
mov r9, qword [rax + 0x1b90]
movsxd rcx, dword [r9 + 0x108]
mov rax, qword [r9 + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x20]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x140682490]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x1405cbd5a
not r8d
lea rdx, [rsp + 0x20]
lea rcx, [r9 + 0x108]
mov dword [rsp + 0x20], r8d
call fcn.1405d9ea8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140668060
add rsp, 0x38
ret