joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003000
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140002fc2
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140003bb0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140003bd3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140003bd3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140003bd4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140003c0e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140003c05
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140003c10
inc r8d
add rax, 0x28
jmp 0x140003bec
xor eax, eax
ret

Function at 0x140003c81
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1405784f0]
mov r8, rcx
mov rcx, r9
call fcn.140003bb0
test eax, eax
je 0x140003cad
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140003bd4
xor eax, eax
add rsp, 0x28
ret
Function at 0x14059b600
Capabilities:
Encode data using xor

Disassembly:
pop rbx
movabs byte [0x5d0e80018bf66e8], al
adc al, 0
mov qword [rsp], 0xffffffffa3c582df
call fcn.14072c945
pushfq
add qword [rsp + 8], 0xffffffffbf8d15f1
call fcn.1405812e0
jo 0x14059b5f9
in al, 1
jle 0x14058c655
int3
call fcn.14059ae76
mov dh, 0xcc
mov r15d, 0xfccf2a43
add byte [rax + rcx + 0x3c], dl
adc r11b, byte [rbx + 0x2f]
xor edi, dword [rdi]
pop rdi
movabs eax, dword [0x576ba23cac084428]
jnp 0x14059b63b
xadd dword [rax - 0x3c], ebp
or byte [rcx - 0x15142d3c], ah
adc ecx, edi
xor al, 0xa0
xchg ecx, eax
jrcxz 0x14059b620
ret
out 0xb4, al
invalid
Function at 0x1408ab4cb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xb314aa1e
mov edx, 4
movzx ecx, al
sar ecx, 0x3d
lea ecx, [rcx + rbx - 4]
mov eax, 0xb1b47da9
sal ax, 0xe7
shl ecx, 3
call fcn.1408b5317
push 0xffffffffa7029903
cmp ebx, 3
lea rsp, [rsp + 8]
jne 0x1408bc704
mov r8d, 0xb68847ae
mov r8, rax
push 0xfacb195
jmp 0x1408890bf
add r11, 8
call fcn.1408b94c3
adc r10, 2
jmp 0x14087f6aa
xor cx, bp
inc ax
dec cx
add ax, 0x8c14
xor cx, 0xb08c
or eax, 0x8b6492a
neg cx
bswap rax
call fcn.1408a17a1
lea rsp, [rsp + 8]
jmp 0x1408b8cdc
call fcn.1408b8cd3
mov r10d, 0x97127821
movsx ebp, r10w
shr ebp, 0xbd
xor rbp, qword [r11 + rbp*2]
add r10d, 0x4023308c
adc r10d, r10d
mov r10, qword [r11 + 8]
jno 0x14087b94c
cmp ebx, 4
jbe 0x14087b30d
jmp 0x14087b2f9
neg al
mov qword [rsp + rbx + 0x3bc6a0ca], 0xffffffff9803c4b8
shl rdx, 0xe9
rol byte [rsp + rbp*2 - 0x28662270], 0x65
xor al, 8
push rbx
dec dword [rsp + rbp - 0x14331137]
shr word [rsp + rbp - 0x1433112c], 0x28
rol al, 1
add al, 0x31
xor dil, al
add edx, dword [rsp + rbx + 0x3bc6a0cb]
mov qword [rsp + rbx + 0x3bc6a0d2], rsi
add bl, byte [rsp + rbx + 0x3bc6a0cb]
xchg ebp, edx
mov qword [rsp + rbx*2 + 0x778d40d6], r10
push rdx
mov qword [rsp + rbx + 0x3bc6a06b], rdi
mov rbp, r8
jns 0x1408ab4e8
mov ebx, eax
sar dx, 6
jnp 0x14087d43d
seta dl
mov edx, ebx
xor ecx, ecx
jmp 0x14089fac3
cmp ebx, 4
push 0x4a31dc0b
not byte [rsp + 4]
lea rsp, [rsp + 8]
jne 0x14089a604
mov r9d, 0xcf273ba1
mov r9, rax
push 0xffffffffd8a5ba12
lea rsp, [rsp + 8]
jmp 0x1408b8cdc
Function at 0x180005600
Capabilities:
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x180063080]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
mov qword [rbp - 9], rbx
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREGuidGuid13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1800057a0
lea rdx, [0x180065a10]
lea rcx, [rbp - 0x49]
call fcn.180007410
mov rdx, rax
lea rcx, [rbp + 0x27]
call fcn.1800011b0
nop
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rcx, qword [rbp + 0x27]
mov eax, dword [rbp + 0x37]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rbx + 1]
xor r8d, r8d
lea rdx, str.guid
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, [0x180065a30]
lea rcx, [rbp - 0x29]
call fcn.180007410
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.1800011b0
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rcx, qword [rbp - 1]
mov eax, dword [rbp + 0xf]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rbx + 1]
xor r8d, r8d
lea rdx, str.user_id
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x180005754
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000574f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057c3
call fcn.1800205d4
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], 7
mov word [rbp - 1], bx
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x1800057a0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000579b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800057bd
call fcn.1800205d4
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800205b0
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret
call fcn.18002c92c
nop
call fcn.18002c92c
nop
int3
Function at 0x18000b240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, qword [rsp + 0x70]
mov rsi, rcx
mov ecx, dword [rcx + 0x38]
mov r14, r9
movsxd rdi, r8d
mov rbx, rdx
lea r15d, [rcx + rdi]
mov dword [rbp], r15d
cmp r15d, 0x10
ja 0x18000b298
mov eax, ecx
mov r8, rdi
lea rcx, [rsi + 0x28]
add rcx, rax
call fcn.180022420
add dword [rsi + 0x38], edi
mov dword [rbp], 0
jmp 0x18000b3b0
cmp r14, rbx
jne 0x18000b2a7
mov eax, 0x1001
jmp 0x18000b3b2
mov eax, 0x10
sub eax, ecx
mov edi, eax
movsxd r8, eax
mov rax, rcx
lea rcx, [rsi + 0x28]
add rcx, rax
call fcn.180022420
lea rdx, [rsi + 0x18]
add rbx, rdi
lea rcx, [rsi + 0x3c]
lea edi, [r15 - 0x10]
call fcn.1800091c0
mov eax, dword [rsi + 0x18]
lea rcx, [rsi + 0x28]
xor eax, dword [rcx]
mov dword [r14], eax
mov eax, dword [rsi + 0x2c]
xor eax, dword [rsi + 0x1c]
mov dword [r14 + 4], eax
mov eax, dword [rsi + 0x30]
xor eax, dword [rsi + 0x20]
mov dword [r14 + 8], eax
mov eax, dword [rsi + 0x34]
xor eax, dword [rsi + 0x24]
mov dword [r14 + 0xc], eax
add r14, 0x10
mov eax, dword [rcx]
mov dword [rsi + 0x18], eax
mov eax, dword [rsi + 0x2c]
mov dword [rsi + 0x1c], eax
mov eax, dword [rsi + 0x30]
mov dword [rsi + 0x20], eax
mov eax, dword [rsi + 0x34]
mov dword [rsi + 0x24], eax
cmp edi, 0x10
jbe 0x18000b395
mov qword [rsp + 0x50], r12
lea r12d, [rdi - 0x11]
shr r12d, 4
inc r12d
lea rdx, [rsi + 0x18]
lea rcx, [rsi + 0x3c]
call fcn.1800091c0
mov eax, dword [rsi + 0x18]
lea r14, [r14 + 0x10]
xor eax, dword [rbx]
add edi, 0xfffffff0
mov dword [r14 - 0x10], eax
mov eax, dword [rbx + 4]
xor eax, dword [rsi + 0x1c]
mov dword [r14 - 0xc], eax
mov eax, dword [rsi + 0x20]
xor eax, dword [rbx + 8]
mov dword [r14 - 8], eax
mov eax, dword [rsi + 0x24]
xor eax, dword [rbx + 0xc]
mov dword [r14 - 4], eax
mov eax, dword [rbx]
mov dword [rsi + 0x18], eax
mov eax, dword [rbx + 4]
mov dword [rsi + 0x1c], eax
mov eax, dword [rbx + 8]
mov dword [rsi + 0x20], eax
mov eax, dword [rbx + 0xc]
add rbx, 0x10
mov dword [rsi + 0x24], eax
sub r12, 1
jne 0x18000b330
mov r12, qword [rsp + 0x50]
lea rcx, [rsi + 0x28]
movsxd r8, edi
mov rdx, rbx
call fcn.180022420
mov eax, dword [rsi + 0x38]
and eax, 0xf0000000
add eax, edi
sub dword [rbp], edi
mov dword [rsi + 0x38], eax
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x18000b8c0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x180063080]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
mov rdi, qword [rdx + 0x10]
mov r15, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x18000b911
mov r15, qword [rdx]
xor r13d, r13d
test r15, r15
je 0x18000ba86
test rdi, rdi
je 0x18000ba86
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdi
shr rdx, 1
shl edx, 2
add edx, 5
mov ecx, edx
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.18002d758
mov rsi, rax
mov r10d, r13d
mov eax, 1
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp rax, rdi
jae 0x18000b96c
movzx ecx, byte [rax + r15]
jmp 0x18000b96e
xor cl, cl
lea rbp, [rax + 1]
cmp rbp, rdi
jae 0x18000b97f
movzx r11d, byte [r15 + rax + 1]
jmp 0x18000b982
xor r11b, r11b
movzx r9d, byte [r15 + rax - 1]
movzx r8d, cl
mov edx, r8d
and edx, 0xf
movzx ecx, r11b
shr ecx, 6
lea edx, [rcx + rdx*4]
mov ecx, r9d
shr rcx, 2
movzx ecx, byte [rcx + r12]
mov byte [r10 + rsi], cl
and r9d, 3
shl r9d, 4
shr r8d, 4
add r9d, r8d
movzx ecx, byte [r9 + r12]
mov byte [r10 + rsi + 1], cl
cmp rax, rdi
jae 0x18000b9d1
movzx edx, byte [rdx + r12]
jmp 0x18000b9d3
mov dl, 0x3d
mov byte [r10 + rsi + 2], dl
cmp rbp, rdi
jae 0x18000b9eb
movzx ecx, r11b
and ecx, 0x3f
movzx edx, byte [rcx + r12]
jmp 0x18000b9ed
mov dl, 0x3d
mov byte [r10 + rsi + 3], dl
add r10, 4
add rax, 3
lea rcx, [rax - 1]
cmp rcx, rdi
jb 0x18000b960
mov byte [r10 + rsi], r13b
test rsi, rsi
je 0x18000ba86
movdqa xmm0, xmmword [0x18005abe0]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], r13b
mov r8, r10
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.180007760
mov rcx, rsi
call fcn.1800251c4
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [r14 + 0x10], xmm1
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18000bade
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18000bad9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000bb1b
jmp 0x18000bad6
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 0xf
mov byte [r14], r13b
xor r8d, r8d
lea rdx, [0x1800594c8]
mov rcx, r14
call fcn.180007760
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18000bade
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18000bad9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000bb15
mov rcx, r8
call fcn.1800205d4
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 0xf
mov rax, r14
mov byte [rbx], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800205b0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18002c92c
int3
call fcn.18002c92c
int3
Function at 0x180015970
Capabilities:
Get file version info

Disassembly:
push rbx
push rdi
mov eax, 0x4308
call fcn.180021490
sub rsp, rax
mov rax, qword [0x180063080]
xor rax, rsp
mov qword [rsp + 0x42e0], rax
mov qword [rsp + 0x40], rdx
mov rbx, rdx
cmp qword [rcx + 0x70], 0
mov rdi, rcx
jne 0x180015b0d
xor edx, edx
lea rcx, [rsp + 0x2e0]
mov r8d, 0x4000
call fcn.180022880
xor eax, eax
lea rcx, [rsp + 0xd0]
xor edx, edx
mov qword [rsp + 0x30], rax
mov r8d, 0x208
mov qword [rsp + 0x38], rax
call fcn.180022880
mov r8d, 0x104
lea rdx, [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0xd0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
test eax, eax
jne 0x180015a14
lea rdx, [rdi + 0x60]
jmp 0x180015b14
mov qword [rsp + 0x4330], rbp
lea r9, [rsp + 0x2e0]
mov qword [rsp + 0x4300], rsi
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x42f8], r14
mov r8d, eax
xor edx, edx
mov qword [rsp + 0x42f0], r15
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x180015a95
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x40]
lea rdx, [0x18005a84c]
lea rcx, [rsp + 0x2e0]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x180015a95
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + 8]
mov esi, eax
movzx r14d, ax
mov eax, dword [rcx + 0xc]
mov ebp, eax
shr esi, 0x10
shr ebp, 0x10
movzx r15d, ax
jmp 0x180015aa7
mov r15d, dword [rsp + 0x3c]
mov ebp, dword [rsp + 0x38]
mov r14d, dword [rsp + 0x34]
mov esi, dword [rsp + 0x30]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, pe_nt_image_headers64
call fcn.180022880
mov r9d, r14d
mov dword [rsp + 0x28], r15d
mov r8d, esi
mov dword [rsp + 0x20], ebp
lea rdx, [0x18005a850]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
add rdi, 0x60
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1800076e0
mov r15, qword [rsp + 0x42f0]
mov r14, qword [rsp + 0x42f8]
mov rsi, qword [rsp + 0x4300]
mov rbp, qword [rsp + 0x4330]
jmp 0x180015b11
add rdi, 0x60
mov rdx, rdi
mov rcx, rbx
call fcn.180007170
mov rax, rbx
mov rcx, qword [rsp + 0x42e0]
xor rcx, rsp
call fcn.1800205b0
add rsp, 0x4308
pop rdi
pop rbx
ret
Function at 0x180017080
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180063080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x1800170bb
xor eax, eax
cmp dx, si
cmove di, ax
movzx eax, di
jmp 0x180017208
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1800170f7
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x1800170f7
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, di
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x180017208
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x1800171fd
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x18001713e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180017167
movzx ecx, di
mov rdx, qword [rbx + 0x80]
call fcn.18002de68
cmp ax, si
je 0x1800171fd
movzx esi, di
jmp 0x1800171fd
lea r8, [rsp + 0x40]
mov word [rsp + 0x50], di
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x52]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x1800171fd
cmp eax, 1
jle 0x1800171bd
cmp eax, 3
jne 0x1800171fd
movzx ecx, word [rsp + 0x50]
jmp 0x18001714a
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x1800171ea
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.18002ec5c
cmp rbp, rax
jne 0x1800171fd
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, di
jne 0x180017200
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800205b0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x180017cd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180063080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180017d81
cmp byte [rcx + 0x72], 0
je 0x180017d81
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x180017d43
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x180017d47
sub eax, 1
je 0x180017d4b
sub eax, 2
je 0x180017d81
xor al, al
jmp 0x180017d83
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180017d78
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.18002ec5c
cmp rdi, rax
jne 0x180017d43
cmp byte [rbx + 0x72], 0
sete al
jmp 0x180017d83
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800205b0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1800388f0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180038756
call fcn.18002fa20
mov dword [rax], 0x16
call fcn.18002c90c
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180038738
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180038738
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x180038788
lock or dword [rax + 0x14], 0x10
jmp 0x180038738
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1800387a5
mov rcx, qword [rbp + 0x20]
call fcn.180038cdc
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1800387ba
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1800387c0
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.180036fc8
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1800392f4
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x180038813
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x180038738
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x18003887f
mov rcx, qword [rbp + 0x20]
call fcn.180036fc8
cmp eax, 0xffffffff
je 0x180038866
mov rcx, qword [rbp + 0x20]
call fcn.180036fc8
cmp eax, 0xfffffffe
je 0x180038866
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.180036fc8
movsxd rdi, eax
lea r15, [0x1800654f0]
mov rcx, rbx
sar rdi, 6
call fcn.180036fc8
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x18003886d
lea rax, [0x180063340]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18003887f
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1800388b5
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1800388b1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1800388b1
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1800388d3
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1800388de
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x18003873d
jmp 0x180038704
Function at 0x14018383d
Capabilities:
Encode data using xor

Disassembly:
jl 0x14001d785
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.1401b5c23
push rcx
bswap rsi
mov qword [rsp + 0x18], 0x3814d1cc
mov rsi, qword [rsp + 0x10]
movabs rcx, 0x4f0905b9a21d120e
shr cx, cl
call 0x14018383d
push r9
mov qword [rsp + 8], 0x75f371da
lea rsp, [rsp + 8]
call fcn.1401a93f4
mov cx, 0x8ca9
sub rcx, 0x7c2f0d22
mov rcx, qword [rsp + 8]
jno 0x14000ef52
mov word [rax - 0x7f], cs
jmp 0x1bc47456a
or ecx, edx
cwde
xchg byte [rax - 0xc83acf0], dh
add ebx, esp
pop rdi
or dword [rax - 0x449f4f8a], 0x68c373e4
mov dh, 0x60
movabs al, byte [0x21bbeae4ca801d95]
outsb dx, byte [rsi]
int1
nop
xor bh, byte [rdx + rax]
adc bh, bh
push 0xffffffffffffffa4
cmp eax, 0x7b56cbdd
pop rbx
in al, 3
int1
and ebx, ebp
jns 0x140183840
mov bh, 0x9d
or al, 0x9d
xlatb
test eax, 0x591988b3
ret 0xf56d
Function at 0x180008120
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180008163
mov qword [0x180059d30], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180007ea0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180008163
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180009860
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800098bd
lea rbx, [0x18004ab40]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800098a4
cmp r10, 2
jb 0x1800098a4
cmp byte [r9], r8b
jne 0x1800098a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180009880
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800098ff
lea rbx, [0x18004ab40]
cmp r8b, 0x23
jne 0x1800098e3
cmp byte [r9], r8b
jne 0x1800098e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800098d0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180009a40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180009a5a
mov qword [r8], 0
lea rdx, [0x18004f8a8]
call fcn.180009910
mov rbx, rax
test rax, rax
jne 0x180009a7a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180009b51
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180009b51
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180009b51
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180009b51
cmp rdi, 0xffffffffffffffff
je 0x180009b51
mov rax, qword [0x180059d40]
test rax, rax
je 0x180009aee
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180009b51
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180009b3e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180059d40]
test rax, rax
je 0x180009b33
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180009b5a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180009b4c
mov qword [r14], rdi
mov rax, rsi
jmp 0x180009b5c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18000bfa0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x18004ab40]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x180059d40]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ee4], ebx
jne 0x18000c036
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.18001e380
mov eax, ebx
add rsp, 0x20
pop rbx
ret