joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800026f4
Capabilities:
Get file size
Read file on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, rcx
mov r13, r9
lea rcx, [0x18023ebd0]
mov ebp, r8d
mov rdi, rdx
xor r12d, r12d
or r14d, 0xffffffff
call sym.python310.dll_PyImport_AddModule
mov rbx, rax
test rax, rax
je 0x1800028a1
inc qword [rax]
mov rcx, rax
call sym.python310.dll_PyModule_GetDict
lea rdx, str.__file__
mov rcx, rax
mov rsi, rax
call sym.python310.dll__PyDict_GetItemStringWithError
test rax, rax
jne 0x1800027aa
mov rcx, qword [0x18044f1f0]
cmp qword [rcx + 0x58], r12
jne 0x180002867
mov r8, rdi
lea rdx, str.__file__
mov rcx, rsi
call sym.python310.dll_PyDict_SetItemString
test eax, eax
js 0x180002867
lea r8, sym.python310.dll__Py_NoneStruct
mov rcx, rsi
lea rdx, str.__cached__
call sym.python310.dll_PyDict_SetItemString
sub esp, 0x60
mov dh, 0
add byte [rax], al
movzx ecx, ax
Function at 0x180002a44
Capabilities:
Get file size
Read file on windows
Resolve function by parsing pe exports
Terminate process

Disassembly:
pop rbp
add byte [rbp - 0x7b], al
sal byte [rbx + rdi + 0x44], 0x8d
pop rsi
std
Function at 0x1800030f8
Capabilities:
Get thread local storage value

Disassembly:
cmp qword [rcx + 0x10], 0
je 0x180003108
add rcx, 0x18
jmp sym.python310.dll_PyThread_tss_get
xor eax, eax
ret
Function at 0x180ccb224
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x70], 0x46e70c71
mov r11, qword [rsp + 0x60]
add qword [rsp], 0x7f8f1467
add dword [rsp + 0x48], 0x747458b0
and qword [rsp + 0x48], 0x53e442f1
test qword [rsp + 0x48], 0x6ef57101
push qword [rsp + 0x80]
popfq
lea rsp, [rsp + 0x90]
call fcn.180ed7cf3
sbb eax, 0xc9072179
xor al, 0xc6
jl fcn.180ccb224
invalid
Function at 0x140001070
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140001094
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsi], 0
lea rax, str.8A69D345_D564_463c_AFF1_A69D9E530F96
mov qword [rsi + 8], rax
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x16], rax
mov byte [rsi + 0x1e], 1
mov qword [rsi + 0x20], rax
mov edx, 1
mov r8d, 0xa
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x140001119
mov r14, rax
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140001119
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test eax, eax
sete al
mov ecx, edi
or cl, al
test cl, 1
jne 0x140001119
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
je 0x140001119
mov ecx, edi
cmp word [rax + rcx - 2], 0
jne 0x140001119
mov qword [rsi + 0x20], rax
lea rdi, [rsp + 0x34]
mov dword [rdi], 0
mov qword [rsp + 0x20], 2
lea rdx, str.SoftwareGoogle
lea r8, str.ChromeInstallerCleanup
mov rcx, 0xffffffff80000001
mov r9, rdi
call fcn.140003af0
cmp word [rdi], 0x30
setne cl
xor al, 1
or al, cl
mov byte [rsi + 0x1e], al
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rsi
mov rdx, rax
call fcn.140001180
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140001180
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov qword [rcx + 0x10], rdx
lea rbx, [rcx + 0x18]
mov rcx, rdx
mov rdx, rbx
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov rdi, rax
mov qword [rsi], rax
test rax, rax
je 0x140001219
cmp dword [rbx], 2
jl 0x1400011dd
mov ebp, 1
lea r14, str.__system_level
mov r13, qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea r15, str.__chrome_beta
lea r12, str.__chrome_dev
jmp 0x140001262
cmp byte [rsi + 0x1c], 0
jne 0x140001219
xor eax, eax
lea rbx, [rsp + 0x22]
mov word [rbx + 4], ax
mov word [rbx], ax
lea rcx, str.GoogleUpdateIsMachine
mov rdx, rbx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, 1
sete al
cmp word [rbx], 0x31
sete cl
and cl, al
mov byte [rsi + 0x1c], cl
test rdi, rdi
setne al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, str.401C381F_E0DE_4B85_8BD8_3F3F14FBDA57
jmp 0x14000124f
lea rax, str.4ea16ac7_fd5a_47c3_875b_dbf4a2008c20
jmp 0x14000124f
mov byte [rsi + 0x1c], 1
jmp 0x140001253
lea rax, str.8237E44A_0054_442C_B6B6_EA0509993955
mov qword [rsi + 8], rax
inc rbp
movsxd rax, dword [rbx]
cmp rbp, rax
jge 0x1400011dd
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r14
call r13
test eax, eax
je 0x140001242
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r15
call r13
test eax, eax
je 0x140001248
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
mov rdx, r12
call r13
test eax, eax
je 0x140001230
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__chrome_sxs
call r13
test eax, eax
je 0x140001239
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__cleanup
call r13
test eax, eax
je 0x1400012d8
mov rax, qword [rsi]
mov rcx, qword [rax + rbp*8]
lea rdx, str.__chrome_frame
call r13
test eax, eax
jne 0x140001253
mov byte [rsi + 0x1d], 1
jmp 0x140001253
Function at 0x140001a90
Capabilities:
Self delete using alternate data streams

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
mov rdi, rcx
mov dword [rdx], 1
mov r15, qword [sym.imp.KERNEL32.dll_CreateFileW]
xorps xmm6, xmm6
lea rbx, [rsp + 0x40]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001afa
mov rcx, r14
call r13
mov eax, dword [rsi]
cmp eax, 0x64
je 0x140001c56
inc eax
mov dword [rsi], eax
mov rax, qword [0x1400070a0]
test rax, rax
je 0x140001b58
mov rcx, qword [0x1400070a8]
call qword [0x1400058d8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x10000
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001b76
mov r14, rax
mov byte [rsp + 0x40], 1
mov rcx, rax
mov edx, 4
mov r8, rbx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
test eax, eax
je 0x140001b65
mov rcx, r14
call r13
jmp 0x140001afa
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001afa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov rcx, r14
call r13
jmp 0x140001b7f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
mov ebp, r12d
and ebp, 0xfffffffe
cmp ebp, 2
je 0x140001c56
cmp r12d, 0x91
je 0x140001ad2
cmp r12d, 0x20
je 0x140001ad2
cmp r12d, 5
jne 0x140001c56
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0x180
mov r8d, 7
xor r9d, r9d
call r15
cmp rax, 0xffffffffffffffff
je 0x140001ad2
mov r14, rax
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0x60], 0
mov rcx, rax
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
test eax, eax
je 0x140001acc
mov eax, dword [rsp + 0x60]
test al, 1
je 0x140001acc
and eax, 0xfffffffe
mov dword [rsp + 0x60], eax
mov rcx, r14
xor edx, edx
mov r8, rbx
mov r9d, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
mov r12d, eax
mov rcx, r14
call r13
test r12d, r12d
jne 0x140001afa
jmp 0x140001ad2
cmp ebp, 2
sete al
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400021c0
Capabilities:
Create process on windows
Get file attributes

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov edi, r9d
mov rbx, rdx
mov rsi, rcx
xorps xmm0, xmm0
lea rax, [rsp + 0x80]
movaps xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x60], rcx
movaps xmmword [rax + 0x50], xmm0
movaps xmmword [rax + 0x40], xmm0
movaps xmmword [rax + 0x30], xmm0
movaps xmmword [rax + 0x20], xmm0
movaps xmmword [rax + 0x10], xmm0
mov dword [rax], 0x68
lea rdx, [rsp + 0x60]
mov qword [rdx + 0x10], rcx
movaps xmmword [rdx], xmm0
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r8
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400022b0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x5c], 0
mov rcx, qword [rsp + 0x60]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140002289
mov edi, 0x6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], edi
mov dword [rsi + 4], eax
mov rax, rsi
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x60]
lea rdx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000226a
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov edi, dword [rsp + 0x5c]
jmp 0x140002275
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp ebp, 3
je 0x1400022d9
cmp ebp, 2
je 0x140002275
mov eax, dword [rsp + 0x138]
mov dword [rsi], eax
mov dword [rsi + 4], ebp
jmp 0x14000227a
mov ecx, dword [rsp + 0x130]
mov dword [rsi], ecx
jmp 0x140002277
Function at 0x140002c80
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
mov rsi, rdx
mov qword [rdx], 0
xor eax, eax
lea rdx, [rsp + 0x4e]
mov word [rdx + 0x208], ax
mov word [rdx], ax
mov dword [rsp + 0x40], 0
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
test eax, eax
je 0x140002d7f
xor eax, eax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 0
lea rcx, [rsp + 0x4e]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140002d7f
test byte [rsp + 0x40], 8
mov dil, 1
je 0x140002d82
lea rcx, [rsp + 0x40]
mov qword [rcx], 0
call fcn.140002ba0
xor edi, edi
test al, al
je 0x140002d82
lea rcx, [rsp + 0x4e]
mov word [rcx + 0x258], di
mov word [rcx], di
lea r8, str.D:PAI_A__FA___BA__A_OIIOCI_GA___BA__A__FA___SY__A_OIIOCI_GA___SY__A_OIIOCI_GA___CO__A__FA___
mov edx, 0x12c
call fcn.140003700
test al, al
je 0x140002d72
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.140003700
test al, al
je 0x140002d70
lea r8, [0x140005580]
lea rcx, [rsp + 0x4e]
mov edx, 0x12c
call fcn.140003700
test al, al
jne 0x140002d8e
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140002d82
mov dil, 1
mov eax, edi
add rsp, 0x2a8
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x4e]
mov edx, 1
mov r8, rsi
xor r9d, r9d
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
setne dil
jmp 0x140002d72
Function at 0x140002db0
Capabilities:
Create directory
Generate random numbers via rtlgenrandom

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r8
mov rdi, rdx
mov r15, rcx
mov qword [r8], 0x6c
mov edx, 0x104
mov rcx, rdi
mov r8, r15
call fcn.1400036c0
test al, al
je 0x140002e17
lea r8, [0x140005692]
mov ebx, 0x104
mov edx, 0x104
mov rcx, rdi
call fcn.140003700
test al, al
je 0x140002e17
mov edx, 0x104
mov rcx, rdi
call fcn.140003690
sub rbx, rax
cmp rbx, 0xb
jae 0x140002e2a
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, rax
xorps xmm0, xmm0
lea rdx, [rsp + 0x38]
movaps xmmword [rdx - 8], xmm0
mov qword [rdx + 8], 0
mov dword [rdx - 8], 0x18
mov rcx, r15
call fcn.140002c80
test al, al
jne 0x140002e67
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 0x75
mov qword [rsi], rax
jmp 0x140002e17
mov qword [rsi], 0x6d
lea r15, [rdi + r14*2]
mov rbp, r14
add rbp, 5
mov r13d, 0xfffffff6
lea r12, [rsp + 0x2c]
jmp 0x140002efb
lea r8, [0x14000558e]
mov edx, 0x104
mov rcx, rdi
call fcn.140003700
mov qword [rsi], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140002eb1
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [rsi], 0
sete al
jmp 0x140002e19
mov word [rdi + r14*2 + 0xa], 0
mov edx, 0x104
mov rcx, rdi
lea r8, [0x140005584]
call fcn.140003700
mov rdx, qword [rsp + 0x38]
test rdx, rdx
lea rax, [rsp + 0x30]
cmovne rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140002e86
inc r13d
je 0x140002ea1
mov rcx, r12
mov edx, 4
call sub.ADVAPI32.dll_SystemFunction036
mov edx, 4
mov rcx, r12
mov r8, r15
mov r9, rbx
call fcn.140003630
cmp rbp, 0x103
ja 0x140002ec4
jmp 0x140002ebc

Function at 0x140003980
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rdi, r9
mov rsi, r8
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea eax, [rdi + rdi]
lea r8, [rsp + 0x30]
mov dword [r8], eax
mov rcx, qword [rcx]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rsi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400039c4
add rsp, 0x38
pop rdi
pop rsi
ret
mov eax, 0x32
cmp dword [rsp + 0x34], 1
jne 0x1400039bd
mov ecx, dword [rsp + 0x30]
cmp rcx, 2
jb 0x1400039f6
mov edx, ecx
and edx, 0xfffffffe
cmp word [rsi + rdx - 2], 0
je 0x1400039fb
shr ecx, 1
mov eax, 0xea
cmp rcx, rdi
jae 0x1400039bd
add rsi, rdx
mov word [rsi], 0
xor eax, eax
jmp 0x1400039bd

Function at 0x140003a00
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea r9, [rsp + 0x34]
mov dword [r9], 0
lea rax, [rsp + 0x30]
mov dword [rax], 4
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003a3a
add rsp, 0x38
ret
mov eax, 0x32
cmp dword [rsp + 0x34], 4
jne 0x140003a35
xor ecx, ecx
cmp dword [rsp + 0x30], 4
mov eax, 0xe8
cmove eax, ecx
jmp 0x140003a35
Function at 0x140003a60
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
mov rcx, qword [rbx]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140003ab0
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x34]
mov dword [rax], r8d
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
add rsp, 0x38
ret

Function at 0x140003af0
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, r9
mov rbx, r8
lea rax, [rsp + 0x40]
mov qword [rax], 0
mov qword [rsp + 0x20], rax
xor edi, edi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003b41
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140003b35
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r14, qword [rsp + 0x90]
lea r9, [rsp + 0x3c]
mov dword [r9], 0
lea eax, [r14 + r14]
lea rdx, [rsp + 0x38]
mov dword [rdx], eax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
xor edi, edi
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003b25
cmp dword [rsp + 0x3c], 1
jne 0x140003b25
mov eax, dword [rsp + 0x38]
cmp rax, 2
jb 0x140003ba9
mov ecx, eax
and ecx, 0xfffffffe
cmp word [rsi + rcx - 2], 0
je 0x140003bae
shr eax, 1
cmp rax, r14
jae 0x140003bb6
add rsi, rcx
mov word [rsi], 0
mov dil, 1
jmp 0x140003b25
xor edi, edi
jmp 0x140003b25

Function at 0x140003c60
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
mov rsi, rdx
mov rdi, rcx
lea rbx, [rsp + 0x30]
mov rcx, rbx
call fcn.140001d50
mov rcx, rbx
mov rdx, rsi
call fcn.140001db0
test al, al
je 0x140003d33
mov rbx, qword [rdi + 8]
mov sil, 1
test rbx, rbx
je 0x140003d35
xor r13d, r13d
mov ebp, 0x800000
lea r14, [rsp + 0x30]
lea r15, [rsp + 0x2c]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFile]
sub rbx, r13
cmp rbx, rbp
cmovae rbx, rbp
mov dword [rsp + 0x2c], 0
mov r12, qword [rdi]
add r12, r13
mov rcx, r14
call fcn.140001f20
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, r12
mov r8d, ebx
mov r9, r15
call rsi
test eax, eax
je 0x140003d0e
add r13, rbx
mov rbx, qword [rdi + 8]
cmp r13, rbx
jb 0x140003cc2
mov sil, 1
jmp 0x140003d35
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.140001e60
mov rcx, rdi
call fcn.140001d70
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor esi, esi
lea rcx, [rsp + 0x30]
call fcn.140001d70
mov eax, esi
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140003e48
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140003ec0
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140003ec0
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140003ec0
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140003eb4
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140003ed2
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140003ea2
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140003ec2
Function at 0x1800024d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000252d
lea rbx, [0x180032cb0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180002514
cmp r10, 2
jb 0x180002514
cmp byte [r9], r8b
jne 0x180002514
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1800024f0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000256f
lea rbx, [0x180032cb0]
cmp r8b, 0x23
jne 0x180002553
cmp byte [r9], r8b
jne 0x180002553
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180002540
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800026b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1800026ca
mov qword [r8], 0
lea rdx, [0x180032934]
call fcn.180002580
mov rbx, rax
test rax, rax
jne 0x1800026ea
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1800027c1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800027c1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800027c1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800027c1
cmp rdi, 0xffffffffffffffff
je 0x1800027c1
mov rax, qword [0x18003d8e8]
test rax, rax
je 0x18000275e
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1800027c1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1800027ae
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18003d8e8]
test rax, rax
je 0x1800027a3
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800027ca
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1800027bc
mov qword [r14], rdi
mov rax, rsi
jmp 0x1800027cc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800046c0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x180032cb0]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x18003d8e8]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ee4], ebx
jne 0x180004756
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.180015140
mov eax, ebx
add rsp, 0x20
pop rbx
ret