joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400236c0
Capabilities:
Get file size
Get system information on windows
Read file via mapping

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rsi, r9
mov rbx, r8
mov r15, rdx
mov r14, rcx
xor edi, edi
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x140023704
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140023704
lea edx, [rdi - 1]
xor eax, eax
xor ecx, ecx
jmp 0x140023711
mov rdi, qword [rsp + 0x30]
xor edx, edx
mov rax, rdi
mov rcx, rdi
test edx, edx
je 0x14002372b
mov rax, 0xffffffffffffffff
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
cmp rsi, rax
jb 0x140023741
xor eax, eax
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
lea rax, [rsi + rbx]
cmp rax, rcx
jbe 0x140023750
mov rbx, rdi
sub rbx, rsi
mov eax, dword [0x1401fb0d4]
test eax, eax
jne 0x14002376f
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x70]
mov dword [0x1401fb0d4], eax
mov edi, eax
dec rdi
not rdi
and rdi, rsi
sub rsi, rdi
mov qword [rsp + 0x38], 0xffffffffffffffff
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, r14
call qword [0x1401f2080]
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140023828
lfence
lea rcx, [rsi + rbx]
mov r8, rdi
shr r8, 0x20
mov qword [rsp + 0x20], rcx
mov r9d, edi
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002381f
lfence
lea rdx, [rax + rsi]
mov r8, rbx
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsp + 0x38], rbx
jmp 0x140023813
lfence
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, r14
call qword [0x1401f2070]
lfence
mov rax, qword [rsp + 0x38]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400248b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
push r12
push r13
push r15
sub rsp, 0x48
cmp qword [rcx + 0x20], 0
mov r15d, r9d
mov r12d, r8d
mov r13, rdx
mov rdi, rcx
jne 0x1400248dd
xor al, al
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x40], r14
mov r14, qword [rsp + 0x90]
mov r9, qword [r14 + 8]
test r9, r9
je 0x14002495a
xor edx, edx
add rcx, 0x38
nop dword [rax]
mov r8d, dword [rcx + 8]
test r8d, r8d
je 0x140024920
mov rax, qword [r9 + 0xf8]
cmp qword [rcx], rax
je 0x140024986
inc edx
add rcx, 0x10
cmp edx, 0x20
jb 0x140024900
mov ecx, dword [rdi + 0x238]
mov rax, qword [r9 + 0xf8]
add rcx, rcx
mov qword [rdi + rcx*8 + 0x38], rax
mov eax, dword [rdi + 0x238]
add rax, 4
add rax, rax
mov dword [rdi + rax*8], 1
mov eax, dword [rdi + 0x238]
inc eax
and eax, 0x1f
mov dword [rdi + 0x238], eax
mov qword [rsp + 0x70], rbx
mov ecx, 4
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rsi
call fcn.14002c1a0
mov rbx, rax
test rax, rax
je 0x1400249b1
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x1400249b3
cmp r8d, 5
jae 0x14002499e
mov eax, edx
lea ecx, [r8 + 1]
add rax, 4
add rax, rax
mov dword [rdi + rax*8], ecx
jmp 0x14002495a
mov r14, qword [rsp + 0x40]
mov al, 1
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
ret
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [rsp + 0x98], 0
mov sil, 1
mov ebp, eax
jne 0x1400249ce
cmp dword [rdi + 0x28], 2
jne 0x1400249f4
mov byte [rsp + 0x30], sil
mov r9d, r15d
mov dword [rsp + 0x28], ebp
mov r8d, r12d
mov rdx, r13
mov qword [rsp + 0x20], r14
mov rcx, rdi
call fcn.140024a60
movzx esi, al
and sil, 1
mov byte [rsp + 0x30], 0
mov r9d, r15d
mov dword [rsp + 0x28], ebp
mov r8d, r12d
mov rdx, r13
mov qword [rsp + 0x20], r14
mov rcx, rdi
call fcn.140024a60
mov rbp, qword [rsp + 0x78]
and sil, al
test rbx, rbx
je 0x140024a34
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov rcx, rbx
call qword [0x1401f2070]
mov rbx, qword [rsp + 0x70]
movzx eax, sil
mov rsi, qword [rsp + 0x80]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r13
pop r12
pop rdi
ret
Function at 0x140029e10
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x280
mov rax, qword [0x1401f2308]
xor rax, rsp
mov qword [rsp + 0x270], rax
lea rax, [rsp + 0x48]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdi, rdx
mov rbx, rcx
call qword [0x1401f2180]
test eax, eax
jne 0x140029f05
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x2a0], rsi
lea r8, [rsp + 0x60]
xor esi, esi
mov dword [rsp + 0x40], 0x101
mov qword [rsp + 0x30], rsi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140029ef2
nop dword [rax]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
xor r8d, r8d
call fcn.140029e10
test al, al
je 0x140029ef2
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x40], 0x101
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140029ea0
mov rcx, qword [rsp + 0x48]
call qword [0x1401f2168]
mov rsi, qword [rsp + 0x2a0]
cmp dword [0x1401fb818], 0
mov rdx, rdi
mov rcx, rbx
je 0x140029f22
xor r9d, r9d
xor r8d, r8d
call qword [0x1401f2278]
jmp 0x140029f28
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140160900
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x280
pop rdi
ret

Function at 0x14002c6e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rdi, r9
mov rsi, r8
mov rbx, rcx
je 0x14002c77d
cmp rdx, 0xffffffffffffffff
je 0x14002c71b
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x1400309a4.0]
cmp rax, 0xffffffffffffffff
je 0x14002c77d
mov ecx, dword [rbx + 0x30]
xor edx, edx
mov rax, rdi
div rcx
test rdx, rdx
jne 0x14002c77d
mov rdi, qword [rbx + 0x20]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov rdx, rsi
mov r8d, dword [rdi + 0x1c]
mov rcx, qword [rdi]
imul r8, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002c77d
mov ecx, dword [rdi + 0x1c]
xor edx, edx
mov eax, dword [rsp + 0x40]
div rcx
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14002c77d
mov eax, dword [rbx + 0x30]
imul rax, rcx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14002c7a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rdi, r9
mov rsi, r8
mov rbx, rcx
je 0x14002c83d
cmp rdx, 0xffffffffffffffff
je 0x14002c7db
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x1400309a4.0]
cmp rax, 0xffffffffffffffff
je 0x14002c83d
mov ecx, dword [rbx + 0x30]
xor edx, edx
mov rax, rdi
div rcx
test rdx, rdx
jne 0x14002c83d
mov rdi, qword [rbx + 0x20]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov rdx, rsi
mov r8d, dword [rdi + 0x1c]
mov rcx, qword [rdi]
imul r8, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002c83d
mov ecx, dword [rdi + 0x1c]
xor edx, edx
mov eax, dword [rsp + 0x40]
div rcx
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14002c83d
mov eax, dword [rbx + 0x30]
imul rax, rcx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov rax, 0xffffffffffffffff
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14002d0f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r9
mov rbp, r8
mov rdi, rcx
cmp rdx, 0xffffffffffffffff
je 0x14002d130
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x1400309a4.0]
cmp rax, 0xffffffffffffffff
jne 0x14002d130
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x58]
mov r8d, r14d
mov qword [rsp + 0x50], rbx
mov rdx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rsi, 0xffffffffffffffff
test eax, eax
jne 0x14002d188
mov rbx, rsi
call fcn.140021590
cmp eax, 0x13
jne 0x14002d1a8
mov r9, qword [rdi + 0x38]
mov r8, r14
mov rcx, qword [rdi + 0x20]
mov rdx, rbp
call fcn.1400236c0
mov rbx, rax
cmp rax, rsi
je 0x14002d1a8
jmp 0x14002d18c
mov ebx, dword [rsp + 0x58]
add qword [rdi + 0x38], rbx
cmp dword [rdi + 0x28], 0
je 0x14002d1a8
mov rdx, rbx
mov rcx, rbp
call fcn.1400135b0
cmp rbx, rax
cmovne rbx, rsi
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14002d1c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r14, r8
mov rsi, rcx
cmp rdx, 0xffffffffffffffff
je 0x14002d1ff
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x1400309a4.0]
cmp rax, 0xffffffffffffffff
je 0x14002d2af
xor r15d, r15d
mov edi, r15d
test rbp, rbp
jne 0x14002d225
mov rdx, qword [rsi + 0x38]
mov rcx, qword [rsi + 0x20]
call fcn.140022f20
sub r15d, eax
neg r15d
sbb rax, rax
jmp 0x14002d2f0
cmp dword [rsi + 0x28], edi
je 0x14002d2b8
mov r12d, 0x10000
cmp qword [rsi + 0x50], rdi
jne 0x14002d250
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsi + 0x50], rax
test rax, rax
je 0x14002d2af
nop dword [rax]
mov rcx, qword [rsi + 0x50]
cmp rbp, r12
mov rbx, rbp
mov rdx, r14
cmovae rbx, r12
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsi + 0x50]
mov rdx, rbx
call fcn.140013890
cmp rbx, rax
jne 0x14002d2af
mov rdx, qword [rsi + 0x50]
lea r9, [rsp + 0x68]
mov rcx, qword [rsi + 0x20]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002d2af
mov eax, dword [rsp + 0x68]
add rdi, rax
cmp rax, rbx
jne 0x14002d2e3
add r14, rbx
sub rbp, rbx
jne 0x14002d250
jmp 0x14002d2e3
mov rax, 0xffffffffffffffff
jmp 0x14002d2f0
mov rcx, qword [rsi + 0x20]
lea r9, [rsp + 0x68]
mov r8d, ebp
mov qword [rsp + 0x20], r15
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14002d2df
mov rdi, 0xffffffffffffffff
jmp 0x14002d2ed
mov edi, dword [rsp + 0x68]
cmp rdi, 0xffffffffffffffff
je 0x14002d2ed
add qword [rsi + 0x38], rdi
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x14002d380
Capabilities:
Get file size

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx + 0x20]
xor edx, edx
mov qword [rsp + 0x30], rdx
test rax, rax
je 0x14002d3b3
lea rdx, [rsp + 0x34]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x14002d3d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002d3d2
mov rax, qword [rcx + 8]
test rax, rax
je 0x14002d3e0
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x30]
mov rdx, qword [rcx + 0x10]
mov rcx, rax
call fcn.1400231e0
test eax, eax
jne 0x14002d3e0
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret
mov rax, 0xffffffffffffffff
add rsp, 0x48
ret
Function at 0x14002dbc0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x1401f2308]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov ebx, r9d
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x14002dbfc
mov eax, 0x1b62
jmp 0x14002dcee
cmp qword [rcx + 8], 0
jne 0x14002dc0d
mov eax, 0x232e
jmp 0x14002dcee
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x1400309a4.0]
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsi + 8]
bt ebx, 9
jae 0x14002dc83
test rdx, rdx
je 0x14002dc6d
mov eax, dword [rdx]
test eax, eax
je 0x14002dc6d
cmp eax, 1
je 0x14002dc4a
mov eax, dword [rdx + 4]
add rdx, 8
add rdx, rax
mov eax, dword [rdx]
test eax, eax
jne 0x14002dc33
jmp 0x14002dc6d
mov r8d, 0x122
lea rdx, [rsp + 0x30]
call fcn.140029800
test al, al
jne 0x14002dc68
mov eax, 0x1388
jmp 0x14002dcee
lea rcx, [rsp + 0x30]
mov r8d, 4
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne al
jmp 0x14002dc97
mov r9, rbp
mov dword [rsp + 0x20], ebx
mov r8, rdi
call fcn.14001eea0
test eax, eax
sete al
test al, al
je 0x14002dce2
mov rcx, qword [rsi + 8]
cmp rdi, rcx
je 0x14002dcde
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x14002dcb0
inc rbx
lea rdx, [rbx + rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14002dcde
mov r8, rdi
mov qword [rsi + 8], rax
mov rdx, rbx
mov rcx, rax
call fcn.140032170
xor eax, eax
jmp 0x14002dcee
call fcn.140021590
mov ecx, eax
call fcn.14002f760
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140160900
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x290
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002dd20
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
test rax, rax
jne 0x14002dd3f
lea ecx, [rax + 0xd]
call int.140021860
mov eax, 0xffffffff
add rsp, 0x28
ret
mov rdx, qword [rcx + 0x10]
mov rcx, rax
add rsp, 0x28
jmp fcn.14001eca0
Function at 0x14002e110
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1401f2308]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rcx]
mov esi, edx
mov rbx, rcx
mov rax, qword [rax + 0x20]
call qword [case.0x1400309a4.0]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14002e15b
mov rdx, qword [rbx + 0x10]
mov r8d, 0x20
call fcn.14001f210
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0xb8]
call qword [case.0x1400309a4.0]
movzx ebp, al
bt esi, 9
jae 0x14002e202
mov rcx, qword [rbx + 0x10]
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x14002e1ca
mov edx, dword [rcx]
test edx, edx
je 0x14002e1ca
nop
cmp edx, 1
je 0x14002e1a7
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov edx, dword [rcx]
test edx, edx
jne 0x14002e190
jmp 0x14002e1ca
mov r8d, 0x122
lea rdx, [rsp + 0x20]
mov rcx, r9
call fcn.140029800
test al, al
jne 0x14002e1c5
mov eax, 0x1388
jmp 0x14002e1df
lea r9, [rsp + 0x20]
xor edx, edx
mov rcx, r9
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x14002e21b
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140160900
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
mov rax, qword [rax + 0xa0]
call qword [case.0x1400309a4.0]
test eax, eax
je 0x14002e1dd
call fcn.140021590
mov ecx, eax
call fcn.14002f760
lea ecx, [rax - 0x2332]
cmp ecx, 1
jbe 0x14002e1dd
test bpl, bpl
mov ecx, 0x2337
cmovne eax, ecx
jmp 0x14002e1df
Function at 0x1400306e0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xc8], 0
mov edi, edx
mov rbx, rcx
je 0x140030708
mov eax, 0x232d
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x40], rsi
xor esi, esi
mov dword [rcx + 0xb0], edi
mov qword [rcx + 0xb8], rsi
test dil, 0x20
je 0x140030835
mov r9, qword [rcx + 0x10]
mov qword [rcx + 0x208], 0xffffffffffffffff
test r9, r9
je 0x14003079f
mov ecx, dword [r9]
test ecx, ecx
je 0x14003079f
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r9 + 4]
lea rdx, [r9 + 8]
add rdx, rax
cmp ecx, 0xf
je 0x14003076b
mov ecx, dword [rdx]
mov r9, rdx
test ecx, ecx
jne 0x140030750
jmp 0x14003079f
mov r8, rdx
test rdx, rdx
jne 0x140030778
mov r8, rsi
jmp 0x140030797
cmp dword [rdx], esi
je 0x140030790
nop dword [rax]
mov eax, dword [r8 + 4]
add r8, 8
add r8, rax
cmp dword [r8], esi
jne 0x140030780
sub r8, rdx
add r8, 8
mov rcx, r9
call sub.VCRUNTIME140.dll_memmove
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400307fc
mov r8d, dword [rcx]
test r8d, r8d
je 0x1400307fc
mov eax, dword [rcx + 4]
lea rdx, [rcx + 8]
add rdx, rax
cmp r8d, 0x29
je 0x1400307cd
mov r8d, dword [rdx]
mov rcx, rdx
test r8d, r8d
jne 0x1400307b0
jmp 0x1400307fc
mov r8, rdx
test rdx, rdx
jne 0x1400307da
mov r8, rsi
jmp 0x1400307f7
cmp dword [rdx], esi
je 0x1400307f0
nop
mov eax, dword [r8 + 4]
add r8, 8
add r8, rax
cmp dword [r8], esi
jne 0x1400307e0
sub r8, rdx
add r8, 8
call sub.VCRUNTIME140.dll_memmove
bt edi, 0x12
jae 0x140030815
lea rcx, [rbx + 0xd0]
call fcn.140009ea0
mov qword [rbx + 0x208], rsi
bt edi, 0x19
jae 0x140030835
lea rcx, [rbx + 0x138]
lea rdx, [0x1401a3ca0]
call fcn.14000e980
mov qword [rbx + 0x208], rsi
mov rax, qword [rbx + 0x228]
mov dword [rbx + 0xc8], 1
cmp rax, 0xffffffffffffffff
je 0x14003086e
mov qword [rbx + 0xc0], rax
cmp qword [rbx + 0x48], rsi
jne 0x140030863
cmp rax, qword [rbx + 0x40]
jge 0x140030863
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x228], 0xffffffffffffffff
test dil, dil
jns 0x1400308ab
mov rax, qword [rbx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400309a4.0]
test rax, rax
je 0x1400308ab
mov dword [rbx + 0xc8], esi
mov eax, 0x232a
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140032a00
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rdx
movzx r9d, cx
movabs rax, 0x79baa6bb6398b6f7
shr ecx, 0x10
mul r8
mov rax, r8
mov rbx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xc
imul rax, rax, 0x15b0
sub r8, rax
test r10, r10
jne 0x140032a48
lea eax, [r10 + 1]
mov rbx, qword [rsp + 8]
ret
test rbx, rbx
je 0x140032b1c
xor edx, edx
cmp r8, 7
jbe 0x140032aca
lea r11d, [rdx + 7]
nop dword [rax]
movzx eax, byte [r10]
add r11d, 8
add r9d, eax
add edx, 8
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
add r10, 8
add ecx, r9d
mov eax, r11d
cmp rax, r8
jb 0x140032a60
mov eax, edx
cmp rax, r8
jae 0x140032ae7
movzx eax, byte [r10]
inc edx
add r9d, eax
inc r10
add ecx, r9d
mov eax, edx
cmp rax, r8
jb 0x140032ad1
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub rbx, r8
mov r8d, 0x15b0
jne 0x140032a51
mov rbx, qword [rsp + 8]
shl ecx, 0x10
lea eax, [r9 + rcx]
ret

Function at 0x140032b30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x1401a75f0]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x140032ba9
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140032b50
test r8, r8
je 0x140032bcd
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x140032bb0
not ecx
mov eax, ecx
ret
Function at 0x14004a840
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x14004a861
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14004a88e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14004a890
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14004a8f1
test ecx, ecx
jle 0x14004a8c9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14004a8f1
cmp qword [rdi + 0x80], 0
je 0x14004a8f1
lfence
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
in eax, 0x95
invalid
mov ebx, 0x6ba802d1
imul edi, dword [0x149ad2cbc], 0x63
loope 0x14036dc8d
out 0x5d, al
rcr byte [rdi - 0x1354ec40], 0x68
and al, 0x16
out 0xce, al
jg 0x14036dc59
mov ss, word [0x1176f0c5b]
ret 0xcd0b
Function at 0x14004a910
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rbp, rdx
mov rsi, rcx
test r8, r8
jg 0x14004a941
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14004a95b
lfence
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14004a97e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004a980
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14004a9bc
mov qword [rsp + 0x38], rdi
cmp rax, r14
mov rdi, r14
mov rcx, rbp
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add rbp, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14004aa4e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14004a9f7
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14004aa2e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add rbp, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14004aa4e
cmp rbx, rax
ja 0x14004aa00
test rbx, rbx
je 0x14004aa4e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub r14, rbx
mov rax, r14
lfence
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov cl, 0x78
movabs eax, dword [0x83a6c7a42584cda7]
insb byte [rdi], dx
movabs byte [0x7975680fa8fd28a0], al
xchg ecx, eax
invalid