joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011db30
Capabilities:
Encode data using xor

Disassembly:
push rbx
xchg rcx, rcx
neg rsp
sub rsp, 0xfffffffffffffdd0
neg rsp
mov rax, qword [0x1401422b0]
lea rdx, [rsp + 0x20]
not rax
xchg rbp, rbp
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
ror rax, 0x21
ror rax, 0xc
ror rax, 0xb
ror rax, 1
ror rax, 3
ror rax, 1
movabs rcx, 0x5694a59d6d077eef
sub rcx, 0x172ac3bc
add rcx, 0xe2cbbb6
sub rcx, 0x24d5a2a
sub rcx, 0x3178bb51
xor rax, rcx
mov dword [rsp - 0x30], ebx
xor r9d, r9d
movabs rcx, 0x69887042219b3525
add rcx, 0xcbc4b64
add rcx, 0x15fba064
add rcx, 0x2c6dad6c
sub rax, rcx
mov dword [rsp - 0x18], esp
xor ecx, ecx
lea r8d, [r9 + 8]
call rax
mov dword [rsp - 0x14], 0x35ee17f3
lea rcx, [rbx + 8]
xorps xmm0, xmm0
mov qword [rbx], rcx
mov dword [rsp - 0x20], esp
xchg rcx, rsp
movups xmmword [rsp], xmm0
xchg rsp, rcx
xchg rcx, r12
movups xmmword [r12 + 0x10], xmm0
xchg r12, rcx
xchg rbx, rcx
movups xmmword [rbx + 0x20], xmm0
xchg rbx, rcx
test eax, eax
je 0x14011dd2b
mov rsp, rsp
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff5ca48ff3
sub rdx, 0x56649eb3
add rdx, 0x27ca1c7
sub rdx, 0x8395d5e
add rdx, 0x7fffffff
xor rdx, 0x7f7cca57
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
mov r13, r13
jne 0x14011dc48
mov rcx, rbx
xchg rdx, r13
mov qword [rbx + 0x38], r13
xchg r13, rdx
call fcn.140017954
mov r10, r10
xor r8d, r8d
xchg rdi, rax
mov rdx, rdi
xchg rdi, rax
mov ecx, 0xa7ed497
sub ecx, 0x4ed45b9
add ecx, 0x51b438c3
sub ecx, 0x217442a9
add ecx, 0x2cdfbf5d
cmp qword [rbx + 0x38], r8
jbe 0x14011dd35
mov rbp, rbp
lea r9, [rsp + 0x20]
mov r10d, 0x3af4e10f
xor r10d, 0x5a6f4946
sub r10d, 0x11f2057e
sub r10d, 0x4ea9a1cc
sub r9, rax
mov dword [rsp - 0x1c], 0x50c11fed
nop word [rax + rax]
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
mov dword [rsp - 0x38], edx
ror ecx, 7
ror ecx, 1
xor ax, word [r9 + rdx - 2]
mov dword [rsp - 0x20], 0x27c193c
inc r8
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14011dcd8
xchg rcx, rcx
xchg rbx, r14
mov rax, r14
xchg rbx, r14
sub rsp, 0xfffffffffffffdd0
xchg r9, r9
nop
mov rbx, qword [rsp]
add rsp, 8
ret
xor r8d, r8d
mov r11, r11
mov qword [rbx + 0x38], r8
xchg r12, rax
mov r12, rbx
xchg r12, rax
add rsp, 0x19d92748
sub rsp, 0x19d92518
pop rbx
mov dword [rsp - 0x18], 0x6873eb07
ret
Function at 0x140134150
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov dword [rsp - 0x38], edi
mov eax, dword [0x140142ba4]
cmp qword [0x140142bb8], 0
jne 0x14008dca0
syscall
mov dword [rsp - 0xc], 0x21cc6cc
ret
jmp 0x14008e7f3
Function at 0x1401368b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg r9, rbx
xchg rdi, rsi
mov qword [rsp + 0x10], rdi
xchg rsi, rdi
mov qword [rsp + 0x18], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
push 0x6835512f
mov qword [rsp], r12
push r14
mov rbx, rbx
mov rbp, rsp
nop
add rsp, 0x46541a7f
sub rsp, 0x46541aef
xchg r8, rdi
mov r8, rdi
xchg r8, rdi
xchg r10, r14
mov r10, rdx
xchg r14, r10
xchg rsi, r13
mov r13, rcx
xchg r13, rsi
movabs r12, 0x703a3e7f20c5722b
add r12, 0x46620d37
sub r12, 0x42834a2a
sub r12, 0x1c7f04da
cmp r9d, 0x60001
jne 0x140136ac4
xchg r10, r10
mov dword [rbp - 0x40], 0xf184c04
sub dword [rbp - 0x40], 0x2bf8c5f
add dword [rbp - 0x40], 0x2f059283
xor dword [rbp - 0x40], 0x4007ff62
sub dword [rbp - 0x40], 0x17684c9d
xor edx, edx
mov dword [rbp - 0x3c], 0x4fc6e5c2
xor dword [rbp - 0x3c], 0x3dcb8642
sub dword [rbp - 0x3c], 0x32368e26
add dword [rbp - 0x3c], 0x7d7cb86c
mov dword [rbp - 0x38], 0x1e4e8ff5
add dword [rbp - 0x38], 0x887a3d9
add dword [rbp - 0x38], 0x3ef4ea1f
add dword [rbp - 0x38], 0x3f7275cb
mov ecx, edx
mov rcx, rcx
mov eax, 0x5b35a22a
sub eax, 0x5a18862c
add eax, 0x35603104
add eax, 0x3727e0ea
rol eax, cl
xor al, byte [rbp + rdx - 0x40]
mov dword [rsp - 0xc], esi
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
mov dword [rsp - 0x34], 0x683df4d2
jb 0x14013699d
mov r9d, 0x63850681
xor r9d, 0x10ef3dac
sub r9d, 0x323effa0
sub r9d, 0x412b2b8e
mov qword [rsp + 0x20], 0x6154bfbb
sub qword [rsp + 0x20], 0x370c60c6
xor qword [rsp + 0x20], 0x5b8988b6
sub qword [rsp + 0x20], 0x3ae382ba
xor qword [rsp + 0x20], 0x36de5385
lea r8, [rbp - 0x34]
xchg rsi, rdx
mov rsi, rdi
xchg rsi, rdx
mov rcx, r14
call fcn.140133dc0
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea rdi, [rbp - 0x34]
mov dword [rsp - 0x2c], esi
xor eax, eax
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
mov dword [rsp - 0x44], esp
je 0x140136b16
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.140090078
mov dword [rsp - 0x24], 0x739e37f3
test dword [rbp - 7], 0x1000
jne 0x140136b16
cmp byte [rbp - 0x1d], 0xe8
jne 0x140136b16
mov dword [rsp - 0x34], 0x1356b528
lea rdx, [rbx + 0xc]
xchg rbp, r14
mov rcx, rbp
xchg rbp, r14
call fcn.1400858a0
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
mov dword [rsp - 0x3c], 0x26a6e113
add edx, eax
mov rax, qword [rsi + 8]
xor rax, r12
mov rdx, rdx
add rdx, rax
xor rdx, r12
mov qword [rsi + 0x20], rdx
cmp qword [rsi + 0x20], r12
mov dword [rsp - 0x1c], 0x6678edcd
setne al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
xchg r12, rsi
mov r12, qword [r11 + 0x28]
xchg rsi, r12
xchg r12, rdi
mov r12, qword [r11 + 0x30]
xchg r12, rdi
xchg r15, r11
mov rsp, r15
xchg r11, r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
xor al, al
mov r13, r13
jmp 0x140136ad3
Function at 0x140011113
Capabilities:
Write file on windows

Disassembly:
jmp 0x140022c70
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140040068]
call fcn.140011ac8
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140022cc7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140022dd3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x140022d6c
cmp qword [rbp + 0x28], 0
jle 0x140022d6c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x140022d0c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011a0f
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140022dc2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140022dc2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x140011203
Capabilities:
Execute command

Disassembly:
jmp 0x14001ee10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140038018]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x140040074]
call fcn.140011ac8
mov dword [rbp + 4], 0
mov byte [rbp + 0x24], 0x4e
lea rcx, [rbp + 0x48]
call fcn.140011aaf
nop
lea rcx, [rbp + 0x88]
call fcn.140011aaf
nop
lea rdx, str._n__________HBO_APP
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011136
lea rdx, str._n_1.__Iniciar_Sesion
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011136
lea rdx, str._n_2.__Registrarse
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011136
lea rdx, str._n_n_Opcion:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011136
lea rdx, [rbp + 4]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
lea rcx, [0x140031488]
call qword [sym.imp.ucrtbased.dll_system]
cmp dword [rbp + 4], 0
je 0x14001ee7b
cmp dword [rbp + 4], 3
jg 0x14001ee7b
mov eax, dword [rbp + 4]
mov dword [rbp + 0x174], eax
cmp dword [rbp + 0x174], 1
je 0x14001ef0e
cmp dword [rbp + 0x174], 2
je 0x14001ef26
jmp 0x14001ef3d
mov rax, qword [rbp + 0x1a0]
mov rdx, rax
mov rcx, qword [rbp + 0x1a0]
call fcn.1400119ba
jmp 0x14001ef3d
mov rax, qword [rbp + 0x1a0]
mov rdx, rax
mov rcx, qword [rbp + 0x1a0]
call fcn.140011a1e
nop
lea rcx, [rbp + 0x88]
call fcn.14001120d
nop
lea rcx, [rbp + 0x48]
call fcn.14001120d
lea rcx, [rbp - 0x20]
lea rdx, [0x14002f360]
call fcn.1400118ca
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.140011528
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140011604
Capabilities:
Terminate process

Disassembly:
jmp 0x140025810
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011776
Capabilities:
Parse pe header

Disassembly:
jmp 0x140026340
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140026360
xor al, al
jmp 0x1400263e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140026373
xor al, al
jmp 0x1400263e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14002639d
xor al, al
jmp 0x1400263e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400263b1
xor al, al
jmp 0x1400263e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400263c3
xor al, al
jmp 0x1400263e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400263df
xor al, al
jmp 0x1400263e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011aa5
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001b080
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x140038018]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x140040068]
call fcn.140011ac8
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x14001b0e6
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001b0ed
mov al, 1
jmp 0x14001b247
call fcn.1400112f3
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.1400112f3
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.1400118ed
movzx eax, al
test eax, eax
je 0x14001b148
xor al, al
jmp 0x14001b247
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x14001b1ad
cmp dword [rbp + 0x194], 1
je 0x14001b1b8
cmp dword [rbp + 0x194], 3
je 0x14001b236
jmp 0x14001b245
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14001b208
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14001b208
xor al, al
jmp 0x14001b247
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14001b223
mov dword [rbp + 0x194], 1
jmp 0x14001b22d
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x14001b247
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001b247
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140030880]
call fcn.1400118ca
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.140011528
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x141104fa4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141104fae
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141104fd7
pop rbp
sub rbp, 0x33
sub rbp, 0x1104fa4
sub rsp, 0x20
jmp 0x141104ff6
mov rax, 0x1104fa4
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0xffffffff98171b17
xor byte [rax], dl
inc rax
dec rcx
jne 0x141105015
jmp 0x14110502c
pop rdi
sahf
invalid
Function at 0x180003778
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800ff028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbp, rcx
mov rcx, r8
mov rax, 0xfffffffffffff000
and rcx, rax
mov rsi, r8
mov qword [rdx], rcx
mov rdx, r8
sub rdx, rcx
lea r9, [rdi + 0x10]
add rdx, 0x1004
mov r8d, 0x40
and rdx, rax
mov qword [rdi + 8], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180003802
mov r9, qword [rdi + 8]
lea rdx, str.__unprotect_memory__p__size_llu______p__size_llu__n
mov r8, qword [rdi]
mov rcx, rbp
mov qword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call fcn.180002dd4
xor eax, eax
jmp 0x18000384f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x40]
call fcn.180003484
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rdi + 8]
lea rdx, str.Failed_to_unprotect_memory__p__size_llu______p__size_llu__error_lu__s__
mov r8, qword [rdi]
mov rcx, rbp
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call fcn.180002dfc
mov eax, 9
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18009c930
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800082c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18000831a
mov r11b, 0x23
lea rdi, [0x1800c3d00]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x180008304
cmp rdx, 2
jb 0x180008304
cmp byte [r10], r11b
jne 0x180008304
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x1800082e2
jmp 0x18000835b
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18000835b
mov r11b, 0x23
lea rdi, [0x1800c3d00]
cmp dl, r11b
jne 0x18000833f
cmp byte [r10], r11b
jne 0x18000833f
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x18000832d
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x180008490
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x1800084b0
and qword [r8], 0
lea rdx, [0x1800e4358]
call fcn.18000836c
mov rbx, rax
test rax, rax
je 0x1800085a1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x180008598
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180008598
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180008598
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180008598
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x180008598
mov rax, qword [0x180102bc0]
test rax, rax
je 0x180008535
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x180008598
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x180008585
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180102bc0]
test rax, rax
je 0x18000857a
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800085a1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x180008593
mov qword [rsi], rbp
mov rax, rdi
jmp 0x1800085a3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18000b180
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1800ff028]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0xf8]
mov r8, rdx
mov qword [rsp + 0x20], rdx
mov r9, rcx
movsxd rdx, dword [rcx + 0xf0]
mov r10d, 8
mov ebx, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x20]
not ebx
movzx eax, byte [rdx]
inc rdx
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1800c3d00]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x18000b1bf
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x1210], ebx
jne 0x18000b1f6
lea edx, [r10 + 0xc]
mov ecx, ebx
call fcn.18001b728
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009c930
add rsp, 0x30
pop rbx
ret
Function at 0x18000b20c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1800ff028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, dword [rcx + 0xf0]
mov r11d, 4
mov rax, qword [rcx + 0xf8]
mov r9, rcx
mov dword [rsp + 0x20], edx
mov r10d, r11d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x20]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1800c3d00]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x18000b24b
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x1210], ebx
jne 0x18000b285
movsxd r8, edx
mov ecx, ebx
mov edx, r11d
call fcn.18001b728
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009c930
add rsp, 0x30
pop rbx
ret

Function at 0x18000b29c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1800ff028]
xor rax, rsp
mov qword [rsp + 0x10], rax
movss xmm2, dword [rcx + 0x110]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x114]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xf8]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xf0]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x1800c3d00]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x18000b319
not r8d
mov eax, r8d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.18009c930
add rsp, 0x28
ret
Function at 0x18001a420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x2f40], 0
lea rbx, [rcx + 0x2f48]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18001a4b9
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x18001a471
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001c650
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.180008e2c
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x2f40]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x180102bb8]
movsxd r8, eax
mov rax, qword [rdi + 0x2f50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18001a4c1
mov rcx, rbx
call fcn.180008e2c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001ab7c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180102bc0]
mov rbx, rcx
and dword [rax + 0x2ea4], 0
test rcx, rcx
je 0x18001abe5
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.18001abf0
lea rdx, [0x1800e435c]
mov rcx, rbx
mov rdi, rax
call fcn.18000836c
mov rbx, rax
test rax, rax
je 0x18001abe5
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180037f00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1800ff028]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
jne 0x180037f31
lea rcx, str.Tried_getting_virtual_function_from_a_null_class._n
call fcn.1800066e8
jmp 0x180037f4e
mov rax, qword [rcx]
test rax, rax
jne 0x180037f42
lea rcx, str.Tried_getting_virtual_function_from_a_null_vtable._n
jmp 0x180037f2a
mov rdx, qword [rax + 0x480]
test rdx, rdx
jne 0x180037f70
lea rcx, str.Tried_calling_a_null_virtual_function._n
call fcn.1800066e8
mov rcx, rdi
call fcn.1800403f8
test al, al
je 0x180037f80
mov eax, 2
jmp 0x180038010
call rdx
test al, al
je 0x180037f5a
mov eax, 1
jmp 0x180038010
mov qword [rsp + 0x20], rbx
test rdi, rdi
jne 0x180037f98
lea rcx, str.Tried_getting_virtual_function_from_a_null_class._n
call fcn.1800066e8
jmp 0x180037fb5
mov rax, qword [rdi]
test rax, rax
jne 0x180037fa9
lea rcx, str.Tried_getting_virtual_function_from_a_null_vtable._n
jmp 0x180037f91
mov r8, qword [rax + 0x110]
test r8, r8
jne 0x180037fc3
lea rcx, str.Tried_calling_a_null_virtual_function._n
call fcn.1800066e8
jmp 0x180037fce
lea rdx, [rsp + 0x20]
mov rcx, rdi
call r8
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x18003800e
mov rax, qword [rax + 8]
test rax, rax
je 0x18003800e
cmp byte [rax], bl
je 0x18003800e
movsx ecx, byte [rax]
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
lea rcx, [rax + 1]
call fcn.18003c824
cmp eax, 0x94f0c692
mov ecx, 3
cmove ebx, ecx
mov eax, ebx
jmp 0x180038010
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009c930
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18003c824
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
cmp byte [rcx], 0
je 0x18003c842
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
call fcn.18003c824
mov edx, eax
mov eax, edx
add rsp, 0x28
ret