joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7aa5e6a50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x7ff7aa719aa0]
movsxd rcx, dword [rcx + 0xf0]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0xf8]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x3f20], ebx
jne 0x7ff7aa5e6ae4
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.7ff7aa5fb040
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff7aa5e6b00
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x110]
lea r10, [0x7ff7aa719aa0]
mov rax, qword [rcx + 0xf8]
movss xmm1, dword [rcx + 0x114]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xf0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x7ff7aa5ea440
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x7ff7aa7eaac0]
movzx esi, r9b
mov r12d, dword [rsp + 0x90]
mov r15d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x3ed8]
mov eax, dword [rbx + 0x14]
movss xmm2, dword [rbx + 0x250]
and eax, 4
movss xmm3, dword [rbx + 0x254]
or eax, 0x1000103
or r12d, eax
cmp qword [rbx + 0x1a8], 0
jne 0x7ff7aa5ea4aa
cmp qword [rdi + 0x4b38], 0
je 0x7ff7aa5ea4b2
movss xmm2, dword [rbx + 0x220]
cvttss2si eax, dword [r8]
subss xmm2, dword [rbx + 0x100]
subss xmm3, dword [rbx + 0x104]
xorps xmm5, xmm5
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm5
cvtdq2ps xmm0, xmm0
jp 0x7ff7aa5ea4ec
jne 0x7ff7aa5ea4ec
mov eax, 1
jmp 0x7ff7aa5ea4ee
xor eax, eax
ucomiss xmm0, xmm5
jp 0x7ff7aa5ea4fd
jne 0x7ff7aa5ea4fd
mov r14d, 2
jmp 0x7ff7aa5ea500
xor r14d, r14d
movss xmm4, dword [0x7ff7aa72d698]
or r14d, eax
comiss xmm5, xmm1
jb 0x7ff7aa5ea51b
addss xmm2, xmm1
movaps xmm1, xmm2
maxss xmm1, xmm4
comiss xmm5, xmm0
jb 0x7ff7aa5ea52b
addss xmm3, xmm0
movaps xmm0, xmm3
maxss xmm0, xmm4
or dword [rdi + 0x47b8], 2
xor edx, edx
movss dword [rdi + 0x47d8], xmm1
movss dword [rdi + 0x47dc], xmm0
mov dword [rdi + 0x47c0], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x7ff7aa5ea574
mov dword [rsp + 0x28], r15d
lea r8, [0x7ff7aa722db8]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.7ff7aa5e3240
jmp 0x7ff7aa5ea58a
lea r8, [0x7ff7aa722db0]
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x70]
call fcn.7ff7aa5e3240
movss xmm6, dword [rdi + 0x37f8]
test sil, sil
jne 0x7ff7aa5ea5a1
mov dword [rdi + 0x37f8], 0
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
xor edx, edx
call fcn.7ff7aa5ed2e0
mov rsi, qword [rdi + 0x3ed8]
movzx ebp, al
movss dword [rdi + 0x37f8], xmm6
cmp word [rsi + 0xc2], 1
mov dword [rsi + 0x80], r15d
mov byte [rsi + 0xd2], r14b
jne 0x7ff7aa5ea5e7
movsd xmm0, qword [rsi + 0x20]
movsd qword [rbx + 0x100], xmm0
mov r9d, r15d
lea rdx, [0x7ff7aa722da9]
not r9d
lea r10, [0x7ff7aa719aa0]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x7ff7aa5ea614
cmp byte [rdx], r8b
jne 0x7ff7aa5ea614
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x7ff7aa5ea601
not ebx
cmp dword [rdi + 0x3f38], ebx
jne 0x7ff7aa5ea644
xor edx, edx
xor ecx, ecx
call fcn.7ff7aa5e6cf0
cmp dword [rdi + 0x48d0], r15d
jne 0x7ff7aa5ea691
bt r12d, 0x17
jb 0x7ff7aa5ea691
cmp word [rsi + 0x15c], 0
jne 0x7ff7aa5ea667
cmp byte [rsi + 0x162], 0
je 0x7ff7aa5ea691
xor edx, edx
mov rcx, rsi
call fcn.7ff7aa5ef7b0
xor edx, edx
mov rcx, rsi
call fcn.7ff7aa5f5e00
mov rdx, rsi
mov ecx, ebx
call fcn.7ff7aa5e6cf0
mov eax, dword [rdi + 0x48f4]
mov dword [rdi + 0x3f60], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x7ff7aa5f3c50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff7aa74f840]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x7ff7aa7eaac0]
mov edi, ecx
cmp byte [rbx + 0x4a81], 0
jne 0x7ff7aa5f3cb1
cmp byte [rbx + 0x4a82], 0
jne 0x7ff7aa5f3cb1
movsx r9d, word [rbx + 0x5bb2]
lea r8, [0x7ff7aa723510]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff7aa5e31c0
test dil, 2
je 0x7ff7aa5f3ddf
jmp 0x7ff7aa5f3d3c
movss xmm1, dword [rbx + 0x3894]
lea r8, [0x7ff7aa723510]
movsx r9d, word [rbx + 0x5bb2]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x7ff7aa72d6e8]
mov edx, 0x10
mulss xmm1, dword [0x7ff7aa72d6d4]
addss xmm0, dword [rbx + 0xe00]
addss xmm1, dword [rbx + 0xe04]
mov qword [rbx + 0x47d0], rax
mov dword [rbx + 0x47bc], 1
movss dword [rbx + 0x47c8], xmm0
movss dword [rbx + 0x47cc], xmm1
movss xmm0, dword [rbx + 0x38f0]
mulss xmm0, dword [0x7ff7aa72d57c]
or dword [rbx + 0x47b8], 0x41
movss dword [rbx + 0x4818], xmm0
call fcn.7ff7aa5e31c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x7ff7aa5f3d90
lea r11, [0x7ff7aa719aa0]
nop dword [rax]
cmp r9b, 0x23
jne 0x7ff7aa5f3d73
cmp byte [r8], r9b
jne 0x7ff7aa5f3d73
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff7aa5f3d60
not ecx
call fcn.7ff7aa5eab80
test rax, rax
je 0x7ff7aa5f3ddf
cmp byte [rax + 0xb6], 0
je 0x7ff7aa5f3ddf
mov byte [rax + 0xbb], 1
lea r8, [0x7ff7aa723510]
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bb2]
movsx r9d, word [rbx + 0x5bb2]
call fcn.7ff7aa5e31c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.7ff7aa5ed2e0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.7ff7aa6d76b0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x7ff7aa5f9950
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca0], 0
lea rbx, [rcx + 0x5ca8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x7ff7aa5f99f7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x7ff7aa5f99aa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.7ff7aa5fbbf0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.7ff7aa5e3da0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x7ff7aa7eaa54]
cmovne rcx, rax
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x7ff7aa5f99ff
mov rcx, rbx
call fcn.7ff7aa5e3da0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff7aa5f9e80
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x7ff7aa7eaac0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x7ff7aa5f9ee3
mov qword [rsp], rbx
lea rbx, [0x7ff7aa719aa0]
nop dword [rax]
cmp r9b, 0x23
jne 0x7ff7aa5f9ec3
cmp byte [r8], r9b
jne 0x7ff7aa5f9ec3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x7ff7aa5f9eb0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c10]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x7ff7aa5f9f17
mov r10, qword [r10 + 0x5c18]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x7ff7aa5f9f1e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x7ff7aa5f9f04
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x7ff7aa6128e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x7ff7aa7eaac0]
mov r10, rcx
mov r9, qword [rcx + 0x180]
movsxd rax, edx
imul rbx, rax, 0x70
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x74], edx
test dword [rbx], 0x10000
movss xmm1, dword [rbx + 0x34]
je 0x7ff7aa612923
addss xmm1, dword [rcx + 0x8c]
lea rsi, [r9 + 0x100]
movss dword [rsi], xmm1
movss xmm0, dword [rcx + 0xc0]
addss xmm0, dword [rcx + 0x7c]
movss dword [r9 + 0x118], xmm1
subss xmm1, dword [r9 + 0x20]
movss dword [r9 + 0x104], xmm0
subss xmm1, dword [r9 + 0x144]
movss dword [r9 + 0x148], xmm1
mov eax, dword [rcx + 0x88]
mov dword [r9 + 0x138], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x158], eax
movss dword [r9 + 0x21c], xmm0
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x218], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x220], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1bc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xbb], al
cmp byte [rbx + 0x68], 0
je 0x7ff7aa6129c3
xor eax, eax
mov dword [rdi + 0x4778], eax
mov dword [rdi + 0x4780], eax
test dword [rcx + 4], 0x100000
je 0x7ff7aa6129d7
mov r8d, 2
jmp 0x7ff7aa612a57
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x298]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x238], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x298]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x298]
mov rcx, qword [r10 + 0x198]
call fcn.7ff7aa606bb0
cmp byte [rdi + 0x5c98], 0
je 0x7ff7aa612a95
cmp byte [rbx + 0x68], 0
jne 0x7ff7aa612a95
xor r8d, r8d
lea rdx, [0x7ff7aa7241b8]
mov rcx, rsi
call fcn.7ff7aa5f9a60
mov dword [rdi + 0x5cc8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff7aa6153c0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x7ff7aa7eaac0]
mov rdx, qword [rax + 0x4b38]
cmp ecx, 0xffffffff
jne 0x7ff7aa6153da
cmp dword [rdx + 0x74], ecx
cmovne ecx, dword [rdx + 0x74]
cmp ecx, dword [rdx + 0x6c]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x7ff7aa615459
mov r10d, dword [rdx]
lea r8, [0x7ff7aa7241a9]
movzx eax, word [rdx + 0x78]
lea r11, [0x7ff7aa719aa0]
not r10d
mov word [rdx + 0x210], cx
mov ecx, r10d
mov byte [rdx + 0x227], 1
mov word [rdx + 0x7a], ax
mov r9b, 0x23
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x7ff7aa615433
cmp byte [r8], r9b
jne 0x7ff7aa615433
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff7aa615420
not ecx
xor edx, edx
jmp fcn.7ff7aa5f3f60
ret
Function at 0x7ff7aa62e300
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x7ff7aa62e3c5
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x7ff7aa62e3c5
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x7ff7aa62e3de
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x7ff7aa62e3b5
cmp byte [rcx], 0x5c
jne 0x7ff7aa62e3ae
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x7ff7aa62e3ae
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x7ff7aa62e39c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x7ff7aa62e3ab
test r8b, 0x10
jne 0x7ff7aa62e3ae
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x7ff7aa62e3ae
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.7ff7aa62cc00
test edi, edi
jne 0x7ff7aa62e320
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.7ff7aa62cbf0
int3
Function at 0x7ff7aa640de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov eax, 1
mov qword [rsp + 0x38], rsi
mov r11, rcx
mov rdi, rdx
movzx ecx, byte [rdx + 0xb]
shl eax, cl
cmp byte [rdx + 0xa], 0
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
jge 0x7ff7aa640e40
mov ecx, dword [rdx + 0xc]
lea eax, [rcx - 1]
test ecx, eax
je 0x7ff7aa640e40
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
jmp 0x7ff7aa640e43
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x7ff7aa640e7e
mov qword [rsp + 0x30], rbx
xor r10d, r10d
mov ebx, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x7ff7aa640e6f
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x7ff7aa640e6f
mov rcx, r11
call fcn.7ff7aa640a00
add r10, 0x10
sub rbx, 1
jne 0x7ff7aa640e51
mov rbx, qword [rsp + 0x30]
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x7ff7aa640ee0
nop word [rax + rax]
movzx eax, byte [r10 + 9]
and al, 0x40
test byte [r10 + 8], 0xf
jne 0x7ff7aa640ea9
test al, al
je 0x7ff7aa640ed7
mov byte [r10 + 9], 0xb
jmp 0x7ff7aa640ed7
test al, al
je 0x7ff7aa640ebf
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x7ff7aa640ebf
mov rcx, r11
call fcn.7ff7aa640a00
test byte [r10 + 8], 0x40
je 0x7ff7aa640ed7
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x7ff7aa640ed7
mov rcx, r11
call fcn.7ff7aa640a00
add r10, 0x18
cmp r10, rsi
jb 0x7ff7aa640e90
movzx eax, byte [rdi + 9]
mov rsi, qword [rsp + 0x38]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x7ff7aa640f17
mov rcx, rdi
call fcn.7ff7aa640970
mov rcx, qword [r11 + 0x90]
mov qword [rax], rcx
mov qword [r11 + 0x90], rdi
and byte [rdi + 9], 0xc7
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x7ff7aa640f21
xor al, 2
mov byte [rdi + 9], al
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7aa64c1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x80], rbx
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rdx
call qword [sym.imp.ucrtbase.dll_localeconv]
xor esi, esi
lea r11, [0x7ff7aa71e410]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x7ff7aa64c24f
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x7ff7aa64c240
mov qword [rsp + 0x30], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x7ff7aa64c266
mov r12d, ebp
jmp 0x7ff7aa64c270
cmp byte [rbx], 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x80]
jne 0x7ff7aa64c3c9
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x7ff7aa64c3c9
movsd xmm2, qword [0x7ff7aa72d650]
lea r13, [0x7ff7aa71e410]
add rdx, 2
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x7ff7aa64c2cb
test edi, edi
jne 0x7ff7aa64c320
mov edi, ebp
inc rdx
jmp 0x7ff7aa64c2b0
test byte [r8 + r13 + 1], 0x10
je 0x7ff7aa64c320
test r10d, r10d
jne 0x7ff7aa64c2e3
cmp r8b, 0x30
jne 0x7ff7aa64c2e3
inc r14d
jmp 0x7ff7aa64c314
inc r10d
cmp r10d, 0x1e
jg 0x7ff7aa64c311
test byte [rcx + r13 + 1], 2
je 0x7ff7aa64c2f9
add ecx, 0xffffffd0
jmp 0x7ff7aa64c2ff
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x7ff7aa64c314
inc r9d
test edi, edi
je 0x7ff7aa64c31b
dec r9d
inc rdx
jmp 0x7ff7aa64c2b0
mov r13, qword [rsp + 0x20]
lea eax, [r14 + r10]
test eax, eax
je 0x7ff7aa64c3c9
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x7ff7aa64c3af
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x7ff7aa64c357
lea rdx, [r11 + 2]
jmp 0x7ff7aa64c361
cmp al, 0x2b
jne 0x7ff7aa64c35f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x7ff7aa71e410]
test byte [r8 + r11 + 1], 2
je 0x7ff7aa64c3c9
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x7ff7aa64c380
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x7ff7aa64c3bb
xorps xmm1, xmmword [0x7ff7aa72eee0]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.ucrtbase.dll_ldexp]
jmp 0x7ff7aa64c3cc
xorps xmm0, xmm0
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff7aa654cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
cmp r8, 0x28
ja 0x7ff7aa654cf7
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.7ff7aa654b20
movabs rax, 0x7fffffffffffffdf
cmp rbp, rax
jae 0x7ff7aa654d84
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 0x19]
mov qword [rsp + 0x38], rsi
mov r8d, 4
mov qword [rsp + 0x40], rdi
mov rdi, qword [rcx + 0x18]
mov ebx, dword [rdi + 0x60]
call fcn.7ff7aa6498c0
movzx ecx, byte [rdi + 0x64]
mov r8, rbp
and cl, 0x18
mov rdx, r14
mov rsi, rax
mov byte [rax + 9], cl
mov byte [rax + 8], 0x14
mov rcx, qword [rdi + 0x70]
mov qword [rax], rcx
lea rcx, [rax + 0x18]
mov qword [rdi + 0x70], rax
mov dword [rax + 0xc], ebx
mov byte [rax + 0xa], 0
mov byte [rax + rbp + 0x18], 0
mov qword [rax + 0x10], rbp
call sub.VCRUNTIME140.dll_memcpy
mov rdi, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.7ff7aa6497c0
int3
Function at 0x7ff7aa6775d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.ucrtbase.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x7ff7aa67d8b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x7ff7aa67d992
call fcn.7ff7aa69b460
test al, al
jne 0x7ff7aa67d992
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x7ff7aa67d8e2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.7ff7aa6a6780
test rax, rax
je 0x7ff7aa67d927
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.7ff7aa6a6780
mov rsi, rax
test rax, rax
je 0x7ff7aa67d927
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x7ff7aa67d95b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.7ff7aa693f10
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x7ff7aa67d940
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x7ff7aa68d510
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xa5e], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x7ff7aa68d5db
cmp qword [rcx + 0x270], 0
je 0x7ff7aa68d58e
mov qword [rsp + 0x40], rbx
call fcn.7ff7aa677c20
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.7ff7aa678630
mov rcx, qword [rdi + 0x1e8]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x270]
movzx edx, bl
mov rcx, rdi
call fcn.7ff7aa678630
mov rbx, qword [rsp + 0x40]
jmp 0x7ff7aa68d5db
mov ecx, esi
test edx, edx
je 0x7ff7aa68d59e
sub ecx, 1
je 0x7ff7aa68d59e
cmp ecx, 1
jne 0x7ff7aa68d5db
mov r9, qword [rdi + 0x1e0]
lea rax, [0x7ff7aa6e7488]
lea rcx, [rsi + rsi*2]
mov edx, 2
add rcx, rax
mov r8d, 1
call sub.ucrtbase.dll_fwrite
mov r9, qword [rdi + 0x1e0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.ucrtbase.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret