joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c1ad0
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
mov r11, rdx
movabs rax, 0xcbf29ce484222325
xor r9, rax
movzx eax, byte [r8 + 1]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
mov r9, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r9
je 0x1800c1b5c
mov ecx, dword [r8]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x1800c1b5e
cmp rax, rdx
je 0x1800c1b5c
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1800c1b40
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
xor eax, eax
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret

Function at 0x1800c5990
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x30
mov rbx, qword [rcx + 8]
mov r14, rcx
sub rbx, qword [rcx]
sar rbx, 2
lea eax, [rbx - 1]
movsxd rdi, eax
test eax, eax
jle 0x1800c5a55
mov ecx, dword [0x18019362c]
mov rax, qword gs:[0x58]
mov qword [rsp + 0x50], rbp
lea rbp, [0x180192160]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r15
mov rsi, qword [rax + rcx*8]
movaps xmmword [rsp + 0x20], xmm6
movsd xmm6, qword [0x18016fe50]
mov r15d, 0x54
mov eax, dword [rsi + r15]
cmp dword [0x1801934e8], eax
jg 0x1800c5a5e
mov rcx, rbp
call fcn.1800d9bc0
mov rdx, qword [r14]
xorps xmm1, xmm1
mov eax, eax
movd xmm0, ebx
dec ebx
cvtdq2pd xmm0, xmm0
mov ecx, dword [rdx + rdi*4]
cvtsi2sd xmm1, rax
mulsd xmm1, xmm6
mulsd xmm1, xmm0
cvttsd2si eax, xmm1
movsxd r8, eax
mov eax, dword [rdx + r8*4]
mov dword [rdx + rdi*4], eax
dec rdi
mov dword [rdx + r8*4], ecx
test rdi, rdi
jg 0x1800c59f1
movaps xmm6, xmmword [rsp + 0x20]
mov r15, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
lea rcx, [0x1801934e8]
call fcn.18016379c
cmp dword [0x1801934e8], 0xffffffff
jne 0x1800c59fd
mov edx, 0x2a
mov dword [0x1801934e4], 0xffffffff
mov dword [0x180192164], 0x2a
lea ecx, [rdx - 0x29]
nop
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rbp + rcx*4 + 4], edx
inc rcx
cmp rcx, 0x270
jb 0x1800c5a90
lea rcx, [0x1801934e8]
mov dword [0x180192160], 0x270
call fcn.180163734
jmp 0x1800c59fd
Function at 0x1800d9bc0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1800d9c21
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1800d9be0
mov ecx, dword [r10]
jmp 0x1800d9d0a
cmp ecx, 0x4e0
jb 0x1800d9d0a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1800d9c40
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1800d9c90
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800fe0b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180190240]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800fe183
cmp byte [rcx + 0x71], 0
je 0x1800fe183
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800fe17f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800fe144
sub eax, 1
je 0x1800fe148
cmp eax, 2
jne 0x1800fe17f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180163c20
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800fe176
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800fe17f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1800fe12c
xor al, al
jmp 0x1800fe12c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180163c20
add rsp, 0x60
pop rbx
ret
Function at 0x180103ae0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180103c91
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1800fd8b0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180103c56
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180103bd0
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180103c45
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x180103c0d
mov r8, qword [rax]
cmp r8, rcx
je 0x180103c07
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180103c45
cmp r9, rax
je 0x180103c21
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x180103c6b
cmp r9, rax
jne 0x180103c12
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180103b80
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x180103c45
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x18011da80
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
mov r11, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
mov r9, qword [r10 + 8]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rcx, qword [rdx + 8]
cmp rcx, r9
je 0x18011db01
mov eax, dword [r11]
mov r8, qword [rdx]
cmp eax, dword [rcx + 0x10]
je 0x18011db03
cmp rcx, r8
je 0x18011db01
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x18011daf1
jmp 0x18011db03
xor ecx, ecx
test rcx, rcx
je 0x18011db5e
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x18011db29
cmp rax, rcx
jne 0x18011db1f
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x18011db34
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x18011db34
cmp rax, rcx
jne 0x18011db34
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call sub.FactoryServer_Core.dll_public:_static_void___cdecl_FMemory::Free_void____ptr64_
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x1801508e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp qword [rdx + 0x10], rax
jae 0x180150919
mov rax, rdi
mov rdi, r14
mov r14, rax
mov rax, qword [rdi + 0x10]
cmp qword [r14 + 0x10], rax
jb 0x180150901
mov qword [rsp + 0x58], r14
mov rax, qword [r8]
cmp rax, qword [r8 + 8]
je 0x180150926
mov qword [r8 + 8], rax
mov rdx, qword [rdi + 0x10]
mov rcx, rsi
cmp qword [r14 + 0x10], rdx
cmovb rdx, qword [r14 + 0x10]
call fcn.1800aa580
mov rdi, qword [rdi + 8]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x180150ae1
mov qword [rsp + 0x50], rbp
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], r12
movabs r9, 0x3fffffffffffffff
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x20], r15
mov ebp, dword [rbx + 0x10]
movabs rcx, 0xcbf29ce484222325
mov eax, ebp
shr eax, 8
movzx edx, al
movzx eax, bpl
xor rax, rcx
imul rax, r8
xor rdx, rax
mov eax, ebp
shr eax, 0x10
movzx ecx, al
mov eax, ebp
shr rax, 0x18
imul rdx, r8
xor rcx, rdx
imul rcx, r8
xor rcx, rax
imul rcx, r8
and rcx, qword [r14 + 0x30]
shl rcx, 4
add rcx, qword [r14 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r14 + 8]
je 0x1801509e4
mov rcx, qword [rcx]
cmp ebp, dword [rax + 0x10]
je 0x1801509e6
cmp rax, rcx
je 0x1801509e4
mov rax, qword [rax + 8]
cmp ebp, dword [rax + 0x10]
jne 0x1801509d4
jmp 0x1801509e6
xor eax, eax
test rax, rax
je 0x180150ac1
mov r14, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
cmp r14, rcx
je 0x180150a09
mov dword [r14], ebp
add qword [rsi + 8], 4
jmp 0x180150abc
mov rax, qword [rsi]
mov r15, r14
sub r15, rax
sar r15, 2
cmp r15, r9
je 0x180150aeb
sub rcx, rax
lea r8, [r15 + 1]
sar rcx, 2
mov rax, r9
mov rdx, rcx
shr rdx, 1
sub rax, rdx
cmp rcx, rax
jbe 0x180150a40
mov r12, r9
jmp 0x180150a4b
lea r12, [rdx + rcx]
cmp r12, r8
cmovb r12, r8
mov rdx, r12
mov rcx, rsi
call fcn.18010b300
mov r13, rax
mov rcx, rax
mov dword [rax + r15*4], ebp
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
cmp r14, r8
jne 0x180150a71
sub r8, rdx
jmp 0x180150a91
mov r8, r14
sub r8, rdx
call sub.VCRUNTIME140.dll_memmove
mov r8, qword [rsi + 8]
lea rcx, [r15*4 + 4]
add rcx, r13
mov rdx, r14
sub r8, r14
call sub.VCRUNTIME140.dll_memmove
mov r9, r12
lea r8, [r15 + 1]
mov rdx, r13
mov rcx, rsi
call fcn.180056e50
movabs r9, 0x3fffffffffffffff
movabs r8, 0x100000001b3
mov r14, qword [rsp + 0x58]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x180150973
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
call fcn.180059960
int3
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140018700]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x140018710]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.140015520
jmp 0x14000123c
mov rax, qword [0x140018710]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x140018710]
mov dword [rax], 1
mov rax, qword [0x140018750]
mov rdx, rax
mov rax, qword [0x140018740]
mov rcx, rax
call sub.ucrtbase.dll__initterm
jmp 0x14000123c
mov dword [0x14001d024], 1
mov rax, qword [0x140018710]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x140018730]
mov rdx, rax
mov rax, qword [0x140018720]
mov rcx, rax
call sub.ucrtbase.dll__initterm
mov rax, qword [0x140018710]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140018700]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x140018650]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x140018650]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.1400147a8
mov rax, qword [0x140018790]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x1400186f0]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.ucrtbase.dll__set_invalid_parameter_handler
call fcn.140013fa0
mov eax, dword [0x14001d004]
lea rdx, [0x14001d008]
mov ecx, eax
call fcn.14000147c
call fcn.140013d37
mov rax, qword [0x140018680]
mov rax, qword [rax]
mov rdx, qword [0x14001d010]
mov qword [rax], rdx
mov rcx, qword [0x14001d010]
mov rdx, qword [0x14001d008]
mov eax, dword [0x14001d004]
mov r8, rcx
mov ecx, eax
call fcn.14000f530
mov dword [0x14001d01c], eax
mov eax, dword [0x14001d020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14001d01c]
mov ecx, eax
call sub.ucrtbase.dll_exit
mov eax, dword [0x14001d024]
test eax, eax
jne 0x14000136c
call sub.ucrtbase.dll__cexit
mov eax, dword [0x14001d01c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400186b0]
mov dword [rax], 1
mov rax, qword [0x1400186c0]
mov dword [rax], 1
mov rax, qword [0x1400186d0]
mov dword [rax], 1
mov rax, qword [0x140018670]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400016e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
movabs rdx, 0x27d4eb2f165667c5
mov r10, rcx
lea rcx, [rcx + 0x28]
mov r9d, dword [r10 + 0x48]
mov r8, qword [r10 + 0x18]
mov r11, qword [r10]
add r9, rcx
add rdx, r8
cmp r11, 0x1f
jbe 0x1400017bd
mov rbx, qword [r10 + 0x10]
mov rdx, qword [r10 + 8]
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, qword [r10 + 0x20]
mov rsi, rbx
imul rbx, rdi
mov rbp, rdx
rol rdx, 1
rol rsi, 7
imul rbp, rdi
add rdx, rsi
mov rsi, r8
rol rsi, 0xc
imul r8, rdi
add rdx, rsi
mov rsi, rax
rol rbp, 0x1f
rol rsi, 0x12
imul rax, rdi
add rdx, rsi
rol r8, 0x1f
movabs rsi, 0x9e3779b185ebca87
imul rbp, rsi
imul r8, rsi
xor rdx, rbp
mov rbp, rbx
movabs rbx, 0x85ebca77c2b2ae63
imul rdx, rsi
rol rbp, 0x1f
imul rbp, rsi
add rdx, rbx
xor rdx, rbp
imul rdx, rsi
add rdx, rbx
xor r8, rdx
mov rdx, rax
imul r8, rsi
rol rdx, 0x1f
imul rdx, rsi
lea rax, [r8 + rbx]
xor rdx, rax
imul rdx, rsi
add rdx, rbx
lea rsi, [r10 + 0x30]
add rdx, r11
cmp r9, rsi
jb 0x140001829
movabs rbx, 0xc2b2ae3d27d4eb4f
mov rcx, rsi
movabs r8, 0x9e3779b185ebca87
movabs r11, 0x85ebca77c2b2ae63
nop word [rax + rax]
mov rax, qword [rcx - 8]
add rcx, 8
imul rax, rbx
rol rax, 0x1f
imul rax, r8
xor rax, rdx
rol rax, 0x1b
imul rax, r8
lea rdx, [rax + r11]
cmp r9, rcx
jae 0x1400017f0
mov rax, r9
sub rax, r10
lea rcx, [rax - 0x30]
and rcx, 0xfffffffffffffff8
add rcx, rsi
lea r8, [rcx + 4]
cmp r9, r8
jb 0x140001867
mov eax, dword [rcx]
movabs rcx, 0x9e3779b185ebca87
imul rax, rcx
mov rcx, r8
xor rax, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
rol rax, 0x17
imul rax, rdx
movabs rdx, 0x165667b19e3779f9
add rdx, rax
cmp rcx, r9
jae 0x14000189e
movabs r10, 0x27d4eb2f165667c5
movabs r8, 0x9e3779b185ebca87
movzx eax, byte [rcx]
add rcx, 1
imul rax, r10
xor rax, rdx
rol rax, 0xb
imul rax, r8
mov rdx, rax
cmp r9, rcx
jne 0x140001880
mov rax, rdx
shr rax, 0x21
xor rax, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
imul rax, rdx
mov rdx, rax
shr rdx, 0x1d
xor rax, rdx
movabs rdx, 0x165667b19e3779f9
imul rax, rdx
mov rdx, rax
shr rdx, 0x20
xor rax, rdx
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x140007820
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.ucrtbase.dll_puts
mov ecx, 2
call sub.ucrtbase.dll_exit
nop
nop word cs:[rax + rax]
nop
Function at 0x14000f400
Capabilities:
Create directory
Extract resource via kernel32 functions

Disassembly:
push rdi
mov eax, 0x2020
push rsi
push rbx
call fcn.1400152d0
sub rsp, rax
mov eax, dword [0x14002c160]
mov rsi, rcx
test eax, eax
je 0x14000f498
xor ebx, ebx
lea rdi, [0x14002a160]
test eax, eax
jg 0x14000f43c
jmp 0x14000f450
add rbx, 1
cmp dword [0x14002c160], ebx
jle 0x14000f450
mov rdx, qword [rdi + rbx*8]
mov rcx, rsi
call sub.ucrtbase.dll_wcscmp
test eax, eax
jne 0x14000f430
jmp 0x14000f483
mov rcx, rsi
call sub.ucrtbase.dll_wcslen
cmp rax, 2
jne 0x14000f465
cmp word [rsi + 2], 0x3a
je 0x14000f483
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000f4e8
movsxd rbx, dword [0x14002c160]
cmp ebx, 0x3ff
jle 0x14000f500
mov eax, 1
add rsp, 0x2020
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rbx, str._HOME_
mov rdx, rbx
mov rcx, rdi
call fcn.1400078b0
test al, al
je 0x14000f522
movsxd rbx, dword [0x14002c160]
mov rcx, rdi
lea rdi, [0x14002a160]
call sub.ucrtbase.dll__wcsdup
mov qword [rdi + rbx*8], rax
mov eax, dword [0x14002c160]
add eax, 1
mov dword [0x14002c160], eax
jmp 0x14000f41d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000f474
xor eax, eax
jmp 0x14000f488
mov rcx, rsi
call sub.ucrtbase.dll__wcsdup
add dword [0x14002c160], 1
mov rdx, rax
lea rax, [0x14002a160]
mov qword [rax + rbx*8], rdx
jmp 0x14000f483
mov rcx, rbx
call fcn.140007860
nop
nop dword [rax + rax]
Function at 0x14000fc00
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rbx, qword [0x1400187e0]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000fc3a
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14000fc60
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x1400187f0]
cmp byte [rax], 0
jne 0x14000fc70
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rbx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14000fc31
mov edx, 0x414
lea r12, [rsp + 0x20]
mov rdi, qword [0x140018800]
lea rsi, [0x140018240]
movq xmm0, rsi
mov dword [rsp + 0x28], 3
mov rcx, r12
mov rbp, qword [sym.imp.SHELL32.dll_SHFileOperationW]
movq xmm6, rdi
mov word [rsp + 0x40], dx
mov ebx, 0x14
punpcklqdq xmm6, xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
mov r13, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000fd44
test al, 0x10
je 0x14000fc46
mov ecx, 0x64
call r14
mov eax, 0x414
mov qword [rsp + 0x50], rsi
mov rcx, r12
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
movaps xmmword [rsp + 0x30], xmm6
call rbp
sub ebx, 1
je 0x14000fc46
mov rcx, rdi
call r13
cmp eax, 0xffffffff
jne 0x14000fcf0
jmp 0x14000fc46

Function at 0x140013fb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.ucrtbase.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.140015310
call sub.ucrtbase.dll_abort
nop