joyce8/EMBER2024-capa huggingface dataset:
Function at 0x210041950
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
imul rax, rax, 1
mov byte [rsp + rax + 0x200], 0x65
mov byte [rsp + 0x180], 0x40
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x200], 0x74
mov dword [rsp + 0x3b0], 0x8c14c31
mov byte [rsp + 0x181], 0x1e
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x200], 0x4d
mov dword [rsp + 0x3b4], 0xc787d34e
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x200], 0x6f
mov dword [rsp + 0x3b8], 0x59cc7ae8
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x200], 0x64
mov byte [rsp + 0x182], 4
mov byte [rsp + 0x183], 0xa9
mov byte [rsp + 0x184], 0x72
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x200], 0x75
mov byte [rsp + 0x185], 0xe3
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x200], 0x6c
mov dword [rsp + 0x3bc], 0x48f2371b
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x200], 0x65
mov byte [rsp + 0x186], 0x6f
movabs rax, 0xaa7823a25dfdb62d
mov qword [rsp + 0x5d8], rax
movabs rax, 0x188ec519eeb696b1
mov qword [rsp + 0x5e0], rax
mov dword [rsp + 0x3c0], 0x2895b8a2
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x200], 0x46
mov byte [rsp + 0x187], 0x7a
movabs rax, 0xe40a7a4166d44fb7
mov qword [rsp + 0x5e8], rax
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x200], 0x69
movabs rax, 0x2e6c8908553a739
mov qword [rsp + 0x5f0], rax
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x200], 0x6c
movabs rax, 0xb7ca6d2f647202cc
mov qword [rsp + 0x5f8], rax
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x200], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x200], 0x4e
mov byte [rsp + 0x188], 0x24
movabs rax, 0xab1b7015d5286c0e
mov qword [rsp + 0x600], rax
mov byte [rsp + 0x189], 0xed
movabs rax, 0x6842cd271de87054
mov qword [rsp + 0x608], rax
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x200], 0x61
mov byte [rsp + 0x18a], 0xc7
mov byte [rsp + 0x18b], 0xdd
movabs rax, 0x1577269253b0d436
mov qword [rsp + 0x610], rax
movabs rax, 0x683291d0f2671944
mov qword [rsp + 0x618], rax
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x200], 0x6d
mov dword [rsp + 0x3c4], 0x85bf1070
movabs rax, 0xb6477c98e3c2848f
mov qword [rsp + 0x620], rax
mov byte [rsp + 0x18c], 0x66
mov dword [rsp + 0x3c8], 0x78586a9c
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x200], 0x65
mov byte [rsp + 0x18d], 0x3e
movabs rax, 0xfe59d672dbbf04a3
mov qword [rsp + 0x628], rax
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x200], 0x41
mov dword [rsp + 0x3cc], 0x4e775f6d
mov dword [rsp + 0x3d0], 0x93630dc3
mov dword [rsp + 0x3d4], 0x1c62fc48
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x200], 0
movabs rax, 0xe113d1e64d490fc7
invalid
invalid
test byte [rax + rsi], ah
Function at 0x14000b770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14000b7a4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14000b790
ret
Function at 0x1400122d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140012492
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140012060
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140012457
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400123c3
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140012446
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x140012400
mov r10, qword [rax]
cmp r10, rcx
je 0x1400123fa
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140012446
mov r8, rax
cmp r10, rax
je 0x140012422
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x14001246c
cmp r10, rax
jne 0x140012410
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140012370
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140012446
lea rcx, str.invalid_hash_bucket_count
call fcn.140066f50
int3
Function at 0x140014ba0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1400f5608]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
movzx edx, byte [rcx + 0x130]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r8, 0x100000001b3
imul rdx, r8
movzx eax, byte [rcx + 0x131]
xor rdx, rax
imul rdx, r8
movzx eax, byte [rcx + 0x132]
xor rdx, rax
imul rdx, r8
movzx eax, byte [rcx + 0x133]
xor rdx, rax
imul rdx, r8
mov r8, qword [rcx + 0x168]
and rdx, r8
mov r10, qword [rcx + 0x150]
add rdx, rdx
mov rax, qword [r10 + rdx*8 + 8]
mov r9, qword [rcx + 0x140]
cmp rax, r9
je 0x140014c7b
mov rdx, qword [r10 + rdx*8]
mov ecx, dword [rcx + 0x130]
cmp ecx, dword [rax + 0x10]
je 0x140014c46
cmp rax, rdx
je 0x140014c7b
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140014c38
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x140014c7b
mov rcx, qword [rax + 0x50]
test rcx, rcx
je 0x140014d30
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008bad0
add rsp, 0x70
pop rbx
ret
movabs rax, 0x4d25767f9dce13f5
and r8, rax
add r8, r8
mov rax, qword [r10 + r8*8 + 8]
cmp rax, r9
je 0x140014d23
mov rcx, qword [r10 + r8*8]
cmp dword [rax + 0x10], 0
je 0x140014cb2
cmp rax, rcx
je 0x140014d23
mov rax, qword [rax + 8]
cmp dword [rax + 0x10], 0
jne 0x140014ca3
test rax, rax
je 0x140014d23
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov r8, qword [rax + 0x50]
test r8, r8
je 0x140014cdc
mov rax, qword [r8]
lea rdx, [rsp + 0x20]
mov rcx, r8
call qword [rax]
mov rcx, rax
mov qword [rsp + 0x58], rax
test rcx, rcx
je 0x140014d1d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140014c68
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14008bad0
add rsp, 0x70
pop rbx
ret
call fcn.140066f0c
nop
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.140066f74
int3
call fcn.140066f0c
int3
Function at 0x14001db70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
movzx eax, byte [rcx + 0x10]
nop
test al, al
jne 0x14001dc0e
xor eax, eax
xchg byte [rcx + 0x11], al
add rcx, 0x18
mov rdx, r8
call fcn.14001d980
mov qword [rbx + 0x58], rdi
mov ecx, reloc.WS2_32.dll_recv
call fcn.14008b48c
test rax, rax
je 0x14001dbbf
mov qword [rax], rbx
lea rcx, [0x14001dc70]
mov qword [rax + 8], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14001d8d0]
xor edx, edx
xor ecx, ecx
call fcn.140095404
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001dc1f
cmp dword [rbx + 8], 0
jne 0x14001dc19
movaps xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
movups xmmword [rbx], xmm0
mov eax, 1
xchg byte [rbx + 0x10], al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.1400935e8
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.14006820c
int3
Function at 0x1400222f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rsi, rcx
mov rcx, qword [rcx + 8]
movzx edx, r8w
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rsi + 8]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rsi + 8]
mov rdx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [r14 + 8], eax
mov rax, r14
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x1400255f0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x1400f5608]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rdx
mov rbp, rcx
mov rbx, 0xffffffffffffffff
mov r14d, 0x104
test rcx, rcx
je 0x14002568d
mov rdx, rcx
mov r8d, r14d
lea rcx, [rsp + 0x20]
call fcn.140095500
lea rcx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x140025642
test rax, rax
je 0x140025670
movzx ecx, byte [rsp + rax + 0x1f]
cmp cl, 0x2f
je 0x14002565f
cmp cl, 0x5c
jne 0x140025670
dec rax
cmp rax, r14
jae 0x14002579f
mov byte [rsp + rax + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14002568d
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
movzx eax, byte [rsi]
test al, al
je 0x140025775
mov qword [rsp + 0x280], rdi
mov rcx, rsi
mov rdi, rsi
cmp al, 0x2f
je 0x1400256ae
cmp al, 0x5c
jne 0x1400256b1
mov rdi, rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x1400256a6
cmp rdi, rsi
je 0x1400256ef
sub rdi, rsi
lea rcx, [rsp + 0x20]
mov r8, rdi
mov rdx, rsi
call fcn.14008d5b0
cmp rdi, r14
jae 0x140025799
lea rdx, [rsp + 0x20]
mov byte [rsp + rdi + 0x20], 0
mov rcx, rbp
call fcn.1400255f0
mov byte [rsp + 0x130], 0
test rbp, rbp
je 0x14002570f
mov r8, r14
lea rcx, [rsp + 0x130]
mov rdx, rbp
call fcn.140095500
mov byte [rsp + 0x233], 0
lea rax, [rsp + 0x130]
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140025720
sub r14, rbx
lea rcx, [rsp + 0x130]
add rcx, rbx
mov r8, r14
mov rdx, rsi
call fcn.140095500
lea rcx, [rsp + 0x130]
mov byte [rsp + 0x233], 0
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14002576d
xor edx, edx
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdi, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14008bad0
mov rbx, qword [rsp + 0x288]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
call fcn.14008bc2c
int3
call fcn.14008bc2c
int3
Function at 0x140025f40
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push r13
push r14
sub rsp, 0x50
cmp qword [rcx], 0
mov ebp, r9d
mov r13, rdx
mov r14, rcx
jne 0x140026124
cmp dword [rcx + 8], 0xffffffff
jne 0x140026124
lea rdx, [rcx + 0x150]
mov qword [rsp + 0x70], rbx
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rax, 0xffffffffffffffff
nop dword [rax]
cmp byte [r14 + rax + 0x151], 0
lea rax, [rax + 1]
jne 0x140025f90
movzx ecx, byte [rax + r14 + 0x14f]
cmp cl, 0x5c
je 0x140025fbd
cmp cl, 0x2f
je 0x140025fbd
mov word [rax + r14 + 0x150], gethostname
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r15
cmp ebp, 1
jne 0x14002601a
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x14002602b
mov eax, 0x2000000
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
lea eax, [rbp - 2]
cmp eax, 1
jbe 0x14002602b
mov ecx, 0x10000
mov eax, ecx
jmp 0x140025ff4
xor edi, edi
xor r12b, r12b
xor r15b, r15b
mov esi, edi
cmp ebp, 1
je 0x140026083
cmp ebp, 2
jne 0x1400260a1
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14002607e
mov ecx, 0x200
mov eax, ecx
jmp 0x140025ff4
mov r15b, 1
jmp 0x140026086
mov rsi, r13
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne r12b
mov ecx, 0x30
call fcn.14008b48c
lea ecx, [rbp - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x1400260d5
mov word [rax], pe_nt_image_headers64
mov byte [rax + 0x18], dil
mov qword [rax + 0x20], r13
mov eax, dword [rsp + 0x80]
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x2c], edi
mov dword [rbx + 0x14], edi
jmp 0x140026107
mov byte [rax], 1
mov byte [rax + 0x18], r15b
mov byte [rax + 1], r12b
mov qword [rax + 8], rsi
mov byte [rax + 0x10], dil
mov dword [rax + 0x14], edi
test r12b, r12b
je 0x140026107
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
mov rcx, rbx
call fcn.1400292c0
test rax, rax
mov qword [r14], rax
mov ecx, 0x200
cmove edi, ecx
mov eax, edi
jmp 0x140025ff4
mov eax, 0x1000000
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
Function at 0x140028de0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10, r8
mov rdi, r9
imul r10d, edx
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x140028e3a
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140028e26
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x28]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x20]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call fcn.14008d5b0
add dword [rdi + 0x2c], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140028e80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x140028e8b
xor eax, eax
ret
lea r11, [0x1400c68f0]
not ecx
cmp r8d, 8
jb 0x140028f61
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140028eb0
test r8d, r8d
je 0x140028f8d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x140028f70
not ecx
mov eax, ecx
ret
Function at 0x1400290a0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400292a6
cmp dword [rcx + 0x1c], 0
je 0x1400292a6
cmp qword [rcx + 0x80], 0
je 0x1400290cf
call fcn.140028fa0
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.140029960
test eax, eax
je 0x1400290f6
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call fcn.1400954e4
mov rbx, rax
test rax, rax
jne 0x14002911c
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call fcn.1400954e4
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
test rax, rax
jne 0x140029162
mov rcx, rbx
call fcn.140091bb4
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, dword [rdi + 0x40]
mov ecx, dword [rdi + 0x38]
mov dword [rbx + 0x78], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x64], ebp
mov dword [rbx + 0x74], ebp
mov dword [rbx + 0x90], ecx
mov dword [rbx + 0x24], ebp
test ecx, ecx
je 0x1400291b1
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.140027370
test eax, eax
jne 0x1400291b1
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
movzx ecx, byte [rdi + 0x34]
mov dword [rbx + 0x7c], eax
and cl, 1
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
mov eax, dword [rdi + 0x34]
shr eax, 3
mov byte [rbx + 0x98], cl
test al, 1
je 0x1400291dd
movzx eax, byte [rdi + 0x3d]
jmp 0x1400291e1
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
neg cl
mov dword [rbx + 0x9c], 0x12345678
sbb eax, eax
mov dword [rbx + 0xa0], 0x23456789
and eax, 0xc
mov dword [rbx + 0xa4], 0x34567890
mov dword [rbx + 0xa8], eax
test rsi, rsi
je 0x14002927a
lea r8, [0x1400c68f0]
nop
movzx eax, byte [rsi]
test al, al
je 0x14002927a
mov edx, dword [rbx + 0x9c]
xor rax, rdx
movzx ecx, al
shr edx, 8
xor edx, dword [r8 + rcx*4]
mov ecx, dword [rbx + 0xa4]
movzx eax, dl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0xa0], edx
shr rdx, 0x18
xor rax, rdx
xor ecx, dword [r8 + rax*4]
mov dword [rbx + 0xa4], ecx
add rsi, 1
jne 0x140029220
mov eax, dword [rsp + 0x58]
mov ecx, dword [rdi + 0x7c]
add eax, 0x1e
add ecx, eax
mov dword [rbx + 0x10], ebp
mov rbp, qword [rsp + 0x20]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14002a370
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x14002a3c0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002a3ba
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x14002a3f7
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x14002a3d6
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x50]
mov ebp, edi
call fcn.14008d5b0
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x2c], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x14002a418
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x14002a40e
cmp byte [rbx + 0x10], 0
je 0x14002a40e
mov eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x1400372b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov rsi, rcx
mov rdx, qword [rcx]
mov r15, rbx
sub r15, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r8, 0xfffffffffffffff
cmp rax, r8
je 0x14003751f
lea r13, [rax + 1]
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r8
sub rax, rdx
cmp rcx, rax
ja 0x140037519
lea rax, [rdx + rcx]
mov r14, r13
cmp rax, r13
cmovae r14, rax
cmp r14, r8
ja 0x140037519
mov r12, r14
shl r12, 4
mov qword [rsp + 0xa8], r14
cmp r12, 0x1000
jb 0x140037373
lea rcx, [r12 + 0x27]
cmp rcx, r12
jbe 0x140037519
call fcn.14008b48c
test rax, rax
je 0x14003752b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14003739c
test r12, r12
je 0x140037392
mov rcx, r12
call fcn.14008b48c
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xa8], r14
jmp 0x1400373a1
xor edi, edi
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0x30], rdi
and r15, 0xfffffffffffffff0
add r15, rdi
lea rax, [r15 + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x98], rax
mov ecx, 8
call fcn.14008b48c
mov r9, rax
test r9, r9
je 0x1400373d9
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [r9], rax
mov qword [rsp + 0x40], r9
lea r14, [r15 + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0
lea r8, [0x140037550]
xor edx, edx
xor ecx, ecx
call fcn.140095404
mov qword [r15], rax
test rax, rax
je 0x140037531
mov qword [rsp + 0x98], r15
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov rdx, rdi
cmp rbx, rcx
jne 0x14003744b
cmp rax, rcx
je 0x140037497
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x140037430
jmp 0x140037497
cmp rax, rbx
je 0x14003746d
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x140037450
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x98], rdi
lea rax, [r15 + 0x10]
cmp rbx, rcx
je 0x140037497
sub rax, rbx
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rax], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x140037481
mov rax, qword [rsi]
test rax, rax
je 0x1400374f0
mov rdx, qword [rsi + 8]
mov rcx, rax
cmp rax, rdx
je 0x1400374bf
nop dword [rax + rax]
cmp dword [rax + 8], 0
jne 0x140037525
add rax, 0x10
cmp rax, rdx
jne 0x1400374b0
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x1400374eb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003752b
mov rcx, r8
call fcn.14008b4c8
mov qword [rsi], rdi
shl r13, 4
add r13, rdi
mov qword [rsi + 8], r13
lea rcx, [r12 + rdi]
mov qword [rsi + 0x10], rcx
mov rax, r15
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.14000add0
int3
call fcn.14000b170
int3
call fcn.1400935e8
int3
call fcn.140091b3c
nop
mov dword [r14], 0
mov ecx, 6
call fcn.14006820c
int3