joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180020a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x180020c14
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x180020c14
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x180020b1b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x180020c3b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x180020b32
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x180020b32
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x180020b45
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x180020b92
mov r8d, eax
cmp eax, 0x800
jae 0x180020b5f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x180020b92
cmp eax, 0x10000
jae 0x180020b79
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x180020b92
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x180020c14
add qword [r14], 2
test sil, sil
jne 0x180020bb3
cmp r10d, 3
jae 0x180020bbf
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x180020bf1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x180020bd0
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x180020acf
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x180020c22
Function at 0x1800230d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1800230bc
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r8d, r8d
movabs r9, 0x180097715
add dword [rax], eax
add byte [rax], al
mov dword [rax + 8], 0x62756373
mov r9, qword [r9]
mov byte [rax + 0xc], r8b
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x18002316d
lea rax, [r9 + rcx]
mov r10d, r8d
mov esi, dword [rax + 0x18]
test esi, esi
jle 0x18002316d
mov r11d, dword [rax + 0x20]
mov ebx, dword [rax + 0x24]
mov r14d, dword [rax + 0x1c]
add r11, r9
add rbx, r9
movzx eax, word [rbx]
lea rdi, [rsp + 0x40]
lea rcx, [r14 + rax*4]
mov eax, dword [r11]
mov ebp, dword [rcx + r9]
add rax, r9
jmp 0x18002313b
cmp cl, byte [rdi]
jne 0x180023141
inc rax
inc rdi
mov cl, byte [rax]
test cl, cl
jne 0x180023131
mov cl, byte [rax]
mov edx, r8d
mov eax, r8d
cmp cl, byte [rdi]
seta dl
cmp byte [rdi], cl
seta al
cmp edx, eax
je 0x180023169
inc r10d
add rbx, 2
add r11, 4
cmp r10d, esi
jl 0x180023119
jmp 0x18002316d
lea r8, [r9 + rbp]
call r8
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180023188
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xe8
xor r13d, r13d
mov dword [rsp + 0x20], 0x687a6664
mov dword [rsp + 0x24], 0x79762157
mov dword [rsp + 0x28], 0x66634025
mov dword [rsp + 0x2c], 0x70414768
mov dword [rsp + 0x38], 0x65006b
lea esi, [r13 + 1]
mov byte [rsp + 0x30], r13b
mov dword [rsp + 0x3c], 0x6e0072
mov dword [rsp + 0x40], 0x6c0065
mov dword [rsp + 0x44], 0x320033
mov dword [rsp + 0x48], 0x64002e
mov dword [rbp - 0x7d], 0x6c006c
mov word [rbp - 0x79], r13w
mov edx, 0x3d090c
mov eax, r13d
lea rcx, [rbp - 0x59]
mov byte [rcx], al
add eax, esi
add rcx, rsi
cmp eax, 0x6a
jb 0x180023216
sub rdx, rsi
jne 0x18002320f
cmp byte [rbp - 0x29], 0x30
jne 0x1800232f2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rbx, qword [rcx + 0x10]
mov rdx, rbx
mov rbx, qword [rbp + 0x6f]
mov rax, qword [rsi]
movabs rcx, 0x8000000000000000
test rcx, rax
mov rcx, r12
je 0x180023669
movzx edx, ax
jmp 0x180023670
lea rdx, [rax + 2]
add rdx, rbx
call r13
mov qword [rsi], rax
invalid
invalid

Function at 0x1800233fc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [rcx - 0x45], cl
add byte [rax + 0x1800a], al
add byte [rax], al
Function at 0x1800236f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd rax, dword [rcx + 0x3c]
mov esi, edx
xor edx, edx
mov r8d, dword [rax + rcx + 0x88]
add byte [rax], al
add byte [rbx + rcx*4 - 0x37], cl

Function at 0x180040554
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x18002acfe
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x18002ace1
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x18002accc

Function at 0x180040568
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x1800163a4
movabs r10, 0x100000001b3
movzx edx, byte [r8 + rcx]
inc r8
xor rax, rdx
imul rax, r10
cmp r8, r9
jb 0x180016390
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x180016370
Function at 0x10009133e
Capabilities:
Encode data using xor

Disassembly:
invalid
jge 0x1000912f0
lodsd eax, dword [rsi]
xor byte [rsi + 0x6e], bh
sbb eax, 0x9a3317a7
mov ch, 0x3d
pop rcx
stosd dword [rdi], eax
xor ebx, dword [rdx - 0x54a6c24b]
push 0xffffffffda92440e
xchg edx, eax
je 0x100091347
mov ah, 0x9a
nop
sbb eax, 0x97698ec7
hlt
Function at 0x1400021b0
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], rdx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov edi, dword [0x1401efcf4]
movsxd rax, dword [reloc.WS2_32.dll_accept]
xor edx, edx
cmp eax, 0x7b
ja 0x1400021e6
lea rdx, [0x1401ee880]
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
movdqa xmm1, xmmword [0x140161880]
movdqu xmmword [rbp - 0x18], xmm1
mov byte [rbp - 0x28], 0
test rdx, rdx
jne 0x140002252
mov dword [rbp - 0x40], 0xdddbd3e6
mov dword [rbp - 0x3c], 0xf79bceda
mov dword [rbp - 0x38], 0x100c7d8
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x4b]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x140002220
mov byte [rbp - 0x35], 0
lea rax, [rbp - 0x40]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140002242
lea rdx, [rbp - 0x40]
jmp 0x14000226a
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140002260
lea rcx, [rbp - 0x28]
call fcn.140017310
cmp edi, 1
jne 0x1400022d9
movdqa xmm0, xmmword [0x140161b00]
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0xa1
mov byte [rbp - 0x2e], dil
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x4b]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x1400022a0
mov byte [rbp - 0x2e], 0
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400022c0
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.140017310
mov dword [rbp + 0x18], 0x42f00000
mov dword [rbp + 0x1c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rcx, qword [rbp - 0x28]
lea rdx, [rbp + 0x18]
call fcn.1400500f0
test al, al
je 0x140002328
test edi, edi
jne 0x140002328
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140002160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140002366
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002361
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002361
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012b6f4
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400042c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x1400042e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x4b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x1400042d0
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x140004e80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xfd0]
mov eax, 0x10d0
call fcn.14012c050
sub rsp, rax
mov eax, dword [0x1401efc78]
lea r8, [rsp + 0x48]
xor esi, esi
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x38], rsi
lea rax, [rbp + 0xff0]
mov ebx, edx
mov rdi, rcx
mov rcx, qword [0x1401efc70]
mov edx, 0x265408
mov qword [rsp + 0x30], rsi
lea r9d, [rsi + 0x10]
mov dword [rsp + 0x28], esi
mov qword [rbp + 0xff0], rsi
mov dword [rsp + 0x48], 0x14bb50d0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x38], rsi
lea r9d, [rsi + 0x28]
mov eax, ebx
mov qword [rsp + 0x30], rsi
sar eax, 0x10
lea r8, [rsp + 0x58]
mov dword [rsp + 0x28], esi
mov edx, 0x264190
mov qword [rbp + 0x1000], rsi
mov dword [rsp + 0x79], esi
lea ecx, [rax*8 + 0x10]
mov word [rsp + 0x7d], si
mov rax, qword [rbp + 0xff0]
add rax, 0xaa964c0
mov byte [rsp + 0x7f], sil
add rcx, rax
mov dword [rsp + 0x58], 0x14bb50d0
lea rax, [rbp + 0x1000]
mov qword [rsp + 0x60], rcx
mov rcx, qword [0x1401efc70]
mov qword [rsp + 0x68], rax
mov eax, dword [0x1401efc78]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x70], 8
mov byte [rsp + 0x78], sil
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor edx, edx
lea rcx, [rbp + 0x7c0]
mov r8d, 0x808
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbp + 0x1000]
lea r9d, [rsi + 0x28]
mov qword [rsp + 0x38], rsi
lea r8, [rbp - 0x80]
mov qword [rsp + 0x30], rsi
mov edx, 0x264190
movzx ecx, bx
mov dword [rsp + 0x28], esi
mov dword [rbp - 0x5f], esi
mov word [rbp - 0x5b], si
lea rcx, [rax + rcx*4]
mov byte [rbp - 0x59], sil
lea rax, [rbp + 0x7c0]
mov qword [rbp - 0x78], rcx
mov rcx, qword [0x1401efc70]
mov qword [rbp - 0x70], rax
mov eax, dword [0x1401efc78]
mov dword [rbp - 0x7c], eax
mov dword [rbp - 0x80], 0x14bb50d0
mov qword [rbp - 0x68], 0x808
mov byte [rbp - 0x60], sil
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
lea rcx, [rbp - 0x50]
mov r8d, 0x808
lea rdx, [rbp + 0x7c0]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x1401efcd0]
call fcn.1400179a0
mov qword [rbp + 0xff0], rax
movzx r9d, si
movzx eax, word [rbp + 0x7c4]
shr ax, 1
cmp si, ax
jae 0x140005083
nop dword [rax]
movzx ecx, r9w
lea r8, [rbp - 0x4a]
add r8, rcx
movzx ecx, r9b
and ecx, 3
inc r9w
movzx edx, byte [rbp + rcx + 0xff0]
xor dl, byte [r8]
xor dl, al
mov byte [r8], dl
movzx eax, word [rbp - 0x4c]
shr ax, 1
cmp r9w, ax
jb 0x140005050
xorps xmm0, xmm0
lea rax, [rbp - 0x4a]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x1400050a0
lea rdx, [rbp - 0x4a]
mov rcx, rdi
call fcn.140018170
mov rbx, qword [rsp + 0x10f8]
mov rax, rdi
add rsp, 0x10d0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140014b10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x270
mov rbx, rdx
mov r15, rcx
xor r13d, r13d
mov edx, 0x100
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140014b70
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.140018040
nop
mov r8d, Ordinal_32
lea rdx, str.SoftwareDistributionDownload_
lea rcx, [rsp + 0x28]
call fcn.140016910
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140014c19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014c14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014c14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012b6f4
movdqa xmm0, xmmword [0x140161850]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], r13w
lea rdi, [rbx + 0x10]
mov rdx, rbx
lea r14, [rbx + 0x18]
cmp qword [rbx + 0x18], 7
jbe 0x140014c48
mov rdx, qword [rbx]
lea rbp, [rbx + 0x10]
jmp 0x140014c4b
mov rbp, rdi
mov r8, qword [rdi]
lea rcx, [rsp + 0x48]
call fcn.140016910
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], r13
movups xmm0, xmmword [rax]
movups xmmword [r15], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r15 + 0x10], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
lea r12, [rbx + 0x18]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140014cd6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140014ccb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140014ccb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012b6f4
mov rdi, rbp
mov r12, r14
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140014d11
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140014d0c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014d44
mov rcx, r8
call fcn.14012b6f4
mov qword [rdi], r13
mov qword [r12], 7
mov word [rbx], r13w
mov rax, r15
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140014d50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x140014d81
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x140014d84
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140014e05
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x140014df9
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140014df1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014efb
mov rcx, r8
call fcn.14012b6f4
mov r14, rsi
mov qword [r14], 7
jmp 0x140014edd
cmp rbp, 0xffffffffffffffff
jne 0x140014e5b
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x140014e4d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140014e48
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014efb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.14012b6f4
mov qword [rsi], 7
xor al, al
jmp 0x140014edf
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x4540
mov qword [rsp + 0x20], r15
lea rdx, [0x14019e430]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x140014e0e
cmp rdx, 7
jbe 0x140014ed6
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140014ed1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014efb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.14012b6f4
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140014f10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r15d, r15d
lea r14, [rcx + 0x18]
cmp qword [r14], 7
mov rdi, rcx
mov dword [rsp + 0x60], r15d
jbe 0x140014f41
mov rcx, qword [rcx]
lea rsi, [rdi + 0x18]
jmp 0x140014f44
mov rsi, r14
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140014fc5
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x140014fb9
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140014fb1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400150bb
mov rcx, r8
call fcn.14012b6f4
mov r14, rsi
mov qword [r14], 7
jmp 0x14001509d
cmp rbp, 0xffffffffffffffff
jne 0x14001501b
mov rdx, qword [r14]
cmp rdx, 7
jbe 0x14001500d
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140015008
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400150bb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.14012b6f4
mov qword [rsi], 7
xor al, al
jmp 0x14001509f
lea r9, [rsp + 0x60]
mov qword [rsp + 0x68], rbx
mov r8d, 0x252f8
mov qword [rsp + 0x20], r15
lea rdx, [0x140179130]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [r14]
test bl, bl
mov rbx, qword [rsp + 0x68]
je 0x140014fce
cmp rdx, 7
jbe 0x140015096
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140015091
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400150bb
mov rcx, r8
lea rsi, [rdi + 0x18]
call fcn.14012b6f4
mov qword [rsi], 7
mov al, 1
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov word [rdi], r15w
mov qword [rdi + 0x10], r15
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001be20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001be7d
lea rbx, [0x14015b120]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14001be64
cmp r10, 2
jb 0x14001be64
cmp byte [r9], r8b
jne 0x14001be64
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14001be40
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001bebf
lea rbx, [0x14015b120]
cmp r8b, 0x23
jne 0x14001bea3
cmp byte [r9], r8b
jne 0x14001bea3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14001be90
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14001c000
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14001c01a
mov qword [r8], 0
lea rdx, [0x1401608a0]
call fcn.14001bed0
mov rbx, rax
test rax, rax
jne 0x14001c03a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14001c111
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001c111
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14001c111
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001c111
cmp rdi, 0xffffffffffffffff
je 0x14001c111
mov rax, qword [0x1401efdb8]
test rax, rax
je 0x14001c0ae
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14001c111
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14001c0fe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401efdb8]
test rax, rax
je 0x14001c0f3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14001c11a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14001c10c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14001c11c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret