joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed120
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x4ed1e7
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x4ed14c
test r15, r15
je 0x4ed22a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x4ed1fc
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x4ed15b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x4eea00
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x4eeaa7
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x4eeb4a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x4eeaa7
cmp r9, 0
je 0x4eec03
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x4eeb60
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x4f8880
Capabilities:
Hash data using sha512

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f89e1
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x40], rbx
lea rdx, [rax - 1]
cmp rdx, 0x3f
ja 0x4f89c6
cmp rcx, 0x40
jg 0x4f89ac
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
lea rax, [0x00540200]
call fcn.0040d540
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x50], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rax + 0x160], rcx
lea rsi, [rax + 0xe0]
mov rbx, qword [rsp + 0x40]
cmp rbx, rsi
je 0x4f8912
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rsi
mov rax, rsi
call fcn.00465560
mov rax, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
nop
movups xmm0, xmmword [0x0062b7e0]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x0062b7f0]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [0x0062b800]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x0062b810]
movups xmmword [rax + 0x30], xmm0
mov rdx, qword [rax + 0x160]
shl rdx, 8
or rdx, qword [rax + 0x50]
or rdx, 0x1010000
xor qword [rax], rdx
mov qword [rax + 0xd8], 0
movups xmmword [rax + 0x40], xmm15
cmp qword [rax + 0x160], 0
jle 0x4f899e
lea rdi, [rax + 0x58]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004651d0
mov rbp, qword [rbp]
mov qword [rax + 0xd8], pe_nt_image_headers64
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rbx, qword [0x00644ab0]
mov rcx, qword [0x00644ab8]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov rbx, qword [0x00644aa0]
mov rcx, qword [0x00644aa8]
xor eax, eax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004f8880
Function at 0x4f8a20
Capabilities:
Encode data using base64
Hash data using sha512

Disassembly:
lea r12, [rsp - 0xa0]
cmp r12, qword [r14 + 0x10]
jbe 0x4f8cb1
sub rsp, 0x120
mov qword [rsp + 0x118], rbp
lea rbp, [rsp + 0x118]
mov qword [rsp + 0x138], rcx
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rbx
movups xmm0, xmmword [0x0062b7e0]
movups xmmword [rsp + 0x58], xmm0
movups xmm0, xmmword [0x0062b7f0]
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [0x0062b800]
movups xmmword [rsp + 0x78], xmm0
movups xmm0, xmmword [0x0062b810]
movups xmmword [rsp + 0x88], xmm0
mov r9, rbx
or rbx, 0x1010000
xor qword [rsp + 0x58], rbx
movups xmmword [rsp + 0x48], xmm15
cmp rdi, 0x80
jle 0x4f8b51
mov r10, rdi
and rdi, 0xffffffffffffff80
lea r11, [rdi - 0x80]
cmp r10, rdi
cmove rdi, r11
cmp rsi, rdi
jb 0x4f8ca5
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x148], rsi
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x138], rcx
lea rax, [rsp + 0x58]
lea rbx, [rsp + 0x48]
mov r8, rsi
mov rsi, rdi
mov rdi, rcx
xor ecx, ecx
call fcn.004f9020
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
cmp rcx, rax
jb 0x4f8c9d
sub rcx, rax
mov rdx, qword [rsp + 0x148]
mov r9, rax
sub rax, rdx
sar rax, 0x3f
and r9, rax
mov rdx, qword [rsp + 0x138]
add rdx, r9
mov rax, qword [rsp + 0x128]
mov r9, qword [rsp + 0x130]
mov rdi, rcx
mov rcx, rdx
cmp rdi, 0x80
mov r8d, pe_nt_image_headers64
cmovl r8, rdi
lea rdi, [rsp + 0x98]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00464e82
mov rbp, qword [rbp]
lea rdi, [rsp + 0x98]
cmp rcx, rdi
je 0x4f8bba
mov qword [rsp + 0x30], r8
mov rax, rdi
mov rbx, rcx
mov rcx, r8
call fcn.00465560
mov rax, qword [rsp + 0x128]
lea rdi, [rsp + 0x98]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x130]
lea rdx, [r8 - 0x80]
neg rdx
cmp qword [rsp + 0x48], rdx
jae 0x4f8bcd
dec qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
lea rdx, [r8 + rdx]
lea rdx, [rdx - 0x80]
mov qword [rsp + 0x48], rdx
lea rax, [rsp + 0x58]
lea rbx, [rsp + 0x48]
mov rcx, 0xffffffffffffffff
mov esi, pe_nt_image_headers64
mov r8, rsi
call fcn.004f9020
mov rdx, qword [rsp + 0x130]
lea r9, [rdx + 7]
sar r9, 0x3f
shr r9, 0x3d
lea rcx, [r9 + rdx]
lea rcx, [rcx + 7]
sar rcx, 3
nop dword [rax]
cmp rcx, 8
ja 0x4f8c93
mov rdx, qword [rsp + 0x128]
xor eax, eax
jmp 0x4f8c3a
mov qword [rdx + rax], rbx
lea rax, [rsi + 1]
cmp rax, rcx
jge 0x4f8c6c
test byte [rdx], al
mov rbx, qword [rsp + rax*8 + 0x58]
mov rsi, rax
shl rax, 3
cmp rax, 0x40
ja 0x4f8c89
lea rdi, [rax - 0x40]
mov r8, rdi
sar rdi, 0x3f
and rax, rdi
neg r8
cmp r8, 7
ja 0x4f8c32
jmp 0x4f8c7c
mov rbp, qword [rsp + 0x118]
add rsp, 0x120
ret
mov eax, 7
mov rcx, r8
call fcn.00464bc0
mov ecx, 0x40
call fcn.00464c80
mov edx, 8
call fcn.00464c00
nop dword [rax]
call fcn.00464c80
mov rcx, rdi
mov rdx, rsi
call fcn.00464c40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00462560
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004f8a20
Function at 0x504060
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x50409f
jb 0x5040b4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x504120
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x5041f0
jb 0x50424f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00504000
aeskeygenassist xmm1, xmm0, 1
call fcn.00504020
aeskeygenassist xmm1, xmm2, 2
call fcn.00504000
aeskeygenassist xmm1, xmm0, 2
call fcn.00504020
aeskeygenassist xmm1, xmm2, 4
call fcn.00504000
aeskeygenassist xmm1, xmm0, 4
call fcn.00504020
aeskeygenassist xmm1, xmm2, 8
call fcn.00504000
aeskeygenassist xmm1, xmm0, 8
call fcn.00504020
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00504000
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00504020
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00504000
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00504020
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00504000
jmp 0x5042bd
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00503f60
aeskeygenassist xmm1, xmm2, 2
call fcn.00503fc0
aeskeygenassist xmm1, xmm2, 4
call fcn.00503f60
aeskeygenassist xmm1, xmm2, 8
call fcn.00503fc0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00503f60
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00503fc0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00503f60
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00503fc0
jmp 0x5042bd
aeskeygenassist xmm1, xmm0, 1
call fcn.00503f20
aeskeygenassist xmm1, xmm0, 2
call fcn.00503f20
aeskeygenassist xmm1, xmm0, 4
call fcn.00503f20
aeskeygenassist xmm1, xmm0, 8
call fcn.00503f20
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00503f20
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00503f20
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00503f20
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00503f20
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00503f20
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00503f20
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x5042ca
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x50c840
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x50ca43
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp + 0x98], rax
mov rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x20]
nop word [rax + rax]
test rbx, rbx
je 0x50c975
mov rax, rdx
call fcn.004d4560
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x98]
mov rdx, qword [rdx + 0x28]
mov rax, rdx
mov ebx, 0xa
call fcn.00473400
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x80]
mov qword [rsp], rdx
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 8], rsi
mov byte [rsp + 0x10], 0x3a
nop dword [rax]
call fcn.00402f60
xorps xmm15, xmm15
mov r14, qword [0x00698440]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x50c938
xor eax, eax
lea rbx, [0x0054a984]
mov ecx, 1
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x60]
lea r8, [0x0054a9f5]
mov r9d, 2
mov r10, qword [rsp + 0x70]
mov r11, qword [rsp + 0x50]
call fcn.0044de40
jmp 0x50c965
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0057a250]
mov esi, 1
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x50]
nop dword [rax]
call fcn.0044dd60
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov rcx, qword [rax + 0x28]
mov ebx, 0xa
mov rax, rcx
call fcn.00473400
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rcx]
mov qword [rsp + 0x78], rdx
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x58], rcx
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0x3a
call fcn.00402f60
xorps xmm15, xmm15
mov r14, qword [0x00698440]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x50ca0c
xor eax, eax
lea rbx, [0x0054a984]
mov ecx, 1
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x58]
lea r8, [0x0054a9f5]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x48]
call fcn.0044de40
jmp 0x50ca33
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
lea rdi, [0x0057a250]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x48]
call fcn.0044dd60
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
call fcn.00462560
mov rax, qword [rsp + 8]
jmp fcn.0050c840
Function at 0x140640058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406401df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140640089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14064006f
add dl, dl
jne 0x140640096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406400f6
xor eax, eax
add dl, dl
jne 0x1406400a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406401ad
add dl, dl
jne 0x1406400b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406400c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406400d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406400dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406400ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14064007e
mov eax, 1
add dl, dl
jne 0x140640106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140640113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406400fb
sub eax, ebx
mov ebx, 1
jne 0x14064014c
mov ecx, 1
add dl, dl
jne 0x14064012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14064013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140640123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14064007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140640168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140640175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14064015d
cmp eax, 0x7d00
jae 0x14064019b
cmp eax, 0x500
jb 0x140640196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14064007e
cmp eax, 0x7f
ja 0x14064019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14064007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406401d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14064007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18000bdd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000be2d
lea rbx, [0x180194860]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18000be14
cmp r10, 2
jb 0x18000be14
cmp byte [r9], r8b
jne 0x18000be14
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18000bdf0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000be6f
lea rbx, [0x180194860]
cmp r8b, 0x23
jne 0x18000be53
cmp byte [r9], r8b
jne 0x18000be53
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18000be40
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x18000bfb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18000bfca
mov qword [r8], 0
lea rdx, [0x180280608]
call fcn.18000be80
mov rbx, rax
test rax, rax
jne 0x18000bfea
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1800593b8
mov esi, eax
cmp eax, 0xffffffff
je 0x18000c0b8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.180059f64
test eax, eax
jne 0x18000c0b8
mov rcx, rbx
call fcn.1800593b8
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18000c0b8
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.180059f64
test eax, eax
jne 0x18000c0b8
cmp rdi, 0xffffffffffffffff
je 0x18000c0b8
mov rax, qword [0x1802959f8]
test rax, rax
je 0x18000c05a
inc dword [rax + 0xf4]
mov rcx, rdi
call fcn.1800602f0
mov rsi, rax
test rax, rax
je 0x18000c0b8
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18005acbc
mov rcx, rbx
cmp rax, rdi
je 0x18000c0a6
call fcn.180059be4
mov rax, qword [0x1802959f8]
test rax, rax
je 0x18000c09c
dec dword [rax + 0xf4]
mov rcx, rsi
call fcn.1800553cc
jmp 0x18000c0c0
call fcn.180059be4
test r14, r14
je 0x18000c0b3
mov qword [r14], rdi
mov rax, rsi
jmp 0x18000c0c2
mov rcx, rbx
call fcn.180059be4
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18000e5a0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x180194860]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f40], ebx
jne 0x18000e636
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.180020bc0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180011ab0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180011b00
lea r11, [0x180194860]
nop dword [rax]
cmp r9b, 0x23
jne 0x180011ae3
cmp byte [r8], r9b
jne 0x180011ae3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180011ad0
mov rcx, qword [0x1802959f8]
not eax
movsxd rdx, dword [rcx + 0x3ed8]
mov r9, qword [rcx + 0x3ee0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180011b61
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180011b59
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x180011b5c
mov rdx, r8
test rdx, rdx
jne 0x180011b30
cmp r9, r10
je 0x180011b70
cmp dword [r9], eax
jne 0x180011b70
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x18001f8f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1802959f8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18001f953
mov qword [rsp], rbx
lea rbx, [0x180194860]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001f933
cmp byte [r8], r9b
jne 0x18001f933
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18001f920
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c20]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x18001f987
mov r10, qword [r10 + 0x5c28]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x18001f98e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x18001f974
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x18003a0e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x18028e030]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x18003a12f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180295e10]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18003a16d
cmp rsi, r14
jb 0x18003a165
cmp rsi, r15
jae 0x18003a165
cmp qword [rsi + 8], 0
jne 0x18003a337
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18003a150
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18003a202
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18003a1f9
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003a1f9
cmp dword [rsp + 0x40], 0x10000
je 0x18003a27b
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x18003a1f9
sub rbx, rbp
cmp rbx, r14
jae 0x18003a1c0
test rsi, rsi
jne 0x18003a2e0
cmp rdi, r15
ja 0x18003a31f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18003a31f
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003a31f
cmp dword [rsp + 0x40], 0x10000
je 0x18003a2b1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18003a232
jmp 0x18003a31f
test rbx, rbx
je 0x18003a1f9
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18003a2e0
cmp rbx, r14
jae 0x18003a1a0
jmp 0x18003a202
test rdi, rdi
je 0x18003a31f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18003a2e0
cmp rdi, r15
jbe 0x18003a210
jmp 0x18003a31f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18003a2f0
mov rax, qword [0x180295e10]
mov qword [rsi], rax
mov qword [0x180295e10], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18004e310
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret