joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140300d34
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov rsi, rdx
mov rbx, qword [r8 + 0x10]
mov r15, rcx
mov r9, r8
jb 0x140300d67
mov r9, qword [r8]
xor edi, edi
lea rdx, [rbx + rbx]
lea rcx, [rdx + r9]
movabs rax, 0xcbf29ce484222325
cmp r9, rcx
mov r10, r9
cmova rdx, rdi
test rdx, rdx
je 0x140300dad
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r11
cmp rcx, rdx
jne 0x140300d8a
mov r14, qword [r15 + 0x30]
mov r13, qword [r15 + 0x18]
and r14, rax
mov r11, qword [r15 + 8]
add r14, r14
mov rax, qword [r13 + r14*8]
cmp qword [r13 + r14*8], r11
jne 0x140300dd0
mov rcx, r11
jmp 0x140300dd8
mov rcx, qword [r13 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140300eb3
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x140300df2
mov rdx, qword [r8]
mov r12, qword [rcx + 0x18]
mov r9, rcx
cmp r12, 8
jb 0x140300e02
mov r9, qword [rcx]
mov rdi, qword [rcx + 0x10]
cmp rdi, rbx
jne 0x140300e46
mov rbp, rdi
test rdi, rdi
je 0x140300e4e
movzx ecx, word [r9]
movzx r10d, word [rdx]
cmp cx, r10w
jb 0x140300e46
sub r9, rdx
cmp cx, r10w
ja 0x140300e46
cmp rbp, 1
je 0x140300e4e
add rdx, 2
dec rbp
movzx ecx, word [r9 + rdx]
movzx r10d, word [rdx]
cmp cx, r10w
jae 0x140300e28
mov rax, qword [rax]
jmp 0x140300dc4
lea rcx, [rax + 0x10]
cmp r12, 8
jb 0x140300e5b
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
mov rdx, r8
jb 0x140300e68
mov rdx, qword [r8]
cmp rbx, rdi
jne 0x140300ea9
xor edi, edi
test rbx, rbx
je 0x140300eae
movzx r9d, word [rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jb 0x140300eab
sub rdx, rcx
cmp r9w, r10w
ja 0x140300eab
cmp rbx, 1
je 0x140300eae
add rcx, 2
dec rbx
movzx r9d, word [rcx + rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jae 0x140300e89
jmp 0x140300eab
xor edi, edi
mov rax, r11
mov rcx, rax
jmp 0x140300ebb
mov rax, r11
mov rcx, r11
xor edi, edi
cmp rcx, r11
jne 0x140300f35
mov rbx, qword [r11]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r8
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.1403016d0
mov rdx, rax
movabs rcx, 0x1745d1745d1745c
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140300f0f
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1403013a0
jmp 0x140300f3c
mov qword [rsi], rax
mov byte [rsi + 8], dil
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140301790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rbx, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rdx, qword [r9 + 0x10]
jb 0x1403017b2
mov r9, qword [r9]
add rdx, rdx
xor edi, edi
movabs rax, 0xcbf29ce484222325
mov r11, r9
lea rcx, [rdx + r9]
cmp r9, rcx
cmova rdx, rdi
test rdx, rdx
je 0x1403017f7
movzx ecx, byte [r11]
movabs rdi, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r9
imul rax, rdi
cmp rcx, rdx
jne 0x1403017d4
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14030182f
cmp qword [rcx + rdx*8], r8
jne 0x140301824
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140301828
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14030183c
cmp qword [rcx + rdx*8], r8
jne 0x14030183c
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.140301634
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140309abc
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rdx
mov rbx, rcx
and dword [rbp + 0x18], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140309b01
mov rcx, qword [rdx]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea esi, [r9 + 1]
mov r8d, esi
mov edx, dword [rdx + 0x10]
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
nop dword [rax + rax]
test eax, eax
je 0x140309c84
mov edx, dword [rbp + 0x18]
lea rcx, [rbp - 0x18]
call fcn.1400708ec
mov rax, qword [rbp - 0x10]
sub rax, qword [rbp - 0x18]
neg rax
sbb r9, r9
and r9, qword [rbp - 0x18]
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 8
jb 0x140309b63
mov rdi, qword [rdi]
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x20], rcx
mov r8d, esi
mov edx, eax
mov rcx, rdi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
nop dword [rax + rax]
test eax, eax
je 0x140309c3f
mov edi, dword [rbp + 0x18]
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], SafeArrayLock
mov byte [rbx], 0
cmp rdi, qword [rbx + 0x18]
ja 0x140309bd3
mov rsi, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140309bba
mov rsi, qword [rbx]
mov qword [rbx + 0x10], rdi
mov r8, rdi
mov rdx, qword [rbp - 0x18]
mov rcx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov byte [rsi + rdi], 0
jmp 0x140309be3
mov r9, qword [rbp - 0x18]
mov rdx, rdi
mov rcx, rbx
call fcn.140072704
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140309c26
mov rdx, qword [rbp - 8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140309c21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140309c21
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop dword [rax + rax]
int3
call fcn.140356b5c
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
nop
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14004f7b4
mov r9d, eax
mov rcx, qword [rbp + 8]
lea rax, str.base64Decode_failed
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourceincconverters.h
mov edx, 0x16d
call fcn.1400545b8
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14004f7b4
mov r9d, eax
mov rcx, qword [rbp + 8]
lea rax, str.base64Decode_failed_to_calculate_needed_size_of_converted_message
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourceincconverters.h
mov edx, 0x164
call fcn.1400545b8
int3
Function at 0x14030c924
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rdx
mov rbx, rcx
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp - 0x31], xmm0
xor r14d, r14d
mov word [rbp - 0x41], r14w
lea rdi, [rdx + 0x2c]
mov rdx, rdi
lea rcx, [rbp - 0x41]
call fcn.140055574
nop
lea rcx, [rbp - 0x41]
call fcn.14023e048
mov rdx, qword [rbx]
add rdx, 8
xor r8d, r8d
lea rcx, [rbp - 0x41]
call fcn.140235678
test al, al
je 0x14030cac6
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], 5
jbe 0x14030ca2a
lea rax, str.Process_is_already_running._Terminate_it
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x52
lea rax, [rsi + 8]
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], 4
lea rdx, [0x1403cb630]
mov eax, r14d
test rdi, rdi
je 0x14030c9f5
mov rdx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r14w
jne 0x14030c9eb
mov qword [rbp + 0x27], rdx
lea eax, [rax*2 + 2]
mov dword [rbp + 0x2f], eax
mov dword [rbp + 0x33], r14d
lea rax, [rbp - 0x19]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14048cbc6]
call fcn.140001208
mov r8d, dword [rsi + 8]
xor edx, edx
mov ecx, 0x100401
call qword [sym.imp.KERNEL32.dll_OpenProcess]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp - 0x49], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14030caac
lea rdx, [rbp - 0x59]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
nop dword [rax + rax]
test eax, eax
je 0x14030caac
cmp dword [rbp - 0x59], 0x103
jne 0x14030caac
mov edx, 0x42b
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
test eax, eax
jne 0x14030ca8e
call fcn.140329e68
mov edx, 0x2710
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14030caac
call fcn.140329e68
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14030cac6
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
nop
lea rcx, [rbp - 0x41]
call fcn.140055f70
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
add rcx, 8
jmp 0x14030c924
Function at 0x140319998
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
lea rcx, [rbp - 0x51]
call fcn.14005da24
nop
lea rdx, [0x140546df0]
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
cmovae rdx, qword [0x140546df0]
mov r8, qword [0x140546e00]
lea rcx, [rbp - 0x51]
call fcn.140068814
xor ebx, ebx
mov dword [rbp - 0x69], ebx
mov eax, dword [rbp - 0x41]
add eax, eax
mov dword [rbp - 0x65], eax
call fcn.1400550c0
mov rcx, qword [rax + 8]
lea esi, [rbx + 4]
cmp dword [rcx], esi
jbe 0x140319a71
lea rax, str.Trying_to_write_to_pipe
mov qword [rbp - 9], rax
mov qword [rbp - 1], 0x30
mov rax, qword [rdi + 0x120]
mov qword [rbp - 0x61], rax
lea rax, [rbp - 0x61]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 8
lea rax, [rbp - 0x65]
mov qword [rbp + 0x17], rax
mov qword [rbp + 0x1f], rsi
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 5
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14048d0d5]
call fcn.140001208
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rdx, qword [rbp - 0x51]
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x69]
mov r8d, dword [rbp - 0x65]
mov rcx, qword [rdi + 0x120]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x140319afd
mov eax, dword [rbp - 0x65]
cmp dword [rbp - 0x69], eax
jne 0x140319afd
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], esi
jbe 0x140319af6
lea rax, str.Successfully_written_to_pipe
mov qword [rbp - 9], rax
mov qword [rbp - 1], 0x3a
lea rax, [rbp - 0x69]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], rsi
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14048d011]
call fcn.140001208
mov bl, 1
jmp 0x140319bae
call fcn.1400550c0
mov rdi, qword [rax + 8]
cmp dword [rdi], 2
jbe 0x140319bae
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x61], eax
lea rax, [rbp - 0x61]
mov qword [rbp - 9], rax
mov qword [rbp - 1], rsi
lea rax, str.Failed_to_write_message_to_request_pipe
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], MsiGetActiveDatabase
lea rcx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rcx, qword [rbp - 0x51]
lea rdx, [0x1403cb630]
mov rax, rbx
test rcx, rcx
je 0x140319b6a
mov rdx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x140319b61
mov qword [rbp + 0x17], rdx
lea eax, [rax*2 + 2]
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], ebx
lea rax, [rbp - 0x69]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rsi
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14048d08c]
mov rcx, rdi
call fcn.140001208
nop
lea rcx, [rbp - 0x51]
call fcn.140055f70
mov al, bl
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14031e448
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov edi, dword [rcx + 0x44]
mov rbx, rcx
mov r9d, dword [rcx + 0x9c]
mov edx, dword [rbx + 0x94]
mov esi, dword [rbx + 0x58]
mov ecx, dword [rbx + 0x44]
sub esi, edx
add ecx, 0xfffffefa
sub esi, r9d
add ecx, edi
cmp edx, ecx
jb 0x14031e502
mov rcx, qword [rbx + 0x50]
mov r8, rdi
lea rdx, [rdi + rcx]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov r9d, dword [rbx + 0x74]
mov rax, qword [rbx + 0x68]
sub dword [rbx + 0x98], edi
sub dword [rbx + 0x94], edi
sub dword [rbx + 0x84], edi
lea r8, [rax + r9*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, di
cmp edx, edi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x14031e4b5
mov rax, qword [rbx + 0x60]
mov r9d, edi
lea r8, [rax + rdi*2]
xor eax, eax
lea r8, [r8 - 2]
movzx edx, word [r8]
movzx ecx, dx
sub cx, di
cmp edx, edi
cmovae ax, cx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x14031e4e0
add esi, edi
mov rcx, qword [rbx]
cmp dword [rcx + 8], 0
je 0x14031e57c
mov edx, dword [rbx + 0x9c]
mov r8d, esi
mov eax, dword [rbx + 0x94]
add rdx, rax
add rdx, qword [rbx + 0x50]
call fcn.14031e204
add dword [rbx + 0x9c], eax
mov r9d, dword [rbx + 0x9c]
cmp r9d, 3
jb 0x14031e566
mov eax, dword [rbx + 0x94]
mov rdx, qword [rbx + 0x50]
mov ecx, dword [rbx + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rbx + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rbx + 0x7c]
mov dword [rbx + 0x70], r8d
cmp r9d, 0x106
jae 0x14031e57c
mov rax, qword [rbx]
cmp dword [rax + 8], 0
jne 0x14031e46a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14031f884
Capabilities:
Compute adler32 checksum

Disassembly:
push rbx
sub rsp, 0x20
mov r11d, r8d
mov rbx, rdx
cmp r8d, 0x20
jbe 0x14031f8c0
mov dword [rsp + 0x40], ecx
test rdx, rdx
je 0x14031f908
mov rax, qword [0x140563f60]
lea r8, [rsp + 0x40]
mov edx, r11d
mov rcx, rbx
call qword [str.p76_]
mov eax, dword [rsp + 0x40]
jmp 0x14031fa69
mov r9d, ecx
movzx r10d, cx
shr r9d, 0x10
cmp r11d, 1
jne 0x14031f903
movzx ecx, byte [rdx]
mov r11d, 0xfff1
add ecx, r10d
cmp ecx, r11d
lea edx, [rcx - 0xfff1]
cmovb edx, ecx
lea ecx, [rdx + r9]
cmp ecx, r11d
lea eax, [rcx - 0xfff1]
cmovb eax, ecx
shl eax, 0x10
or eax, edx
jmp 0x14031fa69
test rbx, rbx
jne 0x14031f912
mov eax, 1
jmp 0x14031fa69
cmp r11d, 0x10
jae 0x14031f95f
test r8d, r8d
je 0x14031f92f
movzx eax, byte [rbx]
inc rbx
add r10d, eax
add r9d, r10d
add r11d, 0xffffffff
jne 0x14031f91d
mov r11d, 0xfff1
lea r8d, [r10 - 0xfff1]
cmp r10d, r11d
mov eax, 0x80078071
cmovb r8d, r10d
mul r9d
shr edx, 0xf
imul eax, edx, 0xf
add eax, r9d
shl eax, 0x10
or eax, r8d
jmp 0x14031fa69
test r8d, r8d
je 0x14031fa5f
mov rcx, r11
shr rcx, 4
movzx eax, byte [rbx]
add r11d, 0xfffffff0
add r10d, eax
movzx eax, byte [rbx + 1]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 2]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 3]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 4]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 5]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 6]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 7]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 8]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 9]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xa]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xb]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xc]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xd]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xe]
add r9d, r10d
add r10d, eax
movzx eax, byte [rbx + 0xf]
add r9d, r10d
add rbx, 0x10
add r10d, eax
add r9d, r10d
sub rcx, 1
jne 0x14031f96f
test r11d, r11d
je 0x14031fa37
movzx eax, byte [rbx]
inc rbx
add r10d, eax
add r9d, r10d
add r11d, 0xffffffff
jne 0x14031fa25
mov eax, 0x80078071
mul r10d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xffff000f
mul r9d
add r10d, ecx
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r9d, ecx
shl r9d, 0x10
or r9d, r10d
mov eax, r9d
add rsp, 0x20
pop rbx
ret
Function at 0x140326c80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
mov eax, dword [r8]
mov rdi, r8
lea rsi, [0x140000000]
not eax
mov r11d, edx
mov r10, rcx
cmp edx, 0xf
jl 0x140326d8a
mov r9d, ecx
mov qword [rsp + 0x10], rbx
and r9d, 7
je 0x140326ce3
neg r9d
and r9d, 7
sub r11d, r9d
nop dword [rax]
movzx edx, byte [r10]
mov ecx, eax
xor rdx, rcx
inc r10
shr ecx, 8
movzx r8d, dl
mov eax, dword [rsi + r8*4 + 0x3ecdc0]
xor eax, ecx
sub r9d, 1
jne 0x140326cc0
mov ebx, r11d
sar ebx, 3
and r11d, 7
nop dword [rax]
mov rcx, qword [r10]
add r10, 8
mov r8, rcx
mov r9d, ecx
mov ecx, eax
xor r9, rcx
shr r8, 0x20
mov rax, r8
shr rax, 0x10
movzx edx, al
mov rax, r8
shr rax, 8
movzx ecx, al
mov eax, dword [rsi + rdx*4 + 0x3fc080]
xor eax, dword [rsi + rcx*4 + 0x3fb480]
mov rcx, r9
shr rcx, 0x10
movzx edx, cl
mov rcx, r9
shr rcx, 8
xor eax, dword [rsi + rdx*4 + 0x3fb880]
movzx edx, cl
mov rcx, r8
shr rcx, 0x18
xor eax, dword [rsi + rdx*4 + 0x3fc880]
xor eax, dword [rsi + rcx*4 + 0x3ecdc0]
mov rcx, r9
shr rcx, 0x18
xor eax, dword [rsi + rcx*4 + 0x3fbc80]
movzx ecx, r8b
xor eax, dword [rsi + rcx*4 + 0x3fc480]
movzx ecx, r9b
xor eax, dword [rsi + rcx*4 + 0x3fcc80]
sub ebx, 1
jne 0x140326cf0
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x140326db4
nop
movzx edx, byte [r10]
lea r10, [r10 + 1]
mov ecx, eax
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov eax, dword [rsi + r8*4 + 0x3ecdc0]
xor eax, ecx
sub r11d, 1
jne 0x140326d90
mov rsi, qword [rsp + 0x18]
not eax
mov dword [rdi], eax
pop rdi
ret
Function at 0x140328524
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
xor ebp, ebp
mov esi, r8d
mov edi, edx
mov rbx, rcx
test rcx, rcx
je 0x140328632
test edx, edx
je 0x140328632
cmp r8d, 0x80
jae 0x140328632
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140328577
mov eax, ebp
jmp 0x140328637
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
cmp eax, 0xb7
je 0x140328570
cmp eax, 3
je 0x1403285a3
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x140328637
lea rax, [rsp + 0x50]
mov r15d, 0x5c
mov qword [rsp + 0x28], rax
mov edx, r15d
lea rax, [rsp + 0x68]
mov r8d, edi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140327e98
test eax, eax
js 0x140328637
cmp dword [rsp + 0x50], ebp
jne 0x1403285dc
mov eax, 0x80070003
jmp 0x140328637
mov edx, dword [rsp + 0x68]
lea r8d, [rsi + 1]
mov rcx, rbx
mov edi, edx
mov word [rbx + rdx*2], bp
call fcn.140328524
test eax, eax
js 0x140328637
xor edx, edx
mov word [rbx + rdi*2], r15w
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x140328570
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
cmp eax, 0xb7
je 0x140328570
jmp 0x140328591
mov eax, 0x80070057
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x140328838
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, dword [rcx + 0x808]
mov r13, r9
mov r9, qword [rcx + 0x800]
xor r15d, r15d
mov r12b, byte [rcx + 0x80c]
mov r10, r8
mov qword [rsp + 0x40], r9
mov r14, rcx
mov dword [rsp + 0x48], eax
test r13, r13
je 0x1403289df
mov dl, byte [rsp + 0x4b]
lea r11, [0x1403ecdc0]
mov r8b, byte [rsp + 0x4a]
mov al, byte [rsp + 0x49]
mov cl, byte [r15 + r10]
cmp cl, r12b
jne 0x1403288b2
cmp cl, dl
jne 0x1403288b2
cmp cl, r8b
jne 0x1403288b2
cmp cl, al
je 0x1403289cf
movzx r10d, al
mov byte [rsp + 0x48], al
movzx r9d, cl
movzx ebx, r8b
mov esi, dword [r11 + r10*4]
movzx ebp, dl
movzx r8d, r12b
mov r12b, cl
mov byte [rsp + 0x4b], r8b
mov edi, r8d
mov byte [rsp + 0x4a], dl
mov edx, ebx
mov r11d, dword [r11 + rbp*4]
mov eax, r11d
shr eax, 8
movzx ecx, al
mov eax, esi
shr eax, 0x10
movzx eax, al
xor rcx, rax
mov byte [rsp + 0x49], bl
shr r11d, 0x10
lea rax, [0x1403ecdc0]
movzx eax, byte [rax + r9*4]
xor rcx, rax
shr esi, 8
lea rax, [0x1403ecdc0]
mov r8d, dword [rax + r8*4]
mov ebx, dword [rax + rbx*4]
mov eax, r8d
inc qword [r14 + rcx*8]
shr eax, 8
movzx ecx, al
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor rcx, rax
shr r8d, 0x10
lea rax, [0x1403ecdc0]
shr ebx, 8
movzx eax, byte [rax + r10*4]
mov r10, qword [rsp + 0x50]
xor rcx, rax
lea rax, [0x1403ecdc0]
mov r9d, dword [rax + r9*4]
mov eax, r9d
shr eax, 8
inc qword [r14 + rcx*8]
movzx eax, al
shr r9d, 0x10
movzx ecx, r11b
lea r11, [0x1403ecdc0]
xor rcx, rax
movzx eax, byte [r11 + rdx*4]
mov dl, byte [rsp + 0x4b]
xor rcx, rax
movzx eax, sil
inc qword [r14 + rcx*8]
movzx ecx, r8b
mov r8b, byte [rsp + 0x4a]
xor rcx, rax
movzx eax, byte [r11 + rbp*4]
xor rcx, rax
movzx eax, r9b
mov r9, qword [rsp + 0x40]
inc qword [r14 + rcx*8]
movzx ecx, bl
xor rcx, rax
movzx eax, byte [r11 + rdi*4]
xor rcx, rax
mov al, byte [rsp + 0x49]
inc qword [r14 + rcx*8]
add r9, 5
mov qword [rsp + 0x40], r9
inc r15
cmp r15, r13
jb 0x140328898
mov eax, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
mov dword [r14 + 0x808], eax
mov byte [r14 + 0x80c], r12b
mov qword [r14 + 0x800], r9
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret