joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028be0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
lea rcx, str.msvcrt.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.rand_s
mov rcx, rax
call rbx
test rax, rax
je 0x140028c28
mov rcx, r12
mov qword [dbg.init_rand_s], rax
add rsp, 0x28
pop rbx
pop r12
jmp rax
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SystemFunction036
mov rcx, rax
call rbx
mov qword [0x140102fe0], rax
lea rax, [dbg.mingw_rand_s]
jmp 0x140028c0f

Function at 0x14002ad90
Capabilities:
Read file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov r9, qword [rcx + 0x40]
mov rsi, rdx
mov rbx, rcx
mov edx, 1
mov rcx, rsi
call sym.fread
mov edx, 0xffffffff
test rax, rax
jle 0x14002adbc
movzx edx, byte [rsi + rax - 1]
mov dword [rbx + 0x48], edx
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x14002ba30
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x30
cmp byte [0x1400d0eb0], 0
jne 0x14002bb3a
mov byte [0x1400d0eb0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x14002bb10
mov r12, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [r12], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add r12, rax
mov rcx, r12
call sym.__cxa_demangle
mov ecx, 2
mov rbx, qword [dbg.__acrt_iob_func]
mov r13, rax
call rbx
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x14002bb01
call rbx
mov rcx, r12
mov rdx, rax
call sym.fputs
mov ecx, 2
call rbx
mov r8d, 2
mov edx, 1
lea rcx, [0x1400d1951]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14002bafc
mov rcx, r13
call sym.free
call sym.__cxa_rethrow
call rbx
mov rcx, r13
mov rdx, rax
call sym.fputs
jmp 0x14002bacb
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x14002bbcf
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov r12, rax
call rbx
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rbx
mov rdx, rax
mov rcx, r12
call sym.fputs
mov ecx, 2
call rbx
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x14002bb35
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x14002bb35
Function at 0x140085c20
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x140085c47
call rbp
cmp dword [rax], 4
jne 0x140085c64
mov rcx, rdi
call method.std::__basic_file_char_.fd__
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sym.read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x140085c40
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400991b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400991d8
xor ecx, ecx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140099220
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400991f0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14009922c
call rbp
cmp dword [rax], 4
je 0x1400991f0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140014580
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x1400145b0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400145d8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400145da
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140014633
test ecx, ecx
jle 0x14001460e
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140014633
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140014633
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140014660
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140014690
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov rdx, qword [rax]
test rdx, rdx
je 0x1400146b8
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400146ba
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140014720
test ecx, ecx
jle 0x1400146ee
cmp rbx, rbp
mov rcx, r14
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x50]
add r14, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x38]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140014720
cmp qword [rdi + 0x80], 0
je 0x140014720
mov rcx, rdi
call fcn.140014eb0
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140003408
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r8d, 0x5c
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.140145480
mov rax, qword [rsp + 0x30]
mov dword [rax], 0x67452301
mov rax, qword [rsp + 0x30]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rsp + 0x30]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rsp + 0x30]
mov dword [rax + 0xc], 0x10325476
mov eax, 1
add rsp, 0x28
ret

Function at 0x140007f00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 4], 0
mov dword [rsp], 0xffffffff
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x140007f93
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov dword [rsp + 8], 7
jmp 0x140007f5e
mov eax, dword [rsp + 8]
dec eax
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0
jl 0x140007f87
mov eax, dword [rsp]
and eax, 1
neg eax
mov dword [rsp + 0x10], eax
mov eax, dword [rsp]
shr eax, 1
mov ecx, dword [rsp + 0x10]
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp], eax
jmp 0x140007f54
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jmp 0x140007f18
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x140107478
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov rax, qword [rsp + 8]
mov qword [rax + 8], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x50], 0x10325476
ret

Function at 0x140109340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140190010]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x34], 0
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xa0]
call fcn.140109558
lea rcx, [rsp + 0x40]
call fcn.140005c70
nop
mov edx, 0x20
lea rcx, [rsp + 0x40]
call fcn.1401096b0
mov dword [rsp + 0x30], 0
jmp 0x1401093ab
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x10
jge 0x14010950f
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x60], 0x62
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x60], 0x30
mov eax, 1
imul rax, rax, 0x10
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x11
jae 0x1401093ea
jmp 0x1401093ef
call fcn.140143278
mov rax, qword [rsp + 0x38]
mov byte [rsp + rax + 0x60], 0
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x60], 0x64
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x60], 0x38
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x60], 0x32
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x60], 0x35
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x60], 0x63
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x60], 0x39
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x60], 0x37
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x60], 0x33
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x60], 0x66
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x60], 0x36
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x60], 0x61
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x60], 0x34
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x60], 0x65
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x60], 0x31
movsxd rax, dword [rsp + 0x30]
movzx eax, byte [rsp + rax + 0x78]
sar eax, 4
and eax, 0xf
cdqe
mov al, byte [rsp + rax + 0x60]
mov byte [rsp + 0x20], al
mov dl, byte [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400866d0
movsxd rax, dword [rsp + 0x30]
movzx eax, byte [rsp + rax + 0x78]
and eax, 0xf
cdqe
mov al, byte [rsp + rax + 0x60]
mov byte [rsp + 0x28], al
mov dl, byte [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1400866d0
jmp 0x1401093a1
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xa8]
call fcn.140006820
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x40]
call fcn.140006c84
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1401430e0
add rsp, 0x98
ret
Function at 0x14010cea4
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 8]
mov qword [rax + 0x28], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x5be0cd19
ret
Function at 0x1401237b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
movzx r10d, byte [rcx]
mov r9, rdx
mov r8, rcx
test r10b, r10b
je 0x1401237f0
movzx ecx, byte [r9]
test cl, cl
je 0x1401237f0
call fcn.140123790
movzx ecx, r10b
movzx edx, al
call fcn.140123790
cmp al, dl
jne 0x140123807
movzx r10d, byte [r8 + 1]
inc r8
inc r9
test r10b, r10b
jne 0x1401237c3
xor ecx, ecx
mov eax, ecx
cmp byte [r8], al
sete al
cmp byte [r9], cl
setne cl
xor eax, ecx
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
test rcx, rcx
je 0x14012381f
test rdx, rdx
je 0x14012382a
jmp 0x1401237b0
test rdx, rdx
jne 0x14012382a
mov eax, 1
ret
xor eax, eax
ret
Function at 0x1401297c0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, qword [rsp + 0x50]
xor eax, eax
mov qword [r9], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov qword [r14], rax
test r8, r8
jne 0x140129808
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], al
jne 0x140129800
lea rcx, [rbx + 2]
movabs rbp, 0xaaaaaaaaaaaaaaab
mov rax, rbp
mul rcx
shr rdx, 1
lea rcx, [rdx*4 + 1]
call qword [fcn.14014a0a4]
mov rcx, rax
mov r9, rax
test rax, rax
jne 0x140129841
lea eax, [r9 + 0x1b]
jmp 0x140129932
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp rbx, 3
jb 0x1401298c7
mov rax, rbp
mul rbx
mov r8, rdx
shr r8, 1
imul rax, r8, 0xfffffffffffffffd
add rbx, rax
movzx eax, byte [rdi]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rcx], al
movzx edx, byte [rdi]
movzx eax, byte [rdi + 1]
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + r10]
mov byte [rcx + 1], al
movzx edx, byte [rdi + 1]
movzx eax, byte [rdi + 2]
and edx, 0xf
shr rax, 6
shl rdx, 2
or rdx, rax
movzx eax, byte [rdx + r10]
mov byte [rcx + 2], al
movzx eax, byte [rdi + 2]
add rdi, 3
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rcx + 3], al
add rcx, 4
sub r8, 1
jne 0x140129861
test rbx, rbx
je 0x140129924
movzx eax, byte [rdi]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rcx], al
movzx edx, byte [rdi]
and edx, 3
shl rdx, 4
cmp rbx, 1
jne 0x1401298fa
movzx eax, byte [rdx + r10]
mov byte [rcx + 1], al
mov word [rcx + 2], 0x3d3d
jmp 0x140129920
movzx eax, byte [rdi + 1]
shr rax, 4
or rax, rdx
movzx eax, byte [rax + r10]
mov byte [rcx + 1], al
movzx eax, byte [rdi + 1]
and eax, 0xf
movzx eax, byte [r10 + rax*4]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
add rcx, 4
mov byte [rcx], 0
sub rcx, r9
mov qword [r14], rcx
xor eax, eax
mov qword [rsi], r9
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140134030
Capabilities:
Connect socket

Disassembly:
mov rcx, qword [rcx + 0x10]
test r8b, r8b
jne 0x14013404f
mov r8d, dword [rcx + 0x14]
lea rdx, [rcx + 0x18]
mov rcx, qword [rcx + 0x98]
jmp qword [sym.imp.WS2_32.dll_connect]
mov eax, 0xffffffff
ret

Function at 0x140134900
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x10]
mov rdi, rdx
mov rsi, rcx
mov r8d, dword [rbx + 0x14]
lea rdx, [rbx + 0x18]
mov rcx, qword [rbx + 0x98]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140134952
call fcn.140121bc0
mov r8d, eax
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140133aa0
mov rdx, rdi
mov rcx, rsi
call fcn.140133c80
mov rcx, qword [rbx + 0x98]
call fcn.14013f320
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14013f810
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov ecx, 0x58
mov esi, r8d
mov rdi, rdx
call qword [fcn.14014a0a4]
mov rbx, rax
test rax, rax
jne 0x14013f84d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x38], rbp
lea rax, fcn.14013f6e0
mov qword [rbx], rax
lea rcx, [rbx + 0x18]
mov qword [rbx + 8], rcx
lea rax, [rcx + 0x10]
mov qword [rbx + 0x10], rax
cmp esi, 0x40
jbe 0x14013f8a2
call fcn.14013f6e0
mov rcx, qword [rbx + 8]
mov r8d, esi
mov rdx, rdi
call fcn.14013f710
mov rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
add rdi, 0x10
mov rcx, rdi
call fcn.14013f720
mov rcx, qword [rbx + 8]
mov esi, 0x20
call fcn.14013f6e0
mov rcx, qword [rbx + 0x10]
call fcn.14013f6e0
xor ebp, ebp
test rsi, rsi
je 0x14013f90a
mov rbp, rsi
nop word [rax + rax]
movzx eax, byte [rdi]
lea rdx, [rsp + 0x30]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x30], al
mov rcx, qword [rbx + 8]
call fcn.14013f710
movzx eax, byte [rdi]
lea rdx, [rsp + 0x30]
xor al, 0x5c
lea rdi, [rdi + 1]
mov byte [rsp + 0x30], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call fcn.14013f710
sub rsi, 1
jne 0x14013f8c0
cmp rbp, 0x40
jae 0x14013f944
mov edi, 0x40
sub rdi, rbp
mov rcx, qword [rbx + 8]
lea rdx, [0x14017bdcf]
mov r8d, 1
call fcn.14013f710
mov rcx, qword [rbx + 0x10]
lea rdx, [0x14017bdce]
mov r8d, 1
call fcn.14013f710
sub rdi, 1
jne 0x14013f912
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14013fb58
Capabilities:
Encode data using xor

Disassembly:
cmp rax, 0xffffffff81f17c64
int1
xor ecx, 0xed7eef82
xor esp, 0xffffff80
jl 0x14013fb54
int1
invalid
mov ch, al
invalid

Function at 0x14013fddb
Capabilities:
Authenticate hmac

Disassembly:
jne 0x14013fe2c
push rbx
xor dword [rsi], ebp
pop r10
and al, 0x77
cmp eax, 0x44335573
push rcx
invalid
Function at 0x14014067f
Capabilities:
Encode data using xor

Disassembly:
jnp 0x14014067a
insb byte [rdi], dx
invalid
mov dh, 0x68
stosd dword [rdi], eax
imul edi, dword [rax + 0x757c7560], 0x2b
jne 0x1401406fe
jne 0x1401406af
cmp ebp, dword [rax + 0x75]
jne 0x1401406cd
js 0x1401406c4
xor dword [r11 + 0x76], edx
pop rdi
outsb dx, byte [rsi]
xor dh, byte [riz*2 - 0x18081684]
clc
out 0xee, al
loope 0x140140692
out 0xf9, eax
in al, 0xf3
out 0xf8, eax
fcompi st(4)
out 0xf6, al
out 0xed, al
in eax, dx
loop 0x14014069e
call 0x11e0de8ab
mul cl
out dx, al
jrcxz 0x1401406ae
loope 0x1401406a9
stc
invalid
loope 0x1401406af
je 0x140140726
sub dword [rbp + 0x30], ebx
invalid
ja 0x140140701
xor dword [rcx + 0x25], eax
sub dword [rbp - 0x45], edx
mov ebx, 0xb7b6b5a9
mov ch, 0xbb
mov al, 0xbc
mov ah, 0xc4
mov al, 0xbd
lodsd eax, dword [rsi]
mov ch, 0xb0
mov ecx, 0xc2b6c1b5
mov ch, 0xb8
mov al, 0xc0
scasb al, byte [rdi]
mov ebp, 0xc2b2c2b5
mov ch, 0xb9
mov ah, 0xb9
mov al, 0xc0
mov dl, 0xb5
mov al, 0xba
lodsb al, byte [rsi]
mov edi, 0xbfb1c2b7
mov cl, 0xbf
mov dh, 0xb9
mov cl, 0xbc
stosb byte [rdi], al
ret 0xb9b3
jl 0x140140795
jae 0x14014074c
or esp, dword [rdx]
adc al, 0x23
adc ebp, dword [rdx]
or ch, byte [0x15f222e3f]
invalid
ja 0x1401407a3
pop rcx
jnp 0x140140773
outsb dx, byte [rsi]
invalid
invalid
invalid
sub rax, qword [r11 + 0x36]
sbb rbp, qword [rax]
sbb ebp, dword [rax]
adc al, 0x25
sbb dword [rdi], ebx
invalid

Function at 0x14014f81c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14014f67b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14014f67b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14014f67b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14014f67b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14014f67b
cmp dword [rcx + 0x84], 0xe
jbe 0x14014f67b
cmp dword [rcx + 0xf8], 0
je 0x14014f67b
mov ecx, ebx
call fcn.14014f738
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14014f508
nop
cmp dword [rbp + 0x20], 0
je 0x14014f6c9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14014f6d4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14014f60c
Function at 0x1401514dc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14016cd80
sub rsp, rax
mov rax, qword [0x140190010]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140160124
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14015152b
mov rax, rbp
jmp 0x140151633
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x191c00]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140161ef0
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x191c00]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14015162f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14015162f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140161ef0
test rax, rax
js 0x14015162f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14015162f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140151621
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140151621
cmp byte [rcx], 0xd
jne 0x140151607
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140151616
cmp byte [rcx + 1], 0xa
jne 0x140151616
inc rcx
jmp 0x140151616
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x190170]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1401515e9
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140151633
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1401430e0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140159d20
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x140190010]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x140173980]
mov rbp, rcx
call fcn.140162dec
xor edi, edi
test rax, rax
je 0x140159e06
mov ebx, edi
call fcn.140149c40
mov r14d, dword [rax]
call fcn.140149c40
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.140162d38
mov rsi, rax
test rax, rax
je 0x140159d97
call fcn.140149c40
mov dword [rax], r14d
jmp 0x140159dc1
call fcn.140149c40
cmp dword [rax], 0x22
jne 0x140159dfe
call fcn.140149c40
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140162d38
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x140159dfe
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x140159dc5
cmp rax, 3
je 0x140159de0
mov rcx, rsi
call fcn.140159c7c
test al, al
je 0x140159df1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x140159df1
mov dil, 1
mov rcx, rbx
call fcn.14014a0ac
mov al, dil
jmp 0x140159e08
mov rcx, rbx
call fcn.14014a0ac
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401430e0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret