joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801fb200
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1801fb23a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1801fb23f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1801fb288
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1801fb288
dec r8
sub rdx, 1
jne 0x1801fb26e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1801ff850
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1801ff930
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1802b7c50]
cmp ecx, 0xffffffff
jne 0x1801ff94e
xor esi, esi
jmp 0x1801ff957
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x1801ffa4b
cmp qword [rsi + 0x30], 0
jne 0x1801ff97d
cmp qword [rsi + 0x18], 0
je 0x1801ffa24
mov rbx, qword [rsi + 0x18]
jmp 0x1801ff990
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1801ff9e4
nop word [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1801ff9c7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x1801ff990
cmp qword [rsi + 0x30], 0
je 0x1801ff96c
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1801ffa0c
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1801ffa0c
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.1801fed40
cmp qword [rsi + 0x30], 0
jne 0x1801ff9f0
jmp 0x1801ff965
lea rdx, [0x1801ff670]
lea rcx, [0x1802c0c00]
call fcn.1801ff210
mov ecx, dword [0x1802b7c50]
cmp ecx, 0xffffffff
je 0x1801ffa4b
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x1801ffa7d
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1801ffa7d
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1801ff930
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1801ff930
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1802b7c50]
cmp ecx, 0xffffffff
jne 0x1801ff94e
xor esi, esi
jmp 0x1801ff957
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x30], rsi
test rsi, rsi
je 0x1801ffa4b
cmp qword [rsi + 0x30], 0
jne 0x1801ff97d
cmp qword [rsi + 0x18], 0
je 0x1801ffa24
mov rbx, qword [rsi + 0x18]
jmp 0x1801ff990
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1801ff9e4
nop word [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1801ff9c7
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x1801ff990
cmp qword [rsi + 0x30], 0
je 0x1801ff96c
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1801ffa0c
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1801ffa0c
call qword [rbx + 0x28]
mov rdx, rbx
lea rcx, [rsi + 0x28]
call fcn.1801fed40
cmp qword [rsi + 0x30], 0
jne 0x1801ff9f0
jmp 0x1801ff965
lea rdx, [0x1801ff670]
lea rcx, [0x1802c0c00]
call fcn.1801ff210
mov ecx, dword [0x1802b7c50]
cmp ecx, 0xffffffff
je 0x1801ffa4b
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x1801ffa7d
mov eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x1801ffa7d
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18032497c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
or rax, rbx
push rsi
push rdi
movzx si, r13b
sub esi, r10d
sub rsp, 0x40
sal al, 0x81
ror sil, 0x88
shrd eax, r10d, 0x16
mov rax, qword [0x1802b7c00]
bt r10, rsi
btr r10w, 0x9e
xor rax, rsp
or r10b, r8b
sbb r10b, 0xbb
mov qword [rsp + 0x30], rax
mov r10, r8
bsf rsi, rdi
mov rsi, rcx
cmp sp, r8w
stc
cmp r14w, 0x63ae
test edx, edx
jmp 0x1803249d7
jle 0x180324a2e
mov rbx, qword [rsi + 0x18]
lea rdi, [rsi + 0x10]
rcl rcx, cl
add rbx, 0xfffffffffffffff0
mov ecx, r14d
adc cx, 0x107
jmp 0x1803249f9
movsxd rcx, edx
test r12w, bx
shl rcx, 4
stc
jmp 0x180324a0a
lea rbx, [rbx + rcx]
cmp spl, 0xb4
stc
cmc
cmp rbx, qword [rdi]
jmp 0x180324a1c
jb 0x180324a8e
mov rbx, qword [0x1802c4040]
jmp 0x180324a8e
cmp edx, 0xffffd8f0
jmp 0x180324a39
jle 0x180324a6d
movsxd rbx, edx
movzx di, r10b
sbb dil, 0x27
neg dil
lea rdi, [rcx + 0x10]
shl rbx, 4
test r13, 0xffffffffaa848331
cmp spl, r11b
add rbx, qword [rdi]
jmp 0x180324a68
jmp 0x180324a8e
call fcn.1800c9c10
mov rbx, rax
movsxd rdi, r8d
xchg dil, dil
mov dil, 0x98
lea rdi, [rsi + 0x10]
jmp 0x180324a8e
mov r8, 0xffffffffffffffff
jmp 0x180324a9a
inc r8
clc
test bpl, 7
cmp byte [r10 + r8], 0
jmp 0x180324aac
jne 0x180324a9a
mov rdx, r10
bswap cx
mov rcx, rsi
jmp 0x180324ac0
call fcn.18032c281
mov r9, qword [rdi]
bt ecx, r10d
lea r8, [rsp + 0x20]
movsxd rdx, r10d
clc
movsx cx, r12b
sub r9, 0x10
mov qword [rsp + 0x20], rax
jmp 0x180324ae8
mov rdx, rbx
movzx cx, dil
movsx rcx, r15w
mov dword [rsp + 0x2c], 5
movzx rcx, r14w
mov ecx, 0x59215905
mov rcx, rsi
jmp 0x180324b0d
call fcn.1803311e9
add qword [rdi], 0xfffffffffffffff0
sar ch, cl
bsr cx, r8w
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
jmp 0x180324b2a
call fcn.1801fc6e0
add rsp, 0x40
mov si, dx
jmp 0x180324b3b
pop rdi
mov esi, 0xcb20c4b9
pop rsi
movsx ebx, si
pop rbx
ret
Function at 0x18032a2ff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
btc r11w, r10w
seto r10b
mov r8, qword [rcx + 0x68]
inc r11w
mov r11, rdx
sbb r10b, cl
mov r10, rcx
test bpl, 0x20
cmp bh, 0x38
test r8, r8
je 0x18032a4b5
nop word [rax + rax]
cmp qword [r8 + 8], r11
jmp 0x18032a33f
jb 0x18032a4b5
mov rax, qword [r8 + 0x20]
not ch
jmp 0x18032a354
lea rdx, [r8 + 0x10]
btc cx, ax
mov qword [r10 + 0x68], rax
mov rcx, qword [r8 + 0x18]
dec al
mov eax, 0x293f7519
btr ax, 0x8f
mov rax, qword [rdx]
mov qword [rcx + 0x10], rax
bt cx, ax
btr ax, cx
movsx rax, r10w
mov rax, qword [r8 + 0x18]
mov ch, 0x22
btc ecx, r10d
ror cl, cl
mov rcx, qword [rdx]
test r10, 0x1c39e31f
test r9b, r11b
mov qword [rcx + 0x18], rax
rol al, 0x23
mov rax, qword [r8 + 8]
cmc
test ah, 0xbd
clc
movups xmm0, xmmword [rax]
bt ax, r11w
nop
mov ah, 0x23
movups xmmword [rdx], xmm0
sub ax, r13w
xor ax, 0xb23d
movzx eax, byte [r8 + 2]
test r10w, r8w
mov qword [r8 + 8], rdx
test spl, 0x31
clc
test al, 7
jmp 0x18032a3de
jne 0x18032a494
mov r9, qword [r10 + 8]
bswap ecx
movzx ecx, byte [r9 + r10 + 0x29]
dec cl
stc
cmp r14b, 0xa6
cmp cl, 2
jmp 0x18032a3ff
ja 0x18032a45e
or al, 4
jmp 0x18032a40c
mov byte [r8 + 2], al
test rsp, r9
jmp 0x18032a418
cmp dword [rdx + 0xc], 5
jmp 0x18032a421
jl 0x18032a494
mov rdx, qword [rdx]
jmp 0x18032a431
test byte [rdx + 2], 3
jmp 0x18032a43a
je 0x18032a494
mov r9, qword [r10 + 8]
bswap cx
movzx ecx, byte [r9 + r10 + 0x29]
jmp 0x18032a452
dec cl
clc
cmp cl, 2
jbe 0x18032a47f
movzx ecx, byte [r9 + r10 + 0x28]
cmc
and al, 0xf8
clc
cmp r10b, 0x38
and cl, 3
or cl, al
mov byte [r8 + 2], cl
jmp 0x18032a47a
jmp 0x18032a494
lea rcx, [r10 + 8]
test rax, rax
clc
add rcx, r9
jmp 0x18032a48f
call fcn.1800d5930
mov r8, qword [r10 + 0x68]
test r11, 0xfffffffff8279383
cmp r15d, 0xa60b7c05
cmc
test r8, r8
jmp 0x18032a4af
jne 0x18032a336
add rsp, 0x28
jmp 0x18032a4be
ret
Function at 0x18032bb05
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1802b7c00]
xor rax, rsp
movsxd rdx, esp
inc ecx
dec dh
mov qword [rsp + 0x28], rax
movsxd rax, r14d
and rdx, 0x2128ab9
mov ecx, dword [0x1802c0be8]
btc eax, 0x3b
movzx rdx, r13w
mov rax, qword gs:[0x58]
sar dl, cl
rcl dh, cl
mov edx, 4
mov rax, qword [rax + rcx*8]
stc
cmc
mov eax, dword [rdx + rax]
cmc
cmp dword [0x1802c4410], eax
jmp 0x18032bb5e
jle 0x18032bbe2
lea rcx, [0x1802c4410]
jmp 0x18032bb70
call fcn.1801fcc60
cmp dword [0x1802c4410], 0xffffffff
jmp 0x18032bb81
jne 0x18032bbe2
lea rcx, [rsp + 0x20]
jmp 0x18032bb91
mov qword [rsp + 0x20], 0
jmp 0x18032bb9f
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movsd xmm1, qword [0x1802889d8]
mov cl, reloc.WS2_32.dll_send
xchg ecx, ecx
lea rcx, [0x1802c4410]
jmp 0x18032bbbd
xorps xmm0, xmm0
jmp 0x18032bbc5
cvtsi2sd xmm0, qword [rsp + 0x20]
divsd xmm1, xmm0
movsd qword [0x1802c4408], xmm1
jmp 0x18032bbdd
call fcn.1801fcbf4
lea rcx, [rsp + 0x20]
jmp 0x18032bbec
mov qword [rsp + 0x20], 0
jmp 0x18032bbfa
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x20]
mulsd xmm0, qword [0x1802c4408]
mov rcx, qword [rsp + 0x28]
clc
test r10d, 0xcc086b19
xor rcx, rsp
jmp 0x18032bc27
call fcn.1801fc6e0
add rsp, 0x38
jmp 0x18032bc35
ret
Function at 0x1400020a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x90
mov dword [rsp + 0x74], edx
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x88]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x68]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0x20]
add rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x48]
cmp eax, dword [rcx + 0x14]
jae 0x140002271
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x24]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x20]
add rax, rcx
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x84], 0xde5f
mov eax, dword [rsp + 0x84]
ror eax, 6
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x88]
movsx eax, byte [rax]
cmp eax, 0x61
jl 0x1400021d1
mov rax, qword [rsp + 0x88]
movsx eax, byte [rax]
sub eax, 0x20
add eax, dword [rsp + 0x84]
mov dword [rsp + 0x84], eax
jmp 0x1400021ea
mov rax, qword [rsp + 0x88]
movsx eax, byte [rax]
add eax, dword [rsp + 0x84]
mov dword [rsp + 0x84], eax
mov rax, qword [rsp + 0x88]
mov rcx, rax
add rcx, 1
mov qword [rsp + 0x88], rcx
cmp byte [rax + 1], 0
jne 0x14000218b
mov eax, dword [rsp + 0x84]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
cmp eax, dword [rsp + 0x74]
jne 0x14000225c
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x24]
movzx ecx, word [rcx + rdx*2]
mov eax, dword [rax + rcx*4]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x68]
add rax, qword [rsp + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x78], rax
jmp 0x14000227a
jmp 0x140002261
mov eax, dword [rsp + 0x24]
add eax, 1
mov dword [rsp + 0x24], eax
jmp 0x140002136
mov qword [rsp + 0x78], 0
mov rax, qword [rsp + 0x78]
add rsp, 0x90
ret
Function at 0x140004a60
Capabilities:
Create thread

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
lea rcx, [rbp + 0x10]
call fcn.140004c50
lea rcx, [rbp - 9]
mov qword [rbp - 0x48], rcx
call fcn.140004c90
mov r8, qword [rbp - 0x48]
lea rcx, [rbp - 8]
mov edx, 2
call fcn.140004ca0
jmp 0x140004aa5
mov dword [rbp - 0x10], 0
cmp dword [rbp - 0x10], 2
jge 0x140004b57
mov eax, dword [rbp - 0x10]
add eax, 1
mov dword [rbp - 0x4c], eax
movsxd rdx, dword [rbp - 0x10]
lea rcx, [rbp - 8]
call fcn.140004cf0
mov ecx, dword [rbp - 0x4c]
mov dword [rax], ecx
movsxd rdx, dword [rbp - 0x10]
lea rcx, [rbp - 8]
call fcn.140004cf0
mov dword [rax + 4], 0xa
movsxd rdx, dword [rbp - 0x10]
lea rcx, [rbp - 8]
call fcn.140004cf0
mov r9, rax
xor eax, eax
mov edx, eax
lea r8, [0x140004960]
xor eax, eax
mov rcx, rdx
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x140004b37
mov dword [rbp - 0x1c], 1
jmp 0x140004bd1
lea rcx, [rbp + 0x10]
lea rdx, [rbp - 0x18]
call fcn.140004d20
jmp 0x140004b49
mov eax, dword [rbp - 0x10]
add eax, 1
mov dword [rbp - 0x10], eax
jmp 0x140004aac
lea rax, [rbp + 0x10]
mov qword [rbp - 0x28], rax
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.140004d50
mov rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x38]
call fcn.140004da0
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x38]
call fcn.140004df0
test al, 1
jne 0x140004b93
jmp 0x140004bca
lea rcx, [rbp - 0x30]
call fcn.140004e20
mov rax, qword [rax]
mov qword [rbp - 0x40], rax
mov rcx, qword [rbp - 0x40]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x30]
call fcn.140004e40
jmp 0x140004b79
mov dword [rbp - 0x1c], 0
lea rcx, [rbp - 8]
call fcn.140004e70
lea rcx, [rbp + 0x10]
call fcn.140004e70
nop
add rsp, 0xb0
pop rbp
ret
Function at 0x140008230
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push rbp
sub rsp, 0x310
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x288], 0xfffffffffffffffe
mov qword [rbp - 0x58], rcx
mov rax, rcx
mov qword [rbp - 0x50], rax
mov qword [rbp + 0x280], rcx
mov byte [rbp + 0x27f], 0
call fcn.140004c50
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, 0x104
lea rdx, [rbp + 0x170]
mov qword [rbp - 0x48], rdx
call rax
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp + 0x130]
call fcn.1400029d0
jmp 0x140008297
lea r8, [0x14044ad11]
lea rcx, [rbp + 0x150]
lea rdx, [rbp + 0x130]
call fcn.140007960
jmp 0x1400082b6
lea rcx, [rbp + 0x130]
call fcn.140002a50
lea rcx, [rbp + 0x150]
call fcn.140008460
mov rcx, rax
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rbp - 0x18], rax
mov rax, 0xffffffffffffffff
cmp qword [rbp - 0x18], rax
jne 0x140008303
mov byte [rbp + 0x27f], 1
mov dword [rbp - 0x1c], 1
jmp 0x140008369
jmp 0x140008308
lea rdx, [rbp + 0x1c]
lea rcx, [rbp - 0x40]
call fcn.1400029d0
jmp 0x14000831a
mov rcx, qword [rbp - 0x58]
lea rdx, [rbp - 0x40]
call fcn.140008480
jmp 0x14000832c
lea rcx, [rbp - 0x40]
call fcn.140002a50
mov rcx, qword [rbp - 0x18]
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 0
jne 0x140008308
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_FindClose]
mov byte [rbp + 0x27f], 1
mov dword [rbp - 0x1c], 1
jmp 0x140008369
lea rcx, [rbp + 0x150]
call fcn.140002a50
test byte [rbp + 0x27f], 1
jne 0x140008390
jmp 0x140008387
mov rcx, qword [rbp - 0x58]
call fcn.140007b10
mov rax, qword [rbp - 0x50]
add rsp, 0x310
pop rbp
ret
Function at 0x140014b40
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov qword [rsp], 0
mov rax, qword [rsp]
cmp rax, qword [rsp + 0x18]
jae 0x140014ba7
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp]
movzx eax, byte [rax + rcx]
xor rax, qword [rsp + 8]
mov qword [rsp + 8], rax
movabs rax, 0x100000001b3
imul rax, qword [rsp + 8]
mov qword [rsp + 8], rax
mov rax, qword [rsp]
add rax, 1
mov qword [rsp], rax
jmp 0x140014b5b
mov rax, qword [rsp + 8]
add rsp, 0x20
ret
Function at 0x140033520
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x78], r8
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x78], 0
jg 0x14003355d
mov qword [rsp + 0x80], 0
jmp 0x140033729
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x68], 0
je 0x14003358e
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
call fcn.14002bea0
mov qword [rsp + 0x80], rax
jmp 0x140033729
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x58], rax
call fcn.14002ccf0
mov qword [rsp + 0x50], rax
xor eax, eax
cmp rax, qword [rsp + 0x50]
jae 0x14003362d
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
call fcn.14000cb50
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
call fcn.14002cc40
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.14000ccf0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x48]
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
sub rax, rdx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x48]
mov edx, eax
call fcn.14002cc80
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x80], 0
je 0x140033717
mov rcx, qword [rsp + 0x30]
call fcn.140033d80
mov qword [rsp + 0x40], 0xfff
mov eax, 0xfff
cmp rax, qword [rsp + 0x60]
jae 0x1400336d5
mov rax, qword [rsp + 0x30]
mov r9, qword [rax + 0x80]
mov rcx, qword [rsp + 0x70]
mov edx, 1
mov r8d, 0xfff
call fcn.1403a0dd0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x60]
sub rax, rcx
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x38], 0xfff
je 0x1400336d0
mov rax, qword [rsp + 0x58]
sub rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
jmp 0x140033729
jmp 0x140033653
xor eax, eax
cmp rax, qword [rsp + 0x60]
jae 0x140033712
mov rax, qword [rsp + 0x30]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov edx, 1
call fcn.1403a0dd0
mov rcx, rax
mov rax, qword [rsp + 0x60]
sub rax, rcx
mov qword [rsp + 0x60], rax
jmp 0x140033717
mov rax, qword [rsp + 0x58]
sub rax, qword [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
add rsp, 0x88
ret
Function at 0x140033740
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
cmp qword [rax + 0x68], 0
je 0x140033786
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
call fcn.14002bfe0
mov qword [rsp + 0x60], rax
jmp 0x140033894
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
call fcn.14002cd40
mov qword [rsp + 0x38], rax
xor eax, eax
cmp rax, qword [rsp + 0x58]
jge 0x140033835
xor eax, eax
cmp rax, qword [rsp + 0x38]
jge 0x140033835
mov rax, qword [rsp + 0x58]
cmp rax, qword [rsp + 0x38]
jge 0x1400337d3
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.14002c840
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
mov rcx, rax
call fcn.14000ccf0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x58]
sub rax, rdx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x38]
mov edx, eax
call fcn.14002cd90
xor eax, eax
cmp rax, qword [rsp + 0x58]
jge 0x140033885
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x80], 0
je 0x140033885
mov rax, qword [rsp + 0x30]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov edx, 1
call fcn.1403a1624
mov rcx, rax
mov rax, qword [rsp + 0x58]
sub rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x40]
sub rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x140034140
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x88
mov qword [rsp + 0x78], rcx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
cmp qword [rax + 0x68], 0
je 0x140034170
mov rax, qword [rsp + 0x38]
test byte [rax + 0x71], 1
jne 0x14003417d
mov byte [rsp + 0x87], 1
jmp 0x1400342cb
call fcn.14002caf0
mov rcx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rsp + 0x34], eax
call fcn.14002caf0
mov edx, dword [rsp + 0x34]
mov ecx, eax
call fcn.14002cb50
test al, 1
jne 0x1400341b0
jmp 0x1400341bd
mov byte [rsp + 0x87], 0
jmp 0x1400342cb
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x70], 0x20
mov rcx, qword [rdx + 0x68]
lea r9, [rsp + 0x70]
add rdx, 0x74
mov rax, rsp
lea r8, [rsp + 0x48]
mov qword [rax + 0x20], r8
lea r8, [rsp + 0x50]
call fcn.140034320
mov ecx, eax
mov dword [rsp + 0x30], ecx
test eax, eax
je 0x140034225
jmp 0x140034201
mov eax, dword [rsp + 0x30]
sub eax, 1
je 0x14003422e
jmp 0x140034213
mov eax, dword [rsp + 0x30]
sub eax, 3
je 0x1400342ad
jmp 0x1400342c3
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x71], 0
mov rax, qword [rsp + 0x48]
lea rcx, [rsp + 0x50]
sub rax, rcx
mov qword [rsp + 0x40], rax
xor eax, eax
cmp rax, qword [rsp + 0x40]
jae 0x140034295
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov edx, 1
call fcn.1403a1624
mov rcx, rax
mov rax, qword [rsp + 0x28]
cmp rax, rcx
je 0x140034295
mov byte [rsp + 0x87], 0
jmp 0x1400342cb
mov rax, qword [rsp + 0x38]
mov al, byte [rax + 0x71]
xor al, 0xff
and al, 1
mov byte [rsp + 0x87], al
jmp 0x1400342cb
mov rax, qword [rsp + 0x38]
mov byte [rax + 0x71], 0
mov byte [rsp + 0x87], 1
jmp 0x1400342cb
mov byte [rsp + 0x87], 0
mov al, byte [rsp + 0x87]
and al, 1
movzx eax, al
add rsp, 0x88
ret

Function at 0x14003ae80
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
call fcn.140005660
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x2c], eax
mov rcx, qword [rsp + 0x50]
call fcn.14000c560
mov r8d, dword [rsp + 0x2c]
mov rdx, rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x10]
lea r9, [rsp + 0x40]
xor eax, eax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rsp + 0x3c], eax
add rsp, 0x58
ret

Function at 0x1400589f0
Capabilities:
Encode data using xor

Disassembly:
endbr64
xor rax, rax
xor r10, r10
cmp r8, 0
je 0x140058a4d
cmp r8, 0x10
jne 0x140058a30
mov r10, qword [rcx]
mov r11, qword [rcx + 8]
mov r8d, 1
xor r10, qword [rdx]
xor r11, qword [rdx + 8]
or r10, r11
cmovne rax, r8
repz ret
mov r10b, byte [rcx]
lea rcx, [rcx + 1]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
or al, r10b
dec r8
jne 0x140058a30
neg rax
shr rax, 0x3f
repz ret