joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012e73
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, rdx
mov qword [rsp + 0x30], rcx
mov eax, dword [0x14012c894]
mov ecx, dword [0x14012c8fc]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov ebp, 0x6d8b3383
mov eax, 0x8aec7b21
cmovne eax, ebp
cmp edx, 0xffffffff
sete byte [rsp + 0x27]
cmovne ebp, eax
cmp ecx, 0xa
setl byte [rsp + 0x28]
mov ecx, dword [0x14012cae8]
mov edx, dword [0x14012c7c8]
cmovge ebp, eax
mov dword [rsp + 0x2c], ebp
lea esi, [rcx - 1]
imul esi, ecx
not esi
or esi, 0xfffffffe
cmp esi, 0xffffffff
sete al
cmp edx, 0xa
setl cl
xor cl, al
mov ebp, 0x29de0911
mov eax, 0xf7bbf2e5
cmovne eax, ebp
cmp esi, 0xffffffff
cmovne ebp, eax
mov r13d, edx
cmp edx, 0xa
not esi
cmovge ebp, eax
mov eax, 0xfa0994eb
mov r14d, 0x189301e6
mov r15d, 0x8df8316d
cmp eax, 0x189301e5
jle 0x140012fdf
cmp eax, 0x3aa6444d
jg 0x140013028
cmp eax, 0x189301e6
je 0x140013055
cmp eax, 0x19256a1e
jne 0x140012f2b
test esi, esi
sete byte [rsp + 0x2a]
cmp r13d, 0xa
setl byte [rsp + 0x2b]
mov ecx, 0x8f09b624
cmp ecx, 0xf7bbf2e4
jle 0x140012f93
cmp ecx, 0xf7bbf2e5
je 0x140012fcc
cmp ecx, 0xfc3fcac4
je 0x140013066
cmp ecx, 0x29de0911
jne 0x140012f68
mov ecx, 0xfc3fcac4
jmp 0x140012f68
cmp ecx, 0x8df8316d
je 0x140012fd3
cmp ecx, 0x8f09b624
jne 0x140012f68
mov bl, byte [rsp + 0x2a]
mov cl, byte [rsp + 0x2b]
mov edx, ebx
xor dl, cl
test cl, cl
mov ecx, 0xf7bbf2e5
cmovne ecx, r15d
test bl, bl
mov ebx, 0xf7bbf2e5
cmove ecx, ebx
test dl, dl
cmovne ecx, r15d
jmp 0x140012f68
mov ecx, 0x8df8316d
jmp 0x140012f68
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov ecx, ebp
jmp 0x140012f68
cmp eax, 0xd935d6f7
jle 0x140013044
cmp eax, 0xd935d6f8
je 0x14001307f
cmp eax, 0xfa0994eb
jne 0x140012f2b
mov cl, byte [rsp + 0x27]
mov al, byte [rsp + 0x28]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x8aec7b21
cmovne eax, r14d
test cl, cl
mov ecx, 0x8aec7b21
cmove eax, ecx
test dl, dl
cmovne eax, r14d
jmp 0x140012f2b
cmp eax, 0x3aa6444e
je 0x140013099
cmp eax, 0x6d8b3383
jne 0x140012f2b
mov eax, 0xd935d6f8
jmp 0x140012f2b
cmp eax, 0x8aec7b21
jne 0x1400130a8
mov eax, 0x189301e6
jmp 0x140012f2b
test rdi, rdi
setne byte [rsp + 0x29]
mov eax, dword [rsp + 0x2c]
jmp 0x140012f2b
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov eax, 0x3aa6444e
jmp 0x140012f2b
cmp byte [rsp + 0x29], 0
mov eax, 0x8028dfde
mov ecx, 0x19256a1e
cmovne eax, ecx
xor r12d, r12d
jmp 0x140012f2b
mov eax, 0x8028dfde
mov r12, qword [rsp + 0x38]
jmp 0x140012f2b
cmp eax, 0x8028dfde
jne 0x140012f2b
mov edx, 1
mov rcx, rdi
mov r8, r12
mov rsi, qword [rsp + 0x30]
mov r9, rsi
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14010ae48
Function at 0x14005130c
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r13, rdx
mov rdi, rcx
mov ecx, 2
call qword [fcn.14010a880]
mov qword [rsp + 0x20], rax
mov eax, 0xc96a4999
mov r15d, 0x176389bb
mov esi, 0xee283388
mov r12d, 0xe41c7189
cmp eax, 0xe41c7188
jle 0x1400513ab
cmp eax, 0xe41c7189
je 0x1400515cf
cmp eax, 0xee283388
je 0x14005158d
cmp eax, 0x176389bb
jne 0x140051348
mov eax, dword [0x14012c8bc]
mov ecx, dword [0x14012c9ac]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete r8b
cmp ecx, 0xa
setl bl
xor bl, r8b
mov ebp, 0xee283388
cmovne ebp, r12d
test eax, edx
mov eax, ebp
cmove eax, r12d
cmp ecx, 0xa
cmovge eax, ebp
jmp 0x140051348
cmp eax, 0xb5bf220a
je 0x140051597
cmp eax, 0xc96a4999
jne 0x140051348
mov r14, qword [rsp + 0x20]
mov edx, 1
mov rcx, rdi
mov r8, r13
mov r9, r14
call sub.msvcrt.dll_fwrite
mov eax, 0x8656bf3f
cmp eax, 0xbb6d85dd
jg 0x140051445
cmp eax, 0xa3286bbd
jg 0x1400514a0
cmp eax, 0x8656bf3f
je 0x140051512
cmp eax, 0x92413cc9
jne 0x1400513da
mov rcx, r14
call fcn.14010ae48
mov eax, dword [0x14012ca38]
mov ecx, dword [0x14012c818]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov eax, 0xa3286bbe
mov ebp, 0xa3286bbe
jne 0x140051501
mov ebp, 0xbb6d85de
jmp 0x140051501
cmp eax, 0xfdfc5bf8
jg 0x1400514c0
cmp eax, 0xbb6d85de
je 0x140051557
cmp eax, 0xc4d4179f
jne 0x1400513da
mov eax, dword [0x14012ca38]
mov ecx, dword [0x14012c818]
lea edx, [rax - 1]
imul edx, eax
mov ebp, edx
xor ebp, 0xfffffffe
test ebp, edx
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov eax, 0xfdfc5bf9
mov esi, 0xfdfc5bf9
jne 0x140051547
mov esi, 0xa3a2143d
jmp 0x140051547
cmp eax, 0xa3286bbe
je 0x140051569
cmp eax, 0xa3a2143d
jne 0x1400513da
mov eax, 0xfdfc5bf9
jmp 0x1400513da
cmp eax, 0xfdfc5bf9
jne 0x140051573
mov eax, dword [0x14012ca38]
mov ecx, dword [0x14012c818]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov eax, 0x457decd8
mov ebp, 0x457decd8
jne 0x140051501
mov ebp, 0xa3a2143d
cmp edx, 0xffffffff
cmovne eax, ebp
cmp ecx, 0xa
cmovge eax, ebp
jmp 0x1400513da
mov eax, dword [0x14012ca38]
mov ecx, dword [0x14012c818]
lea edx, [rax - 1]
imul edx, eax
mov ebp, edx
xor ebp, 0xfffffffe
test ebp, edx
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov eax, 0x92413cc9
mov esi, 0x92413cc9
jne 0x140051547
mov esi, 0xbb6d85de
test ebp, edx
cmovne eax, esi
cmp ecx, 0xa
cmovge eax, esi
jmp 0x1400513da
mov rcx, r14
call fcn.14010ae48
mov eax, 0x92413cc9
jmp 0x1400513da
mov eax, 0xc4d4179f
jmp 0x1400513da
cmp eax, 0x457decd8
jne 0x1400513da
mov eax, 0xb5bf220a
mov esi, 0xee283388
jmp 0x140051348
mov eax, 0x176389bb
jmp 0x140051348
mov eax, dword [0x14012c8bc]
lea ecx, [rax - 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0xee283388
cmove eax, r15d
cmp dword [0x14012c9ac], 0xa
cmovge eax, esi
setl dl
xor dl, cl
cmovne eax, r15d
jmp 0x140051348
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140104b10
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.14010a880
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.14010a880
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140104b80
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14012ba14]
mov rbx, rcx
test esi, esi
jle 0x140104cb0
mov rax, qword [0x14012ba18]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x140104bcb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140104c55
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140104bb0
mov rcx, rbx
call fcn.1401055d0
mov rdi, rax
test rax, rax
je 0x140104cd2
mov rax, qword [0x14012ba18]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140105710
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14012ba18]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140104cb7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140104c4e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140104c60
add dword [0x14012ba14], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14012ba18]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140104c4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140104b10
nop dword [rax]
xor esi, esi
jmp 0x140104bd8
mov rax, qword [0x14012ba18]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140104b10
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140104b10
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140105240
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14012ba80]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14012ba60]
test rbx, rbx
je 0x14010529c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140105293
test rsi, rsi
je 0x140105293
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140105278
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1401055d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401260a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1401055f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1401055f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1401055f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14010564d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140105644
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1401055f0
add rax, 0x28
cmp rax, r9
jne 0x140105630
xor eax, eax
ret

Function at 0x140105650
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401260a0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14010566f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140105678
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14010566f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140105710
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401260a0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14010572f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140105738
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x180013e40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdi, qword [rcx + 0x10]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180013ef7
mov r10d, dword [rbx + 0x18]
xor r8d, r8d
test r10d, r10d
je 0x180013ef7
mov esi, dword [rbx + 0x20]
nop word [rax + rax]
lea rax, [rsi + r8*4]
mov edx, 0x811c9dc5
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x180013eef
nop word [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x180013ed0
cmp edx, 0xaf07e45d
je 0x180013efc
inc r8d
cmp r8d, r10d
jb 0x180013eb0
mov rdi, qword [rdi]
jmp 0x180013e80
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
mov r8, qword [rsp + 0x50]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
mov edx, 0x200
add r10, r9
lea rcx, [0x18039d910]
mov r9, qword [rsp + 0x20]
call r10
lea rax, [0x18039d910]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800156e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rcx, rcx
je 0x180015740
mov r8, qword [rcx]
test r8, r8
je 0x180015740
mov r8, qword [r8 + 0x10]
mov eax, 0xffffffff
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r8 + rcx], 0
jne 0x180015700
test ecx, ecx
je 0x18001573d
mov r9d, ecx
lea r10, [0x180136340]
nop dword [rax + rax]
movsx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, eax
shr eax, 8
xor rdx, rcx
movzx ecx, dl
xor eax, dword [r10 + rcx*4]
sub r9, 1
jne 0x180015720
not eax
ret
xor eax, eax
ret

Function at 0x180016b90
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x180016b9d
xor eax, eax
jmp 0x180016c16
mov r9, qword [rcx]
test r9, r9
jne 0x180016ba9
xor eax, eax
jmp 0x180016c16
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x180016bb6
xor eax, eax
jmp 0x180016c16
mov r10, r9
mov qword [rsp + 8], r9
xor edx, edx
mov r8d, 0xffffffff
lea r11, [0x180136340]
mov dword [rsp], edx
mov ecx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x180016be0
cmp edx, eax
jae 0x180016c0c
movsx eax, byte [r10]
xor rax, rcx
movzx ecx, al
shr r8d, 8
xor r8d, dword [r11 + rcx*4]
inc r10
mov qword [rsp + 8], r10
inc edx
jmp 0x180016bcd
not r8d
mov eax, r8d
jmp 0x180016c16
add rsp, 0x18
ret
Function at 0x180017530
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x180377ad8], 0
mov rbx, rcx
je 0x1800175a1
mov ecx, dword [0x180377bd4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800175a1
cmp dword [0x180377af4], 1
jne 0x1800175a1
lea rcx, [rbx + 0x90]
cmp rcx, 0x40000
jbe 0x1800175a1
lea rax, [rcx + 8]
movabs rdx, 0x7fffffff0000
cmp rax, rdx
jae 0x1800175a1
mov rcx, qword [rcx]
add rcx, 0x1bc
cmp rcx, 0x40000
jbe 0x1800175a1
lea rax, [rcx + 4]
cmp rax, rdx
jae 0x1800175a1
mov dword [rcx], 0x3c23d70a
add rsp, 0x20
pop rbx
ret
Function at 0x180023f60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp byte [0x18037791d], 0
jne 0x180023fc0
lea rcx, [rsp + 0x30]
mov byte [0x18037791d], 1
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
xorps xmm1, xmm1
cvtsi2ss xmm0, qword [rsp + 0x38]
cvtsi2ss xmm1, qword [rsp + 0x30]
movss dword [0x180377938], xmm0
movss dword [0x1803779f8], xmm1
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x30]
subss xmm0, dword [0x1803779f8]
divss xmm0, dword [0x180377938]
add rsp, 0x28
ret
Function at 0x180028340
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
call fcn.180017f30
mov rcx, rax
call fcn.180017e40
mov rbx, rax
test rax, rax
je 0x18002852c
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180017380
cmp dword [rsp + 0x20], 0
je 0x18002852c
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x18002852c
cmp eax, 0xfffffffe
jne 0x1800283f7
mov rcx, rbx
call fcn.1800175b0
cmp byte [0x180377a75], 0
je 0x18002852c
add rbx, 0x90
cmp rbx, 0x40000
jbe 0x18002852c
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18002852c
mov rdx, qword [rbx]
mov r8, rdx
lea r9, [rdx + 0x320]
cmp r9, 0x40000
jbe 0x1800283eb
lea rax, [r9 + 1]
cmp rax, rcx
jae 0x1800283eb
mov byte [r9], 1
lea rdx, [r8 + 0x324]
jmp 0x180028514
cmp eax, 3
jne 0x18002845f
mov rcx, rbx
call fcn.1800175b0
cmp byte [0x180377ab9], 0
je 0x180028452
lea rdx, [rbx + 0x90]
cmp rdx, 0x40000
jbe 0x180028452
lea rax, [rdx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x180028452
mov rdx, qword [rdx]
add rdx, 0x1bc
cmp rdx, 0x40000
jbe 0x180028452
lea rax, [rdx + 4]
cmp rax, rcx
jae 0x180028452
mov dword [rdx], 0x3c23d70a
mov rcx, rbx
add rsp, 0x70
pop rbx
jmp fcn.180017530
cmp eax, 2
jne 0x1800284d1
mov rcx, rbx
call fcn.1800175b0
mov rcx, rbx
call fcn.180017530
cmp byte [0x180377a74], 0
je 0x18002852c
add rbx, 0x90
cmp rbx, 0x40000
jbe 0x18002852c
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18002852c
mov rdx, qword [rbx]
add rdx, 0x250
cmp rdx, 0x40000
jbe 0x18002852c
lea rax, [rdx + 1]
cmp rax, rcx
jae 0x18002852c
mov byte [rdx], 1
add rsp, 0x70
pop rbx
ret
cmp eax, 0xffffffff
jne 0x18002852c
mov rcx, rbx
call fcn.1800175b0
cmp byte [0x180377ac1], 0
je 0x18002852c
add rbx, 0x90
cmp rbx, 0x40000
jbe 0x18002852c
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18002852c
mov rdx, qword [rbx]
add rdx, 0x320
cmp rdx, 0x40000
jbe 0x18002852c
lea rax, [rdx + 4]
cmp rax, rcx
jae 0x18002852c
mov dword [rdx], 0x3f800000
add rsp, 0x70
pop rbx
ret
Function at 0x18002a960
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18002a9d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18002a9d8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18002a9c5
nop
cmp rbx, rcx
jae 0x18002a9d8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18002a9b0
cmp rbx, rcx
jae 0x18002a9d8
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x18002a9da
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180049690
Capabilities:
Delete file

Disassembly:
sub rsp, 0xa8
movdqa xmm1, xmmword [0x180274b50]
xorps xmm0, xmm0
mov r8, qword [0x180375e80]
mov rcx, 0xffffffffffffffff
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x40], 0
movdqu xmmword [rsp + 0x50], xmm1
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1800496c0
movabs rax, 0x7fffffffffffffff
sub rax, r8
cmp rax, rcx
jb 0x18004988b
cmp qword [0x180375e88], 0xf
lea r9, [0x180375e70]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x60]
cmova r9, qword [0x180375e70]
movaps xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0x28], rdx
movaps xmmword [rsp + 0x80], xmm7
mov qword [rsp + 0x20], r8
call fcn.1800074f0
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x180049760
lea rax, [rcx + 4]
cmp rdx, 0xf
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmova rax, qword [rsp + 0x60]
mov dword [rax + rcx], 0x696e692e
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x60]
jmp 0x18004977f
lea r9, str..ini
mov qword [rsp + 0x20], 4
mov edx, 4
lea rcx, [rsp + 0x60]
call fcn.180067120
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1800497d2
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800497cd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180049810
call fcn.180114e9c
mov rdx, qword [rsp + 0x78]
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
cmp rdx, 0xf
jbe 0x18004981c
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180049817
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180049817
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180114e9c
cmp qword [rsp + 0x58], 0xf
lea rcx, [rsp + 0x40]
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180049873
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004986e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004986e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180114e9c
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0xa8
ret
call fcn.180007290
int3
Function at 0x180063b70
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x180063b80
xor al, al
add rsp, 0x38
ret
xor eax, eax
lea r8, [0x180061400]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180063bad
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x18006dcf0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18006dd4d
lea rbx, [0x18026a270]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18006dd34
cmp r10, 2
jb 0x18006dd34
cmp byte [r9], r8b
jne 0x18006dd34
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18006dd10
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18006dd8f
lea rbx, [0x18026a270]
cmp r8b, 0x23
jne 0x18006dd73
cmp byte [r9], r8b
jne 0x18006dd73
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18006dd60
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x18006ded0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18006deea
mov qword [r8], 0
call fcn.18006dda0
mov rbx, rax
test rax, rax
jne 0x18006df03
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x18006dfda
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18006dfda
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18006dfda
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18006dfda
cmp rdi, 0xffffffffffffffff
je 0x18006dfda
mov rax, qword [0x180377bf8]
test rax, rax
je 0x18006df77
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x18006dfda
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18006dfc7
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180377bf8]
test rax, rax
je 0x18006dfbc
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18006dfe3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18006dfd5
mov qword [r14], rdi
mov rax, rsi
jmp 0x18006dfe5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret