joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140180e40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x14022c910]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call fcn.140180850
test eax, eax
jne 0x140180d42
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x140180d53
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rsp + 0x30]
lea rcx, [0x14021d517]
call fcn.1400b6950
call fcn.1401d96b0
nop
nop dword [rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14022c040]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
cmp r8, 0xffec
ja 0x140180e26
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.140180200
lea rax, [rdi + 4]
lea rdx, str.0123456789abcdef
mov r9d, eax
mov ecx, eax
mov r8d, eax
and eax, 0xf
sar r9d, 4
movzx eax, byte [rdx + rax]
sar r8d, 8
and r9d, 0xf
and r8d, 0xf
sar ecx, 0xc
movzx r9d, byte [rdx + r9]
shl eax, 8
movzx r8d, byte [rdx + r8]
movsxd rcx, ecx
movzx edx, byte [rdx + rcx]
mov rcx, rbx
or eax, r9d
shl eax, 8
or eax, r8d
mov r8d, 4
shl eax, 8
or eax, edx
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], eax
call fcn.1400be850
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400be850
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x140180e3a
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.packet_write_failed___data_exceeds_max_packet_size
call fcn.140180160
mov rcx, rax
call fcn.1400b6950
call fcn.1401d96b0
nop
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14022c040]
mov qword [0x1401e81a8], 0
mov qword [rsp + 0x60], r8
mov rbx, rcx
mov qword [rsp + 0x68], r9
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rax, qword [0x1401e81b0]
cmp rax, qword [0x14022c910]
je 0x140180ed0
mov byte [rax], 0
mov r8, rdx
lea r9, [rsp + 0x60]
lea rdx, [0x14021d516]
lea rcx, [0x1401e81a0]
mov qword [rsp + 0x20], r9
call fcn.140180690
mov r8, qword [0x1401e81a8]
mov rdx, qword [0x1401e81b0]
mov rcx, rbx
call fcn.1400be850
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x140180eda
add rsp, 0x38
pop rbx
pop rsi
ret
cmp byte [rax], 0
je 0x140180e82
call fcn.140180180
call fcn.1401d96b0
nop
push rsi
push rbx
sub rsp, 0x28
lea rsi, str.0000
mov r8d, 1
mov edx, 4
mov rbx, rcx
mov rcx, rsi
call fcn.140180200
mov rcx, rbx
mov r8d, 4
mov rdx, rsi
call fcn.1400be850
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400be880
Function at 0x140180ee0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x14022c910]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call fcn.140180850
test eax, eax
jne 0x140180d42
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x140180d53
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rsp + 0x30]
lea rcx, [0x14021d517]
call fcn.1400b6950
call fcn.1401d96b0
nop
nop dword [rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14022c040]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
cmp r8, 0xffec
ja 0x140180e26
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.140180200
lea rax, [rdi + 4]
lea rdx, str.0123456789abcdef
mov r9d, eax
mov ecx, eax
mov r8d, eax
and eax, 0xf
sar r9d, 4
movzx eax, byte [rdx + rax]
sar r8d, 8
and r9d, 0xf
and r8d, 0xf
sar ecx, 0xc
movzx r9d, byte [rdx + r9]
shl eax, 8
movzx r8d, byte [rdx + r8]
movsxd rcx, ecx
movzx edx, byte [rdx + rcx]
mov rcx, rbx
or eax, r9d
shl eax, 8
or eax, r8d
mov r8d, 4
shl eax, 8
or eax, edx
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], eax
call fcn.1400be850
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400be850
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x140180e3a
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.packet_write_failed___data_exceeds_max_packet_size
call fcn.140180160
mov rcx, rax
call fcn.1400b6950
call fcn.1401d96b0
nop
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14022c040]
mov qword [0x1401e81a8], 0
mov qword [rsp + 0x60], r8
mov rbx, rcx
mov qword [rsp + 0x68], r9
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rax, qword [0x1401e81b0]
cmp rax, qword [0x14022c910]
je 0x140180ed0
mov byte [rax], 0
mov r8, rdx
lea r9, [rsp + 0x60]
lea rdx, [0x14021d516]
lea rcx, [0x1401e81a0]
mov qword [rsp + 0x20], r9
call fcn.140180690
mov r8, qword [0x1401e81a8]
mov rdx, qword [0x1401e81b0]
mov rcx, rbx
call fcn.1400be850
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x140180eda
add rsp, 0x38
pop rbx
pop rsi
ret
cmp byte [rax], 0
je 0x140180e82
call fcn.140180180
call fcn.1401d96b0
nop
push rsi
push rbx
sub rsp, 0x28
lea rsi, str.0000
mov r8d, 1
mov edx, 4
mov rbx, rcx
mov rcx, rsi
call fcn.140180200
mov rcx, rbx
mov r8d, 4
mov rdx, rsi
call fcn.1400be850
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400be880
Function at 0x1401952c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov r14, qword [0x14022c040]
mov rax, qword [r14]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rax, qword [0x14022c910]
mov rbp, rdx
mov rdx, rcx
mov qword [rsp + 0x20], 0
lea rcx, str._s_rebase_merge_update_refs
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], rax
call fcn.140091980
lea rdx, [0x14021fcf4]
mov rcx, rax
mov r13, rax
call fcn.1400d77c0
mov rsi, rax
test rax, rax
je 0x140195448
lea rdi, [rsp + 0x40]
lea r12, [rsp + 0x20]
jmp 0x1401953b6
mov edx, 0x48
mov ecx, 1
call fcn.1400bd320
mov rdx, rsi
mov rcx, rdi
mov rbx, rax
call fcn.140090f10
cmp eax, 0xffffffff
je 0x1401953d0
mov rcx, qword [rsp + 0x50]
mov rdx, rbx
call fcn.140029c60
test eax, eax
jne 0x1401953d0
mov rdx, rsi
mov rcx, rdi
call fcn.140090f10
cmp eax, 0xffffffff
je 0x1401953d0
mov rcx, qword [rsp + 0x50]
lea rdx, [rbx + 0x24]
call fcn.140029c60
test eax, eax
jne 0x1401953d0
mov rdx, qword [rsp + 0x30]
mov rcx, rbp
call fcn.1400930d0
mov qword [rax + 8], rbx
mov rdx, rsi
mov rcx, r12
call fcn.140090f10
cmp eax, 0xffffffff
jne 0x140195350
xor ebx, ebx
xor ebp, ebp
jmp 0x1401953f1
mov rax, qword [str.PF__]
lea rcx, str.update_refs_file_at__s_is_invalid
mov eax, dword [rax]
test eax, eax
jne 0x140195438
mov rdx, r13
mov ebp, 0xffffffff
call fcn.1400b6cc0
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov rcx, r13
call fcn.1400eaf30
mov rcx, rbx
call fcn.1400eaf30
mov rcx, r12
call fcn.14008e580
mov rcx, rdi
call fcn.14008e580
mov rax, qword [rsp + 0x58]
sub rax, qword [r14]
jne 0x140195458
mov eax, ebp
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.1401d81b8
mov rcx, rax
jmp 0x1401953e4
xor ebx, ebx
lea rdi, [rsp + 0x40]
lea r12, [rsp + 0x20]
xor ebp, ebp
jmp 0x1401953f9
call fcn.1401d96b0
nop
nop
Function at 0x1401a8370
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
mov rdi, qword [0x14022c040]
pxor xmm0, xmm0
mov r12, qword [rsp + 0xf8]
mov r13, qword [rsp + 0x100]
mov rsi, rdx
mov qword [rsp + 0x50], r8
mov rbx, rcx
mov rdx, qword [rdi]
mov qword [rsp + 0x88], rdx
xor edx, edx
mov qword [rsp + 0x58], r9
mov rdx, qword [rsp + 0xf0]
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x38], 0
movups xmmword [rsp + 0x68], xmm0
test r8, r8
je 0x1401a83ec
lea rax, [0x1401a7e80]
mov qword [rsp + 0x38], rax
lea rax, [0x1401a8070]
lea rbp, [rsp + 0x68]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
call fcn.14008e880
lea rax, [rsp + 0x30]
mov rcx, rbx
mov r9, r13
mov qword [rsp + 0x20], rax
mov r8, r12
mov rdx, rsi
call fcn.1401a81c0
mov rcx, rbp
mov ebx, eax
call fcn.14008e580
mov rax, qword [rsp + 0x88]
sub rax, qword [rdi]
jne 0x1401a8455
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call fcn.1401d96b0
nop
nop dword [rax + rax]

Function at 0x1401a8460
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov r13, qword [0x14022c040]
mov rbp, rdx
mov r12, rcx
mov rdx, qword [r13]
mov qword [rsp + 0x78], rdx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400d9690
mov edi, eax
test eax, eax
jne 0x1401a8550
lea rdx, [0x1402264ab]
mov rcx, rbp
call fcn.1400d77c0
mov rsi, rax
test rax, rax
je 0x1401a8561
mov rbx, qword [rsp + 0x38]
test rbx, rbx
js 0x1401a8577
mov ecx, 1
cmovne rcx, rbx
call fcn.1400bd0a0
mov qword [r12], rax
test rbx, rbx
jne 0x1401a8510
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov dword [r12 + 8], ebx
mov rax, qword [rsp + 0x78]
sub rax, qword [r13]
jne 0x1401a8572
mov eax, edi
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r9, rsi
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_fread
cmp rax, 1
je 0x1401a84dc
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov rdx, rbp
lea rcx, str.Could_not_read__s
call fcn.1400b6bf0
mov edi, 0xffffffff
jmp 0x1401a84e9
mov rdx, rbp
lea rcx, str.Could_not_stat__s
call fcn.1400b6b60
jmp 0x1401a8541
mov rdx, rbp
lea rcx, str.Could_not_open__s
call fcn.1400b6b60
jmp 0x1401a8541
call fcn.1401d96b0
lea rcx, str.Cannot_handle_files_this_big
call fcn.1400b6950
nop
nop word cs:[rax + rax]
nop
Function at 0x1401bab80
Capabilities:
Check if file exists
Generate random numbers via rtlgenrandom
Get file attributes
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rdx + 0x34]
mov edx, eax
and edx, 0xf000
mov rbx, rcx
test r8d, r8d
je 0x1401babd0
cmp edx, 0x8000
lea rax, str..merge_file_XXXXXX
lea r9, str..merge_link_XXXXXX
mov edx, 0x19
cmove r9, rax
lea r8, [0x1402291c6]
call fcn.1400be0f0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d17f0
mov r8d, 0x1b6
cmp edx, 0x8000
je 0x1401babf0
mov edx, 0x501
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d7b40
and eax, 0x40
cmp eax, 1
sbb r8d, r8d
and r8d, 0xffffffb7
add r8d, 0x1ff
jmp 0x1401babde

Function at 0x1401c2070
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r14, qword [0x14022c040]
mov rbx, rcx
mov rcx, qword [r14]
mov qword [rsp + 0x28], rcx
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov ecx, 1
lea rdx, [rax + 0x11]
mov rsi, rax
call fcn.1400bd320
mov r8, rsi
mov rdx, rbx
lea rbp, [rax + 0x10]
mov rdi, rax
mov rcx, rbp
call sub.msvcrt.dll_memcpy
mov qword [rdi + 8], 0
mov r8, rdi
mov rdx, rbx
mov qword [rdi], 0
lea rcx, [0x1401e9000]
call fcn.140094040
mov rax, qword [0x14022c720]
mov rdx, rbp
lea rcx, str.rr_cache__s
mov rbx, qword [rax]
call fcn.140043020
mov rcx, rax
call rbx
mov rsi, rax
test rax, rax
je 0x1401c2166
lea rbp, [rsp + 0x24]
lea r12, str.postimage
lea r13, str.preimage
nop dword [rax + rax]
mov rcx, rsi
call qword [rsi]
test rax, rax
je 0x1401c2160
lea rbx, [rax + 1]
mov r8, rbp
mov rdx, r12
mov rcx, rbx
call fcn.1401c1e20
test eax, eax
je 0x1401c2188
movsxd rbx, dword [rsp + 0x24]
mov rcx, rdi
mov edx, ebx
call fcn.1401c1ef0
add rbx, qword [rdi + 8]
mov rcx, rsi
or byte [rbx], 1
call qword [rsi]
test rax, rax
jne 0x1401c212a
mov rcx, rsi
call qword [rsi + 8]
mov rax, qword [rsp + 0x28]
sub rax, qword [r14]
jne 0x1401c21b5
mov rax, rdi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r8, rbp
mov rdx, r13
mov rcx, rbx
call fcn.1401c1e20
test eax, eax
je 0x1401c2120
movsxd rbx, dword [rsp + 0x24]
mov rcx, rdi
mov edx, ebx
call fcn.1401c1ef0
add rbx, qword [rdi + 8]
or byte [rbx], 2
jmp 0x1401c2120
call fcn.1401d96b0
nop
nop dword [rax + rax]
Function at 0x1401cbf20
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov rax, qword [rcx]
mov edi, r8d
mov r11, rcx
mov r9, rdx
mov ecx, 0x1505
and edi, 0x1e
jne 0x1401cbf98
cmp rax, rdx
jb 0x1401cbf78
jmp 0x1401cbf87
mov r8d, ecx
add rax, 1
shl r8d, 5
add r8d, ecx
mov ecx, edx
xor ecx, r8d
cmp r9, rax
je 0x1401cbf8a
movsx edx, byte [rax]
cmp dl, 0xa
jne 0x1401cbf60
cmp rax, r9
adc rax, 0
mov r9, rax
mov eax, ecx
mov qword [r11], r9
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rsi, qword [str._________AA__A__________________]
cmp rax, rdx
jb 0x1401cc002
jmp 0x1401cbf87
cmp byte [rbp + 1], 0xa
je 0x1401cbfc0
test r8b, 2
je 0x1401cc086
movzx r10d, byte [rdx]
cmp r10b, 0xa
je 0x1401cc0e9
mov rax, rdx
lea rdx, [rbp + 2]
nop word cs:[rax + rax]
movzx ebx, r10b
test byte [rsi + rbx], 1
jne 0x1401cc040
mov eax, ecx
movsx r10d, r10b
shl eax, 5
add eax, ecx
mov ecx, r10d
xor ecx, eax
cmp rdx, r9
jae 0x1401cc06a
mov rax, rdx
movzx r10d, byte [rax]
cmp r10b, 0xa
je 0x1401cbf80
lea rdx, [rax + 1]
cmp edi, 0x10
jne 0x1401cbfe0
cmp r10b, 0xd
jne 0x1401cbfea
cmp rdx, r9
jae 0x1401cc078
cmp byte [rax + 1], 0xa
je 0x1401cbfff
mov eax, ecx
shl eax, 5
add eax, ecx
xor eax, 0xd
mov ecx, eax
jmp 0x1401cbfff
mov rdx, rax
jmp 0x1401cc05e
movzx ebx, byte [rdx]
test byte [rsi + rbx], 1
je 0x1401cbfb0
cmp bl, 0xa
je 0x1401cbfb0
mov rbp, rdx
add rdx, 1
cmp rdx, r9
jb 0x1401cc048
mov r9, rdx
jmp 0x1401cbf8a
mov eax, ecx
shl eax, 5
add eax, ecx
xor eax, 0xd
mov ecx, eax
jmp 0x1401cc06a
test r8b, 4
jne 0x1401cc0cf
test r8b, 8
je 0x1401cbfc0
cmp rdx, rax
je 0x1401cc0f1
mov r10d, ecx
mov rbx, rax
add rax, 1
shl r10d, 5
add r10d, ecx
movsx ecx, byte [rax - 1]
xor ecx, r10d
cmp rdx, rax
jne 0x1401cc09b
movzx r10d, byte [rdx]
cmp r10b, 0xa
je 0x1401cbf80
lea rdx, [rbx + 2]
jmp 0x1401cbfe0
mov eax, ecx
movzx r10d, byte [rdx]
shl eax, 5
add eax, ecx
xor eax, 0x20
mov ecx, eax
cmp r10b, 0xa
jne 0x1401cbfce
mov rax, rdx
jmp 0x1401cbf80
movzx r10d, byte [rdx]
cmp r10b, 0xa
je 0x1401cbf80
add rdx, 1
jmp 0x1401cbfe0
Function at 0x1401d8c00
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14029db20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14029db00]
test rbx, rbx
je 0x1401d8c64
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop word cs:[rax + rax]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1401d8c5b
test eax, eax
jne 0x1401d8c5b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1401d8c40
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1401d8fc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14022bf20]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1401d8fe0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1401d8fe8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1401d8fe0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1401d903d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1401d9034
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1401d8fe0
add rax, 0x28
cmp rax, r9
jne 0x1401d9020
xor eax, eax
ret

Function at 0x1401d9040
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14022bf20]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1401d905f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1401d9068
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1401d905f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1401d9100
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14022bf20]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1401d911f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1401d9128
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1401d96b0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
mov r8d, 0x2c
lea rdx, str._stack_smashing_detected_:_terminated_n
call sub.msvcrt.dll__write
mov ecx, 0x17
call sub.KERNEL32.dll_IsProcessorFeaturePresent
test eax, eax
je 0x1401d96e0
mov ecx, 2
int 0x29
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1401d9730
Capabilities:
Enumerate disk volumes
Get disk information
Get disk size
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov ebp, ecx
mov rsi, rdx
cmp ecx, 0xffffffff
je 0x1401d9960
test rdx, rdx
js 0x1401d9960
call sub.msvcrt.dll__get_osfhandle
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1401d9990
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
jne 0x1401d9990
mov ecx, ebp
call sub.msvcrt.dll__telli64
mov qword [rsp + 0x48], rax
cmp rax, 0xffffffffffffffff
je 0x1401d9960
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1401d9990
cmp qword [rsp + 0x68], rsi
jb 0x1401d9820
xor r9d, r9d
mov qword [rsp + 0x70], rsi
lea r8, [rsp + 0x74]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1401d97d9
cmp dword [rsp + 0x70], 0xffffffff
jne 0x1401d9975
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1401d9960
mov rdx, qword [rsp + 0x48]
xor r8d, r8d
mov ecx, ebp
call fcn.1401de9a0
cmp rax, 0xffffffffffffffff
je 0x1401d9960
xor eax, eax
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x1401d9960
mov edx, 2
mov ecx, 0x33
call sub.msvcrt.dll_calloc
mov edx, 2
mov ecx, 0x106
mov rbx, rax
call sub.msvcrt.dll_calloc
mov r12, rax
test rbx, rbx
je 0x1401d9990
test rax, rax
je 0x1401d9990
mov edx, 0x32
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov r14, qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov r15, qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov r13, rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x40], rax
jmp 0x1401d98b7
mov r8d, 0x32
mov rdx, rbx
mov rcx, r13
call r15
test eax, eax
je 0x1401d9948
mov dword [rsp + 0x38], 0
mov rdx, r12
mov rcx, rbx
mov r9, qword [rsp + 0x40]
mov qword [rsp + 0x30], 0
mov r8d, 0x105
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r14
mov eax, dword [rsp + 0x5c]
cmp dword [rsp + 0x8c], eax
jne 0x1401d98a0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rcx, r12
call fcn.1401deb28
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov rcx, rbx
mov r12d, eax
call fcn.1401deb28
test r12d, r12d
je 0x1401d9982
mov rax, rsi
sub rax, qword [rsp + 0x68]
cmp qword [rsp + 0x60], rax
jae 0x1401d97b1
jmp 0x1401d9982
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
mov rcx, rbx
xor ebx, ebx
call fcn.1401deb28
jmp 0x1401d9904
call sub.msvcrt.dll__errno
mov dword [rax], 0x16
mov eax, 0xffffffff
jmp 0x1401d9805
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x83
jne 0x1401d9960
call sub.msvcrt.dll__errno
mov dword [rax], 0x1b
jmp 0x1401d996b
call sub.msvcrt.dll__errno
mov dword [rax], 9
jmp 0x1401d996b
Function at 0x180076b00
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x180076b35
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x180076b10
and r10, 0xf
je 0x180076b65
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x180076b40
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x180076b59
mov rax, r8
repz ret

Function at 0x180076b70
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x180076bad
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x180076b80
pxor xmm1, xmm1
and r10, 0xf
je 0x180076be3
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x180076bbb
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x180076bd7
mov rax, r8
repz ret
Function at 0x18014f2c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18014f2e2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18014f35c
mov rdi, r14
mov rcx, rbx
call fcn.18013ff30
test rax, rax
jle 0x18014f334
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1803e57a0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18014f34c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_getservbyport]
cmp eax, 0xffffffff
je 0x18014f354
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18014f2f6
sub r14, rdi
jmp 0x18014f43f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18014f373
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18014f375
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18014f3a7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1803e57a0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18014f43c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18014f3e2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18014f41d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1803f87ac
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18014f43c
cmp rbp, rax
ja 0x18014f3f0
test rbp, rbp
je 0x18014f43c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1803f87ac
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x180150960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [r8 + 0x18], 0x10
mov rbx, rdx
mov r11, qword [r8 + 0x10]
mov rdx, r8
mov rdi, rcx
jb 0x180150981
mov rdx, qword [r8]
xor r10d, r10d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x1801509b4
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [r10 + rdx]
inc r10
xor r9, rax
imul r9, rcx
cmp r10, r11
jb 0x1801509a0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.180151f70
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1801509db
mov qword [rbx], rcx
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi + 8]
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret