joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d43a0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov r12, rdx
mov rbp, r8
mov rdi, r9
test rcx, rcx
je 0x1400d44b8
call sym.strlen
mov rcx, r12
mov rsi, rax
call sym.strlen
lea r13, [rsi + rax + 6]
mov rcx, r13
call sym.malloc
mov rsi, rax
test rax, rax
je 0x1400d44bf
lea rax, str..msg
mov r9, rbx
mov rdx, r13
mov rcx, rsi
mov qword [rsp + 0x28], rax
lea r8, str._s__s_s
mov qword [rsp + 0x20], r12
call qword [sym.imp.msvcrt.dll__snprintf]
cdqe
cmp rax, r13
jae 0x1400d44b0
mov rcx, rsi
lea rdx, [0x140119159]
call sym.fopen
mov rcx, rsi
mov rbx, rax
call sym.free
test rbx, rbx
je 0x1400d44b8
mov r8d, 2
xor edx, edx
mov rcx, rbx
call sym.fseek
mov rcx, rbx
call sym.ftell
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov r13d, eax
call sym.fseek
mov rcx, r13
call sym.malloc
mov rsi, rax
test rax, rax
je 0x1400d44bf
mov rcx, rax
mov r9, rbx
mov r8, r13
mov edx, 1
call sym.fread
mov qword [rbp], rsi
xor esi, esi
mov rcx, rbx
mov dword [rdi], eax
cmp r13d, eax
sete sil
lea esi, [rsi + rsi - 2]
call sym.fclose
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
call sym.free
mov esi, 0xfffffffe
jmp 0x1400d44a1
mov esi, 0xffffff9d
jmp 0x1400d44a1

Function at 0x1400d4590
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x88], rdx
mov rdi, rcx
movsxd rbp, r8d
mov rbx, r9
test rcx, rcx
je 0x1400d46cf
call sym.strlen
mov rcx, qword [rsp + 0x88]
mov rsi, rax
call sym.strlen
lea r12, [rsi + rax + 6]
mov rcx, r12
call sym.malloc
mov rsi, rax
test rax, rax
je 0x1400d46d9
lea rax, str..msg
mov r9, rdi
mov rdx, r12
mov rcx, rsi
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
lea r8, str._s__s_s
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll__snprintf]
cdqe
cmp rax, r12
jb 0x1400d4640
mov ebx, 0xfffffffe
mov rcx, rsi
call sym.free
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rdx, [0x14011915c]
mov rcx, rsi
call sym.fopen
mov r14, rax
test rax, rax
je 0x1400d461e
test ebp, ebp
jle 0x1400d46c0
mov r13, qword [rsp + 0xa0]
xor r12d, r12d
lea r15, [r13 + rbp*4]
xor ebp, ebp
nop dword [rax]
movsxd r8, dword [r13]
mov rcx, qword [rbx]
mov r9, r14
mov edx, 1
add r13, 4
add rbx, 8
add r12, r8
call sym.fwrite
add rbp, rax
cmp r13, r15
jne 0x1400d4670
mov rcx, r14
call sym.fclose
cmp r12, rbp
je 0x1400d46c8
mov rdx, qword [rsp + 0x88]
mov rcx, rdi
call sym.pstremove
jmp 0x1400d461e
mov rcx, rax
call sym.fclose
xor ebx, ebx
jmp 0x1400d4623
mov ebx, 0xfffffffe
jmp 0x1400d462b
mov ebx, 0xffffff9d
jmp 0x1400d462b
Function at 0x1400d46f0
Capabilities:
Delete directory

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
test rcx, rcx
je 0x1400d473c
call qword [sym.imp.msvcrt.dll__rmdir]
test eax, eax
jne 0x1400d4720
xor esi, esi
mov rcx, rbx
call sym.free
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
cmp dword [rax], 2
je 0x1400d4708
call rsi
cmp dword [rax], 0x29
je 0x1400d4708
mov esi, 0xfffffffe
jmp 0x1400d470a
mov esi, 0xfffffffe
jmp 0x1400d4712

Function at 0x1400d4750
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x278
lea r8, str._s_
lea rbx, [rsp + 0x20]
mov r9, rcx
mov r14, rdx
mov edx, 0x105
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__snprintf]
cmp eax, 0x104
jg 0x1400d4912
lea r12, [rsp + 0x130]
mov rcx, rbx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400d4912
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop word cs:[rax + rax]
test byte [rsp + 0x130], 0x20
je 0x1400d4890
lea rsi, [rsp + 0x15c]
mov rcx, rsi
call sym.strlen
lea rbx, [rax + 1]
mov rcx, rbx
call sym.malloc
mov r15, rax
test rax, rax
je 0x1400d491c
cmp ebx, 8
jae 0x1400d48c0
test bl, 4
jne 0x1400d48e0
test ebx, ebx
je 0x1400d4820
movzx eax, byte [rsp + 0x15c]
mov byte [r15], al
test bl, 2
jne 0x1400d4900
lea rdx, str..msg
mov rcx, r15
call sym.strstr
test rax, rax
je 0x1400d4837
mov byte [rax], 0
mov rdx, r14
mov rcx, r15
call sym.strcmp
mov ebx, eax
test eax, eax
jne 0x1400d4888
mov rcx, r15
call sym.free
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400d4866
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
add rsp, 0x278
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, r15
call sym.free
mov rdx, r12
mov rcx, rbp
call r13
test eax, eax
jne 0x1400d47c0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400d47c0
mov ebx, 0xfffffffe
jmp 0x1400d4866
mov eax, ebx
sub ebx, 1
mov rdi, r15
mov rdx, qword [rsi + rax - 8]
shr ebx, 3
mov ecx, ebx
mov qword [r15 + rax - 8], rdx
rep movsq qword [rdi], qword [rsi]
jmp 0x1400d4820
mov eax, dword [rsp + 0x15c]
mov ebx, ebx
mov dword [r15], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r15 + rbx - 4], eax
jmp 0x1400d4820
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r15 + rbx - 2], ax
jmp 0x1400d4820
mov ebx, 0xfffffffe
jmp 0x1400d486f
mov ebx, 0xffffff9d
jmp 0x1400d486f

Function at 0x1400d4930
Capabilities:
Enumerate files on windows

Disassembly:
test rcx, rcx
je 0x1400d493a
jmp sym.containskeyWin32
mov eax, 0xfffffffe
ret
Function at 0x1400d4940
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x298
mov rax, qword [sym.imp.msvcrt.dll__snprintf]
lea r8, str._s_
mov edx, 0x105
lea rbx, [rsp + 0x40]
mov rdi, rcx
mov r9, rcx
mov qword [rsp + 0x38], rax
mov rcx, rbx
call rax
cmp eax, 0x104
jg 0x1400d4a75
lea r12, [rsp + 0x150]
mov rcx, rbx
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400d4a75
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileA]
nop
lea rsi, [rsp + 0x17c]
lea r14, str._s__s
test byte [rsp + 0x150], 0x20
je 0x1400d4a2a
mov rcx, rdi
call sym.strlen
mov rcx, rsi
mov rbx, rax
call sym.strlen
lea rbx, [rbx + rax + 2]
mov rcx, rbx
call sym.malloc
mov r15, rax
test rax, rax
je 0x1400d4a87
mov rcx, rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x38]
mov r9, rdi
mov r8, r14
mov rdx, rbx
call rax
mov rcx, r15
cdqe
cmp rax, rbx
jae 0x1400d4a70
call sym.remove
mov rcx, r15
mov ebx, eax
call sym.free
test ebx, ebx
jne 0x1400d4a80
mov rdx, r12
mov rcx, rbp
call r13
mov ebx, eax
test eax, eax
jne 0x1400d49bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400d49b0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, ebx
add rsp, 0x298
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call sym.free
mov ebx, 0xfffffffe
jmp 0x1400d4a51
mov ebx, 0xfffffffe
jmp 0x1400d4a48
mov ebx, 0xffffff9d
jmp 0x1400d4a51

Function at 0x1400d4a90
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
test rcx, rcx
je 0x1400d4a9a
jmp sym.clearWin32
mov eax, 0xfffffffe
ret
Function at 0x1400d4aa0
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x2d8], rdx
mov r9, rcx
mov edx, 0x105
mov qword [rsp + 0x2e0], r8
mov rcx, rbp
lea r8, str._s_
call qword [sym.imp.msvcrt.dll__snprintf]
cmp eax, 0x104
jg 0x1400d4ce2
lea r12, [rsp + 0x140]
mov r14, qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rbp
mov rdx, r12
call r14
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400d4ce2
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileA]
xor r15d, r15d
nop word [rax + rax]
mov eax, dword [rsp + 0x140]
mov rdx, r12
mov rcx, rsi
and eax, 0x20
cmp eax, 1
sbb r15d, 0xffffffff
call r13
mov ebx, eax
test eax, eax
jne 0x1400d4b20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400d4b20
mov rax, qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
mov qword [rsp + 0x28], rax
call rax
test r15d, r15d
jne 0x1400d4c65
mov qword [rsp + 0x20], 0
mov rdx, r12
mov rcx, rbp
call r14
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400d4ce2
lea rbp, [rsp + 0x16c]
nop dword [rax]
test byte [rsp + 0x140], 0x20
je 0x1400d4c08
mov rcx, rbp
call sym.strlen
lea rsi, [rax + 1]
mov rcx, rsi
call sym.malloc
mov rdi, qword [rsp + 0x20]
mov r8, rax
movsxd rax, ebx
mov qword [rdi + rax*8], r8
test r8, r8
je 0x1400d4c7f
cmp esi, 8
jae 0x1400d4c90
test sil, 4
jne 0x1400d4cb0
test esi, esi
je 0x1400d4bee
movzx eax, byte [rbp]
mov byte [r8], al
test sil, 2
jne 0x1400d4cd0
lea rdx, str..msg
mov rcx, r8
call sym.strstr
test rax, rax
je 0x1400d4c05
mov byte [rax], 0
add ebx, 1
mov rdx, r12
mov rcx, r14
call r13
mov esi, eax
test eax, eax
jne 0x1400d4b90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1400d4b90
mov rax, qword [rsp + 0x28]
mov rcx, r14
call rax
mov rax, qword [rsp + 0x2e0]
mov rdi, qword [rsp + 0x20]
mov dword [rax], r15d
mov rax, qword [rsp + 0x2d8]
mov qword [rax], rdi
mov eax, esi
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movsxd rcx, r15d
shl rcx, 3
call sym.malloc
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x1400d4b6e
mov esi, 0xffffff9d
jmp 0x1400d4c4f
mov eax, esi
lea ecx, [rsi - 1]
mov rdi, r8
mov rsi, rbp
mov rdx, qword [rbp + rax - 8]
shr ecx, 3
mov qword [r8 + rax - 8], rdx
rep movsq qword [rdi], qword [rsi]
jmp 0x1400d4bee
mov eax, dword [rbp]
mov esi, esi
mov dword [r8], eax
mov eax, dword [rbp + rsi - 4]
mov dword [r8 + rsi - 4], eax
jmp 0x1400d4bee
mov esi, esi
movzx eax, word [rbp + rsi - 2]
mov word [r8 + rsi - 2], ax
jmp 0x1400d4bee
mov esi, 0xfffffffe
jmp 0x1400d4c4f

Function at 0x1400d4cf0
Capabilities:
Enumerate files on windows

Disassembly:
test rcx, rcx
je 0x1400d4cfa
jmp sym.keysWin32
mov eax, 0xfffffffe
ret
Function at 0x1400d6b00
Capabilities:
Decode data using base64 via winapi

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], 0
mov rax, rcx
mov r10d, edx
mov rcx, r8
lea r8, [rsp + 0x4c]
mov edx, r9d
mov dword [rsp + 0x4c], r10d
mov r9, rax
mov qword [rsp + 0x20], r8
mov r8d, 1
mov qword [rsp + 0x28], 0
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
mov edx, eax
xor eax, eax
test edx, edx
je 0x1400d6b4c
mov eax, dword [rsp + 0x4c]
add rsp, 0x58
ret

Function at 0x1400d6b60
Capabilities:
Encode data using base64 via winapi

Disassembly:
sub rsp, 0x48
mov rax, rcx
mov r10d, edx
mov rcx, r8
mov edx, r9d
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x3c], r10d
mov r9, rax
mov qword [rsp + 0x20], r8
mov r8d, 0x40000001
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov edx, eax
xor eax, eax
test edx, edx
je 0x1400d6b9a
mov eax, dword [rsp + 0x3c]
add rsp, 0x48
ret
Function at 0x1400d7d50
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 0x30]
mov rsi, rdx
test eax, eax
je 0x1400d7de0
mov rbx, qword [0x14013b7c8]
test rbx, rbx
je 0x1400d7db0
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400d7db0
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1400d7db0
mov r8, qword [rbx]
mov rdx, qword [rbx + 8]
mov eax, 0xffffffff
cmp r8, rdx
je 0x1400d7db0
cmp rdx, r8
jae 0x1400d7da8
lea rax, [rdx + 1]
mov qword [rbx + 8], rax
movzx eax, byte [rbx + rdx + 0x10]
mov byte [rsi], al
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
lea rdx, [rsp + 0x28]
call sym.WebSocket_receiveFrame
test eax, eax
jne 0x1400d7da8
mov rdx, qword [0x14013b7c8]
mov rdx, qword [rdx]
test rdx, rdx
je 0x1400d7dd1
mov rbx, qword [rdx + 0x10]
test rbx, rbx
je 0x1400d7da6
mov r8, qword [rbx]
mov rdx, qword [rbx + 8]
jmp 0x1400d7d92
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
jmp sym.Socket_getch

Function at 0x1400d7fc0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov eax, dword [rcx + 0x30]
mov rdi, rcx
mov rbp, r8
mov rbx, r9
test eax, eax
je 0x1400d8048
mov qword [rsp + 0x28], r9
lea rcx, [rsp + 0x70]
mov r9, rdx
mov rdx, rdi
mov qword [rsp + 0x20], r8
mov r8d, 2
call sym.WebSocket_buildFrame.constprop.0
movdqu xmm0, xmmword [rbx]
mov rsi, qword [rsp + 0x70]
lea r9, [rsp + 0x40]
mov rcx, qword [rdi]
mov r8, qword [rsp + 0x78]
movaps xmmword [rsp + 0x40], xmm0
movdqu xmm1, xmmword [rbx + 0x10]
mov rdx, rsi
movaps xmmword [rsp + 0x50], xmm1
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x60], rax
call sym.Socket_putdatas
cmp eax, 0xffffffea
jne 0x1400d8088
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
movdqu xmm2, xmmword [r9]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
mov r8, qword [r8]
movaps xmmword [rsp + 0x40], xmm2
movdqu xmm3, xmmword [r9 + 0x10]
movaps xmmword [rsp + 0x50], xmm3
mov rax, qword [r9 + 0x20]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x60], rax
call sym.Socket_putdatas
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r10d, dword [rbx]
mov rcx, qword [rbp]
test r10d, r10d
jle 0x1400d80f1
mov r8, qword [rbx + 0x10]
xor r11d, r11d
nop dword [rax + rax]
xor edx, edx
cmp qword [r8 + r11*8], 0
lea r9, [r11*8]
je 0x1400d80e8
nop dword [rax]
mov r8, qword [rbx + 8]
mov r10, rcx
add rcx, 1
and r10d, 3
mov rdi, qword [r8 + r9]
movzx r10d, byte [rbx + r10 + 0x20]
add rdi, rdx
add rdx, 1
xor byte [rdi], r10b
mov r8, qword [rbx + 0x10]
cmp rdx, qword [r8 + r9]
jb 0x1400d80b8
mov r10d, dword [rbx]
add r11, 1
cmp r10d, r11d
jg 0x1400d80a0
mov dword [rbx + 0x20], 0
mov rcx, rsi
mov dword [rsp + 0x3c], eax
call sym.free
mov eax, dword [rsp + 0x3c]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x1400d8970
Capabilities:
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
xor edx, edx
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1400d89a0
xor eax, eax
jmp 0x1400d89c8
lea rax, [rbx + 8]
mov rcx, qword [rbx]
mov edx, 0x8004
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov edx, eax
mov eax, 1
test edx, edx
je 0x1400d89d0
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x1400d89c8

Function at 0x1400d89e0
Capabilities:
Hash data via wincrypt

Disassembly:
sub rsp, 0x28
xor r9d, r9d
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
setne al
movzx eax, al
add rsp, 0x28
ret
Function at 0x1400df3b0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
push rsi
push rbx
mov r11d, 0x80000000
mov r10d, ecx
mov eax, edx
test r8d, r8d
je 0x1400df42c
mov esi, 3
lea rdi, [0x14011af20]
jmp 0x1400df3e0
add esi, 1
sar r8d, 1
je 0x1400df42c
test r8b, 1
je 0x1400df3d8
mov edx, esi
mov ecx, r11d
mov r9d, 0x80000000
xor r11d, r11d
and edx, 0x1f
mov ebx, dword [rdi + rdx*4]
jmp 0x1400df414
mov edx, ecx
shr ecx, 1
and edx, 1
shr r9d, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
test ebx, r9d
je 0x1400df400
lea edx, [r9 - 1]
xor r11d, ecx
test edx, ebx
jne 0x1400df400
add esi, 1
sar r8d, 1
jne 0x1400df3e0
xor r8d, r8d
mov ecx, 0x80000000
jmp 0x1400df456
mov edx, r10d
shr r10d, 1
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor r10d, edx
test ecx, r11d
je 0x1400df440
lea edx, [rcx - 1]
xor r8d, r10d
test edx, r11d
jne 0x1400df440
xor eax, r8d
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400df470
Capabilities:
Hash data with crc32

Disassembly:
push rdi
push rsi
push rbx
mov r11d, 0x80000000
mov r10d, ecx
mov eax, edx
test r8d, r8d
je 0x1400df4ec
mov esi, 3
lea rdi, [0x14011af20]
jmp 0x1400df4a0
add esi, 1
sar r8d, 1
je 0x1400df4ec
test r8b, 1
je 0x1400df498
mov edx, esi
mov ecx, r11d
mov r9d, 0x80000000
xor r11d, r11d
and edx, 0x1f
mov ebx, dword [rdi + rdx*4]
jmp 0x1400df4d4
mov edx, ecx
shr ecx, 1
and edx, 1
shr r9d, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
test ebx, r9d
je 0x1400df4c0
lea edx, [r9 - 1]
xor r11d, ecx
test edx, ebx
jne 0x1400df4c0
add esi, 1
sar r8d, 1
jne 0x1400df4a0
xor r8d, r8d
mov ecx, 0x80000000
jmp 0x1400df516
mov edx, r10d
shr r10d, 1
and edx, 1
shr ecx, 1
neg edx
and edx, 0xedb88320
xor r10d, edx
test ecx, r11d
je 0x1400df500
lea edx, [rcx - 1]
xor r8d, r10d
test edx, r11d
jne 0x1400df500
xor eax, r8d
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400df530
Capabilities:
Hash data with crc32

Disassembly:
push rbx
mov r10d, 0x80000000
test ecx, ecx
je 0x1400df5a4
mov r11d, 3
lea rbx, [0x14011af20]
jmp 0x1400df558
add r11d, 1
sar ecx, 1
je 0x1400df5a4
test cl, 1
je 0x1400df550
mov eax, r11d
mov edx, r10d
mov r8d, 0x80000000
xor r10d, r10d
and eax, 0x1f
mov r9d, dword [rbx + rax*4]
jmp 0x1400df58b
mov eax, edx
shr edx, 1
and eax, 1
shr r8d, 1
neg eax
and eax, 0xedb88320
xor edx, eax
test r9d, r8d
je 0x1400df578
lea eax, [r8 - 1]
xor r10d, edx
test eax, r9d
jne 0x1400df578
add r11d, 1
sar ecx, 1
jne 0x1400df558
mov eax, r10d
pop rbx
ret

Function at 0x1400df5b0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
mov r10d, 0x80000000
test ecx, ecx
je 0x1400df624
mov r11d, 3
lea rbx, [0x14011af20]
jmp 0x1400df5d8
add r11d, 1
sar ecx, 1
je 0x1400df624
test cl, 1
je 0x1400df5d0
mov eax, r11d
mov edx, r10d
mov r8d, 0x80000000
xor r10d, r10d
and eax, 0x1f
mov r9d, dword [rbx + rax*4]
jmp 0x1400df60b
mov eax, edx
shr edx, 1
and eax, 1
shr r8d, 1
neg eax
and eax, 0xedb88320
xor edx, eax
test r9d, r8d
je 0x1400df5f8
lea eax, [r8 - 1]
xor r10d, edx
test eax, r9d
jne 0x1400df5f8
add r11d, 1
sar ecx, 1
jne 0x1400df5d8
mov eax, r10d
pop rbx
ret
Function at 0x1400dfb30
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop dword [rax]

Function at 0x1400dfba0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14013b834]
mov rbx, rcx
test esi, esi
jle 0x1400dfcd0
mov rax, qword [0x14013b838]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400dfbeb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400dfc75
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400dfbd0
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
mov rdi, rax
test rax, rax
je 0x1400dfcf2
mov rax, qword [0x14013b838]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call dbg._GetPEImageBase
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14013b838]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400dfcd7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400dfc6e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400dfc80
add dword [0x14013b834], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14013b838]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400dfc6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor esi, esi
jmp 0x1400dfbf8
mov rax, qword [0x14013b838]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400e0280
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14013b8a0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14013b880]
test rbx, rbx
je 0x1400e02dc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1400e02d3
test eax, eax
jne 0x1400e02d3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400e02b8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400e04f0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400e0508
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400e0510
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400e0520
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x1400e056d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x1400e0564
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400e056f
add rax, 0x28
cmp rax, r9
jne 0x1400e0550
xor eax, eax
ret

Function at 0x1400e0570
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x1400e0600
mov rdx, qword [0x14011ea10]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x1400e05ee
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400e05ee
cmp word [rax + 0x18], 0x20b
jne 0x1400e05ee
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x1400e0600
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x1400e05d9
add rbx, 0x28
cmp rbx, rdi
je 0x1400e0600
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x1400e05d0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400e0610
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14011ea10]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400e0630
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400e0638
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400e0630
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400e068d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400e0684
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400e0630
add rax, 0x28
cmp rax, r9
jne 0x1400e0670
xor eax, eax
ret

Function at 0x1400e0690
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14011ea10]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400e06af
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400e06b8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400e06af
movzx ecx, word [rax + 6]
mov eax, ecx
ret