joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e868
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov r15, r8
mov rsi, rdx
mov r12, rcx
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x40]
mov r14d, r9d
call fcn.14003a5c0
xor edx, edx
lea rcx, [rbp + 0x80]
mov r8d, 0x104
call fcn.14003a5c0
mov rcx, r15
call fcn.140004e8c
mov r8, r12
lea rdx, str._s.
lea rcx, [rbp + 0x80]
call fcn.1400055a4
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
test rsi, rsi
je 0x14001ea16
mov rcx, rsi
call fcn.14007ef6c
jmp 0x14001ea16
lea rdx, [0x1400a0904]
lea rcx, [rsp + 0x6c]
call fcn.140061a70
test eax, eax
je 0x14001ea16
lea rdx, [0x1400a0a38]
lea rcx, [rsp + 0x6c]
call fcn.140061a70
test eax, eax
je 0x14001ea16
test r14d, r14d
je 0x14001e94d
test byte [rsp + 0x40], 0x10
jne 0x14001ea16
jmp 0x14001e958
test byte [rsp + 0x40], 0x10
je 0x14001ea16
lea rcx, [rsp + 0x6c]
call fcn.14007ef6c
test rsi, rsi
je 0x14001e982
cmp byte [rsi], 0
je 0x14001e982
mov rdx, rsi
lea rcx, [rsp + 0x6c]
call fcn.14003a760
test rax, rax
je 0x14001ea16
mov ecx, 0x104
call fcn.140037e70
xor edx, edx
mov r8d, 0x104
mov rcx, rax
mov rbx, rax
call fcn.14003a5c0
lea r9, [rsp + 0x6c]
mov r8, r12
lea rdx, str._s_s
mov rcx, rbx
call fcn.1400055a4
and qword [rsp + 0x30], 0
cmp byte [rbx], 0
mov qword [rsp + 0x38], reloc.WSOCK32.dll_ntohs
mov byte [rsp + 0x20], 0
jne 0x14001e9d3
xor eax, eax
jmp 0x14001e9db
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140004d8c
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.140009638
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14001ea16
mov rcx, qword [rsp + 0x20]
inc rdx
mov r8d, 1
call fcn.140004554
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14001e909
test rdi, rdi
je 0x14001ea3a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x290]
mov eax, 1
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140021a08
Capabilities:
Create service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rbp, r9
mov r14, r8
mov r15, rdx
mov rsi, rcx
call fcn.140021bcc
xor ebx, ebx
test eax, eax
je 0x140021a3f
lea eax, [rbx + 1]
jmp 0x140021ad5
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x140021ad5
mov qword [rsp + 0x60], rbp
lea rax, [0x14009d600]
mov qword [rsp + 0x58], r14
mov r9d, 0xf01ff
mov qword [rsp + 0x50], rax
mov r8, rsi
mov rax, qword [rsp + 0xc0]
mov rdx, rsi
mov qword [rsp + 0x48], rbx
mov rcx, rdi
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
test rax, rax
je 0x140021aca
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140021c64
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov ebp, edx
mov rdi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x140021cde
mov r8d, 0xf01ff
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
je 0x140021cca
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140021cca
cmp dword [rsp + 0x24], ebp
sete bl
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400236ec
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ebx, ebx
mov qword [rsp + 0x38], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x30], rbx
mov rdi, rax
mov byte [rsp + 0x20], bl
cmp byte [rax], bl
jne 0x14002371b
mov eax, ebx
jmp 0x140023723
mov rcx, rdi
call fcn.140045e50
mov r8, rax
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140004d8c
lea rcx, [0x1400a15d8]
call fcn.140045e50
mov r9, rax
lea rdx, [0x1400a15d8]
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.14000501c
mov rdx, qword [rsp + 0x38]
cmp rax, 0xffffffffffffffff
setne bl
cmp rdx, 0x10
jb 0x14002377b
mov rcx, qword [rsp + 0x20]
inc rdx
mov r8d, 1
call fcn.140004554
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140023788
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
mov rbx, rax
mov edi, 1
call fcn.140045e50
cmp rax, rdi
jbe 0x1400237f1
mov esi, edi
mov rcx, r14
call fcn.140045e50
mov r8, rax
lea rcx, [rsi + rbx]
mov rdx, r14
call fcn.140069ef0
test eax, eax
je 0x14002380f
inc edi
mov rcx, rbx
movsxd rsi, edi
call fcn.140045e50
cmp rsi, rax
jb 0x1400237c4
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, r14
call fcn.140045e50
movsxd rcx, edi
lea rsi, [rax + 1]
add rsi, rbx
add rsi, rcx
je 0x1400237f1
mov rcx, rbx
call fcn.140045e50
add rax, rbx
cmp rsi, rax
jae 0x1400237f1
lea rcx, [rsi + 1]
lea rdx, [0x14009e790]
call fcn.14003a760
mov rdi, rax
test rax, rax
jne 0x14002385f
mov rcx, rbx
call fcn.140045e50
lea rdi, [rbx - 1]
add rdi, rax
jmp 0x140023863
sub rdi, 2
test rdi, rdi
je 0x1400237f1
cmp rdi, rsi
jb 0x1400237f1
mov ebp, 0x80
mov ecx, ebp
call fcn.140037e70
mov r8d, ebp
xor edx, edx
mov rcx, rax
mov rbx, rax
call fcn.14003a5c0
sub rdi, rsi
mov rdx, rsi
mov rcx, rbx
lea r8, [rdi + 1]
call fcn.140045fa0
mov rax, rbx
jmp 0x1400237f4
Function at 0x1400238c0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
sub rsp, 0x28
lea rdx, [0x1400a0898]
xor ecx, ecx
call fcn.14006c40c
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
lea rdx, [0x1400a1a18]
call fcn.14003a760
test rax, rax
je 0x1400238f5
add rsp, 0x28
jmp 0x140023c2c
xor r8d, r8d
lea rcx, [0x140023910]
xor edx, edx
call fcn.1400604a4
xor eax, eax
add rsp, 0x28
ret
sub rsp, 0x28
lea rcx, [0x1400a1138]
call fcn.140012fec
lea rcx, [0x1400a1178]
call fcn.140012fec
lea rcx, str.__SaveDir:
call fcn.140012fec
lea rcx, str.__DrvName:
call fcn.140012fec
lea rcx, str.__LogServer:
call fcn.140012fec
lea rcx, str.__FTPPort:
call fcn.140012fec
lea rcx, str.__FTPUser:
call fcn.140012fec
lea rcx, str.__FTPPawd:
call fcn.140012fec
lea rcx, str.__FTPSave:
call fcn.140012fec
lea rcx, str.__RunTime:
call fcn.140012fec
lea rcx, str.__Altitude:
call fcn.140012fec
lea rcx, str.__UPDriver:
call fcn.140012fec
lea rcx, str.__UPToFTP:
call fcn.140012fec
lea rcx, str.__Debug:
call fcn.140012fec
lea rcx, str.__UploadDesktop:
call fcn.140012fec
lea rcx, str.__RTQuit:
call fcn.140012fec
lea rcx, [0x1400a14c8]
call fcn.140012fec
lea rcx, [0x1400a1138]
call fcn.140012fec
xor eax, eax
add rsp, 0x28
ret
Function at 0x140026c88
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x240
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x140026cbb
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140026cbb
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov al, byte [rdi]
test al, al
je 0x140026d53
mov rsi, rdi
mov rcx, rdi
cmp al, 0x2f
je 0x140026cd3
cmp al, 0x5c
jne 0x140026cd6
mov rsi, rcx
inc rcx
mov al, byte [rcx]
test al, al
jne 0x140026ccb
cmp rsi, rdi
je 0x140026d12
sub rsi, rdi
lea rcx, [rsp + 0x130]
mov r8, rsi
mov rdx, rdi
call fcn.14003a170
lea rdx, [rsp + 0x130]
mov byte [rsp + rsi + 0x130], 0
mov rcx, rbx
call fcn.140026c88
mov byte [rsp + 0x20], 0
test rbx, rbx
je 0x140026d29
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140060710
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140060670
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140026d53
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400275dc
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r9d
mov r14d, r8d
mov rbp, rdx
mov rbx, rcx
jne 0x1400276a7
cmp dword [rcx + 8], 0xffffffff
jne 0x1400276a7
lea rdi, [rcx + 0x150]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, rdi
call fcn.140045e50
mov cl, byte [rax + rbx + 0x14f]
cmp cl, 0x5c
je 0x14002764b
cmp cl, 0x2f
je 0x14002764b
lea rdx, [0x14009dafc]
mov rcx, rdi
call fcn.140060670
mov r9d, 1
cmp esi, r9d
jne 0x140027670
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x140027670
mov eax, 0x2000000
jmp 0x1400276ac
lea r9, [rsp + 0x40]
mov r8d, esi
mov edx, r14d
mov rcx, rbp
call fcn.140029fa4
test rax, rax
jne 0x14002768e
mov eax, dword [rsp + 0x40]
jmp 0x1400276ac
mov rcx, rax
call fcn.14002a94c
mov qword [rbx], rax
neg rax
sbb eax, eax
not eax
and eax, 0x200
jmp 0x1400276ac
mov eax, 0x1000000
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14002a0dc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
imul esi, edx
mov rbp, rdx
cmp byte [r9], 0
mov r10, rcx
je 0x14002a12c
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
mov rdx, rcx
mov r8d, esi
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14002a126
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x14002a153
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x14002a13f
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov rcx, r10
mov r8d, esi
call fcn.14003a170
add dword [rdi + 0x2c], esi
mov eax, esi
mov rbx, qword [rsp + 0x40]
xor edx, edx
mov rsi, qword [rsp + 0x58]
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14002a29c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14002a2b5
xor eax, eax
jmp 0x14002a326
lea rdi, [0x1400a2740]
not r9d
cmp r8d, 8
jb 0x14002a2fb
mov r11d, r8d
shr r11, 3
mov ebx, 8
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub rbx, 1
jne 0x14002a2d1
add r8d, 0xfffffff8
sub r11, 1
jne 0x14002a2cc
test r8d, r8d
je 0x14002a320
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
inc r10
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r8d, 0xffffffff
jne 0x14002a300
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x14002a754
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14002a771
mov eax, 0xffffff9a
jmp 0x14002a941
cmp dword [rcx + 0x1c], 0
je 0x14002a767
cmp qword [rcx + 0x80], 0
je 0x14002a786
call fcn.14002a370
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.14002adc4
test eax, eax
je 0x14002a7ab
mov eax, 0xffffff99
jmp 0x14002a941
mov ecx, 0xb0
call fcn.1400607d0
mov rbx, rax
test rax, rax
jne 0x14002a7c7
mov eax, 0xffffff98
jmp 0x14002a941
mov ecx, 0x4000
call fcn.1400607d0
mov ecx, dword [rsp + 0x40]
and dword [rbx + 0x70], 0
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
test rax, rax
jne 0x14002a7f5
mov rcx, rbx
call fcn.1400607c8
jmp 0x14002a7bd
and dword [rbx + 0x64], 0
mov eax, dword [rdi + 0x40]
mov ecx, dword [rdi + 0x38]
and dword [rbx + 0x74], 0
mov dword [rbx + 0x78], eax
mov eax, dword [rdi + 0x38]
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
and dword [rbx + 0x24], 0
mov dword [rbx + 0x94], eax
test ecx, ecx
je 0x14002a84d
and qword [rbx + 0x38], 0
lea rcx, [rbx + 8]
and qword [rbx + 0x40], 0
and qword [rbx + 0x48], 0
call fcn.140028718
test eax, eax
jne 0x14002a84d
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
mov al, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x14002a876
mov al, byte [rdi + 0x3d]
jmp 0x14002a879
mov al, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
mov al, byte [rbx + 0x98]
neg al
sbb ecx, ecx
and ecx, 0xc
mov dword [rbx + 0xa8], ecx
mov dword [rbx + 0x9c], 0x12345678
mov dword [rbx + 0xa0], 0x23456789
mov dword [rbx + 0xa4], 0x34567890
test rsi, rsi
je 0x14002a925
lea r8, [0x1400a2740]
cmp byte [rsi], 0
je 0x14002a925
movsx rax, byte [rsi]
mov ecx, dword [rbx + 0x9c]
xor rcx, rax
mov eax, dword [rbx + 0x9c]
movzx edx, cl
shr eax, 8
mov ecx, dword [r8 + rdx*4]
mov edx, dword [rbx + 0xa4]
xor ecx, eax
movzx eax, cl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0xa0], ecx
movzx eax, byte [rbx + 0xa3]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r8 + rcx*4]
xor eax, edx
mov dword [rbx + 0xa4], eax
add rsi, 1
jne 0x14002a8bc
mov ecx, dword [rdi + 0x7c]
and dword [rbx + 0x10], 0
mov eax, dword [rsp + 0x58]
add eax, 0x1e
add ecx, eax
mov dword [rbx + 0x60], ecx
xor eax, eax
mov qword [rdi + 0x80], rbx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002b5f4
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx + 8]
mov r10, rcx
mov r8d, r9d
mov r11b, dl
mov edx, dword [rcx]
and r8d, 0xfffd
or r8d, 2
mov ecx, edx
mov eax, r8d
shr edx, 8
xor eax, 1
imul eax, r8d
lea r8, [0x1400a2740]
shr eax, 8
xor r11b, al
movsx rax, r11b
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
add eax, dword [r10 + 4]
mov dword [r10], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [r10 + 4], ecx
movzx eax, byte [r10 + 7]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, dword [r8 + rcx*4]
xor eax, r9d
mov dword [r10 + 8], eax
mov al, r11b
ret
Function at 0x14002da18
Capabilities:
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
xor r8d, r8d
mov dword [rbp - 0x40], 0x40
lea rdx, [0x14009d600]
mov rdi, rcx
call fcn.140004d8c
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ebx, ebx
test eax, eax
je 0x14002dac9
mov rcx, qword [rbp - 0x38]
xor eax, eax
shr rcx, 0x1e
mov qword [rbp - 0x5f], rax
mov qword [rbp - 0x57], rax
mov qword [rbp - 0x4f], rax
mov dword [rbp - 0x47], eax
mov word [rbp - 0x43], ax
mov byte [rbp - 0x41], al
mov eax, ecx
mov byte [rbp - 0x60], bl
and eax, 0x80000001
jge 0x14002da89
dec eax
or eax, 0xfffffffe
inc eax
lea r8d, [rcx + 1]
cmp eax, 1
lea rdx, str._dGB
cmovne r8d, ecx
lea rcx, [rbp - 0x60]
call fcn.1400055a4
cmp byte [rbp - 0x60], bl
je 0x14002dab5
lea rcx, [rbp - 0x60]
call fcn.140045e50
mov rbx, rax
mov r8, rbx
lea rdx, [rbp - 0x60]
mov rcx, rdi
call fcn.140004d8c
mov eax, 1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140033fb4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11, rdx
mov r9d, ecx
test rdx, rdx
jne 0x140033fcd
xor eax, eax
jmp 0x140034041
lea rdi, [0x1400a5480]
not r9d
cmp r8, 8
jb 0x140034016
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
mov ebx, 8
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
inc r11
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub rbx, 1
jne 0x140033ff0
sub r10, 1
jne 0x140033feb
test r8, r8
je 0x14003403b
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
inc r11
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
sub r8, 1
jne 0x14003401b
not r9d
mov eax, r9d
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140035500
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rbp, edx
mov rsi, r8
mov rbx, rcx
lea eax, [rbp - 1]
cmp eax, 7
jbe 0x140035538
lea rax, str.bad_pack_level
mov qword [rcx + 0x6aff0], rax
xor edi, edi
mov dword [rcx + 0x6afc0], edi
cmp dword [rcx + 0x6afb8], edi
jne 0x14003555c
mov dword [rcx + 0x6afc0], 1
mov dword [rcx + 0x6afb8], 0x10000
mov dword [rcx + 0x6afb4], edi
xor edx, edx
add rcx, 0x4afb8
mov r8d, 0x1fffc
call fcn.14003a5c0
lea rdx, [0x1400a5410]
mov r14d, 2
movzx eax, word [rdx + rbp*8 + 2]
mov dword [rbx + 0x6afe0], eax
movzx eax, word [rdx + rbp*8]
mov dword [rbx + 0x6afe4], eax
movzx eax, word [rdx + rbp*8 + 4]
mov dword [rbx + 0x6afe8], eax
movzx eax, word [rdx + rbp*8 + 6]
mov dword [rbx + 0x6afdc], eax
cmp ebp, r14d
jg 0x1400355b9
or word [rsi], 4
jmp 0x1400355c2
cmp ebp, 8
jl 0x1400355c2
or word [rsi], r14w
lea rsi, [rbx + 0x1afb8]
mov dword [rbx + 0x6afcc], edi
mov rdx, rsi
mov dword [rbx + 0x6afbc], edi
mov r8d, 0x10000
mov rcx, rbx
call qword [rbx + reloc.WSOCK32.dll_recv]
mov dword [rbx + 0x6afd8], eax
lea ecx, [rax - 1]
cmp ecx, 0xfffffffd
ja 0x14003562c
mov dword [rbx + 0x6afd4], edi
cmp eax, 0x106
jae 0x140035607
mov rcx, rbx
call fcn.140034b88
mov dword [rbx + 0x6afc4], edi
movzx eax, byte [rsi]
inc rsi
shl edi, 5
xor edi, eax
and edi, 0x7fff
mov dword [rbx + 0x6afc4], edi
sub r14, 1
jne 0x14003560d
jmp 0x140035637
mov qword [rbx + 0x6afd4], 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140036f68
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, dword [rcx]
mov r11, rcx
mov r10d, dword [rcx + 8]
mov r8d, r9d
mov ebx, r10d
movsx rax, dl
xor r8, rax
shr r9d, 8
movzx eax, r8b
and ebx, 0xfffd
or ebx, 2
lea r8, [0x1400a5480]
mov ecx, dword [r8 + rax*4]
xor ecx, r9d
movzx eax, cl
add eax, dword [r11 + 4]
mov dword [r11], ecx
imul ecx, eax, 0x8088405
inc ecx
mov dword [r11 + 4], ecx
movzx eax, byte [r11 + 7]
movzx ecx, r10b
xor rcx, rax
shr r10d, 8
mov eax, dword [r8 + rcx*4]
xor eax, r10d
mov dword [r11 + 8], eax
mov eax, ebx
xor eax, 1
imul eax, ebx
mov rbx, qword [rsp + 8]
shr eax, 8
xor al, dl
ret

Function at 0x140060bdc
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140060914
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140060914
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140060914
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140060914
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140060914
cmp dword [rcx + 0x84], 0xe
jbe 0x140060914
cmp dword [rcx + 0xf8], esi
je 0x140060914
mov ecx, r14d
call fcn.140060ae4
mov ecx, 2
call fcn.140083c20
nop
cmp byte [0x1400c5580], 0
jne 0x1400609de
mov r15d, 1
mov eax, r15d
xchg dword [0x1400c5570], eax
test ebx, ebx
jne 0x140060987
mov rdi, qword [0x1400c4258]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1400c5578]
cmp rcx, rax
je 0x14006097e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x14009b7d8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1400c58f0]
jmp 0x140060993
cmp ebx, r15d
jne 0x140060999
lea rcx, [0x1400c5908]
call fcn.14007c618
nop
test ebx, ebx
jne 0x1400609b0
lea rdx, [0x14009b928]
lea rcx, [0x14009b908]
call fcn.14007ce18
lea rdx, [0x14009b938]
lea rcx, [0x14009b930]
call fcn.14007ce18
movzx eax, byte [0x1400c5580]
test esi, esi
cmove eax, r15d
mov byte [0x1400c5580], al
jmp 0x1400609de
mov ecx, 2
call fcn.140083c74
test esi, esi
jne 0x1400609f5
mov ecx, r14d
call fcn.140060a10
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400608a4
Function at 0x18001a710
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
nop dword [rax]
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov r9d, dword [rax + rdx + 0x88]
test r9, r9
je 0x18001a730
mov r10d, dword [rax + r9 + 0x18]
test r10, r10
je 0x18001a730
mov r11d, dword [rax + r9 + 0x20]
add r11, rax
lea rsi, [rax + 1]
xor edx, edx
jmp 0x18001a779
add rdx, 1
cmp rdx, r10
je 0x18001a730
mov edi, dword [r11 + rdx*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x18001a770
add rdi, rsi
mov ebp, 0x811c9dc5
nop dword [rax]
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
movzx ebx, byte [rdi]
add rdi, 1
test bl, bl
jne 0x18001a790
cmp ebp, 0xda1a7563
jne 0x18001a770
mov ebp, dword [rax + r9 + 0x1c]
mov ebx, dword [rax + r9 + 0x24]
add rbp, rax
add rbx, rax
mov edx, edx
movzx edx, word [rbx + rdx*2]
mov edx, dword [rbp + rdx*4]
add rdx, rax
mov qword [rsp + 0x20], rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.18004bb50
cmp eax, 0xffffffff
setne al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x18001a7f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
nop dword [rax]
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov r9d, dword [rax + rdx + 0x88]
test r9, r9
je 0x18001a810
mov r10d, dword [rax + r9 + 0x18]
test r10, r10
je 0x18001a810
mov r11d, dword [rax + r9 + 0x20]
add r11, rax
lea rsi, [rax + 1]
xor edx, edx
jmp 0x18001a859
add rdx, 1
cmp rdx, r10
je 0x18001a810
mov edi, dword [r11 + rdx*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x18001a850
add rdi, rsi
mov ebp, 0x811c9dc5
nop dword [rax]
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
movzx ebx, byte [rdi]
add rdi, 1
test bl, bl
jne 0x18001a870
cmp ebp, 0xbdcac9ce
jne 0x18001a850
mov ebp, dword [rax + r9 + 0x1c]
mov ebx, dword [rax + r9 + 0x24]
add rbp, rax
add rbx, rax
mov edx, edx
movzx edx, word [rbx + rdx*2]
mov edx, dword [rbp + rdx*4]
add rdx, rax
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x80
mov dword [rsp + 0x28], 2
mov edx, 0x10000000
mov r8d, 7
xor r9d, r9d
call fcn.18004bb50
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret