joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006aea0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1803490c0]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rdx
mov qword [rcx + 8], rdx
mov rbx, rcx
mov byte [rcx], 1
mov qword [rcx + 0x10], 0
mov edx, 0x66
mov rcx, rdi
mov dword [rbp - 0x19], 0x41525150
mov r8d, 0x40
mov dword [rbp - 0x15], 0x41514150
mov dword [rbp - 0x11], 0x55534152
mov dword [rbp - 0xd], 0x8948006a
mov dword [rbp - 9], 0xfa894ce9
mov dword [rbp - 5], 0x24048d4c
mov dword [rbp - 1], 0x48e58948
mov dword [rbp + 3], 0x48f0e483
mov dword [rbp + 7], 0xff20ec83
mov dword [rbp + 0xb], 0x2d15
mov dword [rbp + 0xf], 0xec894800
mov dword [rbp + 0x13], 0xf8834858
mov dword [rbp + 0x17], 0x5b415d00
mov dword [rbp + 0x1b], 0x59415a41
mov dword [rbp + 0x1f], 0x595a5841
mov word [rbp + 0x23], 0xf58
mov byte [rbp + 0x25], 0x84
mov dword [rbp + 0x2a], 0x6e0f4866
mov dword [rbp + 0x2e], 0x5d8b48c0
mov dword [rbp + 0x32], 0xec8948f8
mov dword [rbp + 0x36], 0x89485e5d
mov word [rbp + 0x3a], 0xffdc
mov byte [rbp + 0x3c], 0xe6
call fcn.18006df30
mov qword [rbx + 0x10], rax
mov rcx, rax
test rax, rax
jne 0x18006afaa
lea rdx, str.Failed_to_allocate_memory_for_i2i_hook_n
lea rcx, [0x18034ad80]
call fcn.180064d80
jmp 0x18006b068
movaps xmm0, xmmword [rbp - 0x19]
lea r9, [rbp + 0x47]
movaps xmm1, xmmword [rbp - 9]
mov eax, edi
sub eax, ecx
mov edx, 0x66
sub eax, 0x43
mov r8d, 0x20
mov dword [rbp + 0x26], eax
lea rax, [0x18006adf0]
mov qword [rbp + 0x3d], rax
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbp + 0x3f]
movups xmmword [rcx + 8], xmm0
movaps xmm0, xmmword [rbp + 7]
movups xmmword [rcx + 0x18], xmm1
movaps xmm1, xmmword [rbp + 0x17]
movups xmmword [rcx + 0x28], xmm0
movaps xmm0, xmmword [rbp + 0x27]
movups xmmword [rcx + 0x38], xmm1
movsd xmm1, qword [rbp + 0x37]
movups xmmword [rcx + 0x48], xmm0
movsd qword [rcx + 0x58], xmm1
mov dword [rcx + 0x60], eax
movzx eax, word [rbp + 0x43]
mov word [rcx + 0x64], ax
mov rcx, qword [rbx + 0x10]
mov dword [rbp + 0x47], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r9, [rbp + 0x47]
mov edx, 5
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rbp + 0x47]
lea r9, [rbp + 0x47]
mov byte [rdi], 0xe9
mov edx, 5
mov eax, dword [rbx + 0x10]
mov rcx, rdi
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rax, rbx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180095fe0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180070540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r15, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.18006e320
mov r13, rax
mov r14, qword [rsi + 0x10]
mov r8, rsi
mov r12, qword [rsi + 0x18]
cmp r12, 0xf
jbe 0x180070586
mov r8, qword [rsi]
movabs rbp, 0xcbf29ce484222325
mov rdx, rbp
xor edi, edi
mov ecx, edi
movabs r9, 0x100000001b3
test r14, r14
je 0x1800705c4
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, r14
jb 0x1800705b0
mov rcx, qword [r13 + 0x38]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x20]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 0x10]
je 0x180070641
mov r15, qword [rax + rcx*8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1800705f3
mov rdx, qword [rdx]
mov rcx, rsi
cmp r12, 0xf
jbe 0x1800705ff
mov rcx, qword [rsi]
cmp r14, rax
jne 0x180070610
mov r8, r14
call fcn.1800c4560
test eax, eax
je 0x18007061b
cmp rbx, r15
je 0x18007062f
mov rbx, qword [rbx + 8]
jmp 0x1800705e1
mov r15, qword [rsp + 0xa8]
movabs r9, 0x100000001b3
jmp 0x180070644
mov r15, qword [rsp + 0xa8]
movabs r9, 0x100000001b3
mov rbx, rdi
mov rcx, rsi
test rbx, rbx
jne 0x1800706d7
lea rdx, [rsp + 0x20]
call fcn.180070990
nop
mov rdx, r15
mov rcx, rax
call fcn.180070aa0
mov rcx, qword [r15]
mov r8, qword [rcx + 0xa8]
mov rdx, rax
mov rcx, r15
call r8
mov rdi, rax
lea rcx, [rsp + 0x20]
call fcn.180004130
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.180064b20
mov qword [rsp + 0x60], rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [r13 + 8]
call fcn.180072690
nop
lea rcx, [rsp + 0x40]
call fcn.180004130
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rdx, r14
cmp r12, 0xf
jbe 0x1800706e3
mov rcx, qword [rsi]
test rdx, rdx
je 0x180070703
nop dword [rax + rax]
movzx eax, byte [rcx + rdi]
xor rbp, rax
imul rbp, r9
inc rdi
cmp rdi, rdx
jb 0x1800706f0
mov rcx, qword [r13 + 0x38]
and rcx, rbp
add rcx, rcx
mov rax, qword [r13 + 0x20]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 0x10]
je 0x180070778
mov rbp, qword [rax + rcx*8]
mov rdi, rdx
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180070742
mov rdx, qword [rdx]
mov rcx, rsi
cmp r12, 0xf
jbe 0x18007074e
mov rcx, qword [rsi]
cmp rdi, rax
jne 0x18007075f
mov r8, rdi
call fcn.1800c4560
test eax, eax
je 0x18007076a
cmp rbx, rbp
je 0x180070778
mov rbx, qword [rbx + 8]
jmp 0x180070730
test rbx, rbx
je 0x180070778
mov rax, qword [rbx + 0x30]
jmp 0x1800706b9
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800933e0
int3
Function at 0x180070790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov r8, rcx
mov r10, qword [rcx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x1800707be
mov rdx, qword [rcx]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
xor edi, edi
mov ecx, edi
movabs rsi, 0x100000001b3
test r10, r10
je 0x1800707f3
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, rsi
inc rcx
cmp rcx, r10
jb 0x1800707e0
lea rdx, [rsp + 0x28]
call fcn.180072220
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180070873
lea r10, [rax + 0x30]
mov rdx, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x18007081c
mov rcx, qword [r14]
test rdx, rdx
je 0x180070834
movzx eax, byte [rcx + rdi]
xor rbx, rax
imul rbx, rsi
inc rdi
cmp rdi, rdx
jb 0x180070821
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, r10
call fcn.180072950
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180070867
mov rax, qword [rax + 0x30]
jmp 0x180070859
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800933e0
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800933e0
int3

Function at 0x180070890
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov r8, rcx
mov r10, qword [rcx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x1800708be
mov rdx, qword [rcx]
movabs rbx, 0xcbf29ce484222325
mov r9, rbx
xor edi, edi
mov ecx, edi
movabs rsi, 0x100000001b3
test r10, r10
je 0x1800708f3
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, rsi
inc rcx
cmp rcx, r10
jb 0x1800708e0
lea rdx, [rsp + 0x28]
call fcn.180072220
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180070973
lea r10, [rax + 0x70]
mov rdx, qword [r14 + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x18007091c
mov rcx, qword [r14]
test rdx, rdx
je 0x180070934
movzx eax, byte [rcx + rdi]
xor rbx, rax
imul rbx, rsi
inc rdi
cmp rdi, rdx
jb 0x180070921
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x28]
mov rcx, r10
call fcn.180072950
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x180070967
mov rax, qword [rax + 0x30]
jmp 0x180070959
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800933e0
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800933e0
int3
Function at 0x180082260
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
cmp byte [rcx + 8], 0
je 0x18008237a
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18008237a
mov rsi, qword [0x18034e858]
cmp qword [rsi + 8], 0
je 0x18008237a
mov rbx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180004d60
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x18034cfc8]
call fcn.180070790
mov rdx, qword [rbx]
mov r9, qword [rdx + 0x320]
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, rbx
call r9
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.180004130
cmp ebx, 4
jne 0x18008237a
mov rsi, qword [0x18034e858]
mov edi, dword [rdi + 0x20]
cmp qword [rsi + 8], 0
je 0x18008237a
mov rbx, qword [rsi]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x14
lea rdx, str.rightClickDelayTimer
lea rcx, [rsp + 0x20]
call fcn.180004d60
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x18034cfc8]
call fcn.180070790
mov r8, qword [rbx]
mov r10, qword [r8 + 0x368]
mov r9d, edi
mov r8, rax
mov rdx, qword [rsi + 8]
mov rcx, rbx
call r10
nop
lea rcx, [rsp + 0x20]
call fcn.180004130
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1800824c0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1803490c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov edi, dword [0x180349edc]
xor esi, esi
mov qword [rsp + 0x28], rcx
mov rbx, rcx
cmp edi, 5
jne 0x180082519
xorps xmm0, xmm0
lea rdx, str.XBUTTON1
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rsi
mov r8d, 8
mov qword [rcx + 0x18], rsi
jmp 0x1800825f0
cmp edi, 6
jne 0x18008253e
xorps xmm0, xmm0
lea rdx, str.XBUTTON2
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rsi
mov r8d, 8
mov qword [rcx + 0x18], rsi
jmp 0x1800825f0
cmp edi, 1
jne 0x180082563
xorps xmm0, xmm0
lea rdx, str.Left_Mouse_Button
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rsi
mov r8d, 0x11
mov qword [rcx + 0x18], rsi
jmp 0x1800825f0
cmp edi, 2
jne 0x180082585
xorps xmm0, xmm0
lea rdx, str.Right_Mouse_Button
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rsi
mov r8d, 0x12
mov qword [rcx + 0x18], rsi
jmp 0x1800825f0
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea ecx, [rdi - 0x25]
cmp ecx, 3
ja 0x18008259b
bts eax, 8
shl eax, 0x10
lea rdx, [rsp + 0x30]
mov ecx, eax
mov r8d, 0x80
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
test eax, eax
jle 0x1800825e0
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], sil
jne 0x1800825d0
lea rdx, [rsp + 0x30]
jmp 0x1800825ed
mov r8d, 7
lea rdx, str.Unknown
mov rcx, rbx
call fcn.180004d60
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180095fe0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800859c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1803490c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx], 0
mov rbx, rcx
jne 0x180085a55
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], 0
cmp byte [rcx], 0xe9
jne 0x180085a31
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180085a31
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call fcn.1800c3a80
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x38
mov rcx, rbx
call fcn.18009659c
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180095fe0
add rsp, 0x30
pop rbx
ret
Function at 0x180088130
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rdx]
mov rbx, r8
dec eax
mov r8, rdx
mov rdi, rcx
cmp eax, 0x20
ja case.0x180088219.4
lea rsi, [0x180000000]
nop dword [rax]
cdqe
movzx eax, byte [rsi + rax + 0x88398]
mov ecx, dword [rsi + rax*4 + 0x8836c]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0xd0]
movzx r8d, byte [r8 + 1]
add rax, 0xffffffffffffffc4
lea r8, [rax + r8*2]
movzx eax, byte [r8]
dec eax
cmp eax, 0x20
jbe 0x180088160
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xcc]
movzx edx, word [rsi + rax*2 + 0xccd00]
mov rcx, rdi
call fcn.1800869e0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x9c]
cmp al, 8
jae case.0x180088219.4
lea edx, [rax + 0x6d]
mov rcx, rdi
call fcn.1800869e0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [r8 + 1]
add eax, 0xfffffffe
cmp eax, 0x1a
ja case.0x180088219.4
cdqe
movzx eax, byte [rsi + rax + 0x883c8]
mov ecx, dword [rsi + rax*4 + 0x883bc]
add rcx, rsi
jmp rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800891d0
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800883f0
movzx eax, byte [rbx + 0xa2]
mov r9, rbx
mov rcx, rdi
mov rdx, qword [rbx + rax*8 + 0xa8]
inc al
mov byte [rbx + 0xa2], al
call fcn.180086f60
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx edx, byte [rbx + 0x34]
mov rcx, rdi
call fcn.1800869b0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x1800882ae
lea edx, [rax + 0x35]
jmp 0x1800882c0
cmp eax, 1
jne 0x1800882bb
lea edx, [rax + 0x1f]
lea eax, [rdx + 0x19]
jmp 0x1800882c5
mov edx, 0x39
mov eax, 0x20
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.1800869e0
movsxd rax, dword [rbx + 8]
mov rcx, rdi
movzx edx, byte [rax + rsi + 0xccec0]
call fcn.1800869e0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x180088307
lea edx, [rax + 0x31]
jmp 0x180088319
cmp eax, 1
jne 0x180088314
lea edx, [rax + 0x19]
lea eax, [rdx - 0xa]
jmp 0x18008831e
mov edx, 0x10
mov eax, 0x1a
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.1800869e0
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xb8]
jmp 0x1800881ae
movzx edx, byte [rbx + 0xa0]
and edx, 7
add edx, 0x85
jmp 0x1800881b6
movsxd rax, dword [rbx + 0x98]
jmp 0x1800881ae
Function at 0x180094880
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1800948ae
xor eax, eax
jmp 0x180094994
cmp qword [rcx + 0x68], 0
je 0x1800948bf
call fcn.1800949b0
jmp 0x180094994
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800948d6
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800948d8
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18009490a
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1800c3a80
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x18009498e
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x180094941
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18009496a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1800a16e0
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x18009498e
cmp rsi, rbx
ja 0x180094948
test rsi, rsi
je 0x18009498e
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1800a16e0
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18009c864
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180096d50
sub rsp, rax
mov rax, qword [0x1803490c0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1800ae0b0
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18009c8b3
mov rax, rbp
jmp 0x18009c9bb
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x34c1b0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1800ae340
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x34c1b0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18009c9b7
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18009c9b7
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1800ae340
test rax, rax
js 0x18009c9b7
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18009c9b7
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x18009c9a9
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x18009c9a9
cmp byte [rcx], 0xd
jne 0x18009c98f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18009c99e
cmp byte [rcx + 1], 0xa
jne 0x18009c99e
inc rcx
jmp 0x18009c99e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x349490]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18009c971
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18009c9bb
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180095fe0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800a9300
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x1800a9337
call fcn.1800a8c00
mov dword [rax], 0x16
call fcn.18009c424
xor eax, eax
jmp 0x1800a93c5
mov rdx, r9
mov rcx, r8
call fcn.1800a929c
mov rbx, rax
test rax, rax
je 0x1800a93c2
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1800a91c8]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1800a93af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800a8b74
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1800a9396
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1800a93a5
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1800af0d0
jmp 0x1800a93c2
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800a93bf
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800ab1dc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1800ab24b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800ab24b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800ab24b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800ab24b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800ab24b
cmp dword [rcx + 0x84], 0xe
jbe 0x1800ab24b
cmp dword [rcx + 0xf8], 0
je 0x1800ab24b
mov ecx, ebx
call fcn.1800ab2fc
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1800ab0d8
nop
cmp dword [rbp + 0x20], 0
je 0x1800ab299
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800ab2a4
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1800ab1dc
Function at 0x1800ae3ec
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x18034c1b0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1800ae443
cmp word [rdx], r13w
jne 0x1800ae443
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1800ae448
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1800ae56d
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1800ae58e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1800ae481
mov rdx, r9
mov word [rbx], cx
jmp 0x1800ae4a8
cmp r9, r8
jae 0x1800ae4b8
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1800ae462
jmp 0x1800ae56d
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800ae562
cmp dword [rsp + 0x80], esi
je 0x1800ae562
lea r8, [0x18034c1b0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1800ae53a
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1800ae50a
mov word [rbx], r13w
jmp 0x1800ae56a
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1800ae517
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1800ae56a
cmp word [rsp + 0x70], r13w
jne 0x1800ae547
cmp rbx, r14
je 0x1800ae504
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1800ae348
cmp word [rsp + 0x70], r13w
je 0x1800ae56d
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x18034c1b0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1800ae567
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1800ae56d