joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14088b99a
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffe8e4f4ef
cmpsb byte es:[rsi], byte [rdi]
ror dword [rcx], cl
movabs byte [0x26eed3fdd8f1faaf], al
mov bh, 0xf5
outsb dx, byte [rsi]
cmpsd dword [rsi], dword [rdi]
sbb ecx, dword [rax - 0x2a]
invalid
add qword [rsp + 0x20], 0x5f816
cmp r13d, 0x1a320440
lea r13, [r13*2 + 0x77b776c9]
bswap r13
add eax, 0xfd814100
add al, 0x32
sbb cl, byte [rsi - 0x73]
sub al, 0x6d
leave
jbe 0x14088b968
ja 0x14088b9fc
bswap ebp
call fcn.1411445ad
adc ah, bl
push rcx
sbb ah, byte [rbp + 0x9e7b195]
movabs byte [0xb6887668e92e4bf6], al
movabs byte [0x5fc8054940ea8701], al
add al, ch
pop rsi
pop rax
xor ch, byte [rdi]
add dword [rax], eax
add byte [rax], al
mov bh, 0xb2
xor esp, dword [0xe654251d]
cmp esp, dword [rbx + 0x2025b6b0]
jnp 0x14088b9a1
sub bl, byte [rdx + 0x3a]
push rdx
adc byte [rdx - 0x26], bl
scasb al, byte [rdi]
invalid
movsd dword [rdi], dword [rsi]
sub eax, 0x25a2dc11
cdq
cwde
in al, dx
sub bl, dl
xor edi, ebx
jne 0x14088ba5b
pop rdx
stc
invalid
and dword [rcx - 0xe806ad9], ecx
sti
lodsb al, byte [rsi]
adc dword [0x15de6ec7c], edx
out dx, al
and dword [rax], ebx
invalid
Function at 0x180764058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1807641df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180764089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18076406f
add dl, dl
jne 0x180764096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807640f6
xor eax, eax
add dl, dl
jne 0x1807640a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1807641ad
add dl, dl
jne 0x1807640b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807640c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807640d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1807640dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1807640ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18076407e
mov eax, 1
add dl, dl
jne 0x180764106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180764113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1807640fb
sub eax, ebx
mov ebx, 1
jne 0x18076414c
mov ecx, 1
add dl, dl
jne 0x18076412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18076413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180764123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18076407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180764168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180764175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18076415d
cmp eax, 0x7d00
jae 0x18076419b
cmp eax, 0x500
jb 0x180764196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18076407e
cmp eax, 0x7f
ja 0x18076419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18076407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1807641d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18076407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180010f70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r12d, [rcx + 6]
mov rdi, r9
mov r15, rdx
mov ebx, ecx
cmp ecx, r12d
jae 0x1800110a4
mov r13, qword [rsp + 0x20]
lea eax, [rbx - 0x53]
lea rdx, [0x180000000]
cmp eax, 0xc
ja case.0x180010fc0.86
mov ecx, dword [rdx + rax*4 + 0x110c0]
add rcx, rdx
jmp rcx
mov rbx, qword [r15 + 0x18]
mov rsi, qword [r15 + 0x20]
cmp rbx, rsi
je 0x180011015
mov rbp, qword [rdi + 0x18]
mov r14, qword [rdi + 0x10]
mov rdx, rdi
cmp rbp, 0x10
jb 0x180010fe3
mov rdx, qword [rdi]
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x180010ff0
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, r14
jne 0x180011002
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180011012
add rbx, 0x28
cmp rbx, rsi
jne 0x180010fd7
mov ebx, 0x54
jmp case.0x180010fc0.86
inc dword [rbx + 0x24]
mov ebx, 0x54
jmp case.0x180010fc0.86
mov r8, qword [r8]
mov r9, r15
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r13, rax
test rax, rax
jne case.0x180010fc0.86
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
jne case.0x180010fc0.86
mov eax, 0xffffffff
jmp 0x1800110a8
mov rcx, qword [r15 + 0x40]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp case.0x180010fc0.86
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
inc ebx
cmp ebx, r12d
jae 0x1800110a4
mov r8, qword [rsp + 0x80]
jmp 0x180010fa3
mov eax, r13d
jmp 0x1800110a8
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, r15
lea rdx, str.__builtin_HEXAGON_V6_vscattermw_128B
mov rcx, rax
call fcn.1800a0de0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180018420
Capabilities:
Hash data using sha256

Disassembly:
push rbx
push rbp
push r12
push r15
sub rsp, 0x48
imul r12d, ecx, 0x444
mov rbx, rdx
mov r15d, ecx
mov ebp, ecx
cmp ecx, r12d
ja 0x1800185a7
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r13
xor r13d, r13d
mov qword [rsp + 0x30], r14
mov r14, qword [rsp + 0x80]
cmp ebp, 0xb003
ja 0x180018542
je 0x18001852b
cmp ebp, 0x15
je 0x180018510
cmp ebp, 0x11f
je 0x180018508
cmp ebp, 0xce1
jne 0x180018581
mov esi, r13d
cmp dword [rbx + 0x60], r13d
jbe 0x1800184ff
nop
mov eax, esi
lea rdi, [rax + rax*2]
add rdi, rdi
movzx eax, word [r14 + rdi*8 + 8]
test ax, ax
je 0x1800184f8
mov dword [rsp + 0x28], 0xdd
lea rdx, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov word [rsp + 0x70], ax
xor ecx, ecx
call fcn.180087950
movzx eax, word [r14 + rdi*8 + 8]
lea r8, [rsp + 0x70]
mov r9d, 0x84
mov word [rsp + 0x70], ax
mov rdx, rbx
xor ecx, ecx
call fcn.1800876c0
inc esi
cmp esi, dword [rbx + 0x60]
jb 0x1800184a0
mov byte [rbx + 0x98], r13b
jmp 0x180018581
mov dword [rbx], 0x6a09e667
jmp 0x180018581
cmp dword [rbx + 0xa8], 0x20090315
jne 0x180018593
cmp byte [rbx + 0x98], r13b
je 0x180018593
mov r14, qword [rbx + 0x58]
jmp 0x180018581
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
jmp 0x180018581
cmp ebp, 0x15ee7
je 0x18001856c
cmp ebp, 0x20dcb
je 0x180018563
cmp ebp, 0x2bcaf
jne 0x180018581
mov qword [rbx + 0xc0], r13
jmp 0x180018581
mov dword [rbx + 0x1c], 0x5be0cd19
jmp 0x180018581
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
imul eax, r15d, 0x9c
add ebp, eax
cmp ebp, r12d
jbe 0x180018462
mov r13, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x30]
add rsp, 0x48
pop r15
pop r12
pop rbp
pop rbx
ret
Function at 0x18002b5c0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebx, dword [rsp + 0x48]
lea r14d, [rdx + 0x84]
mov esi, edx
mov rbp, rcx
cmp edx, r14d
jae 0x18002b783
mov edi, dword [rsp + 0x48]
nop
mov eax, esi
sub eax, 0x61
je 0x18002b628
sub eax, 0x21
je 0x18002b61e
sub eax, 0x21
je 0x18002b783
cmp eax, 0x82
jne 0x18002b777
mov rcx, qword [rbp + 0x10]
call fcn.1800a1078
jmp 0x18002b777
mov ebx, 1
jmp 0x18002b777
xor r9d, r9d
mov r8d, 0xe0
mov rdx, rbp
xor ecx, ecx
call fcn.18009b510
mov ecx, eax
test eax, eax
je 0x18002b6de
sub ecx, 1
je 0x18002b65d
sub ecx, 1
je 0x18002b772
cmp ecx, 1
je 0x18002b696
jmp 0x18002b772
mov esi, reloc.SHELL32.dll_PathMakeUniqueName
mov eax, esi
sub eax, 0x2e
je 0x18002b783
cmp eax, 1
jne 0x18002b68f
lea ecx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbp
lea rdx, str.summary.runtime.consolidationNeeded
mov rcx, rax
call fcn.1800a0de0
xor ebx, ebx
dec esi
cmp esi, 0x2d
ja 0x18002b662
mov esi, ILAppendID
nop dword [rax + rax]
mov eax, esi
sub eax, 0x95
je 0x18002b783
cmp eax, 1
jne 0x18002b6cf
lea ecx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbp
lea rdx, str.cannot_open_stream
mov rcx, rax
call fcn.1800a0de0
xor ebx, ebx
dec esi
cmp esi, 0x94
ja 0x18002b6a0
jmp 0x18002b772
mov esi, 0x1e
mov eax, esi
sub eax, 0x1b
je 0x18002b70b
sub eax, 3
je 0x18002b6f6
cmp eax, 1
je 0x18002b72d
jmp 0x18002b726
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor edi, edi
test eax, eax
setne dil
jmp 0x18002b726
mov r8d, 0xf6
mov dword [rsp + 0x48], 0x1ed
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.180019d50
inc esi
cmp esi, 0x21
jb 0x18002b6e3
test edi, edi
jne 0x18002b772
mov esi, 0xe1
mov eax, esi
sub eax, 0xdf
je 0x18002b783
sub eax, 1
je 0x18002b766
cmp eax, 1
jne 0x18002b768
lea ecx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbp
lea rdx, str.VmodlConverterFaultSSLConnectionFault
mov rcx, rax
call fcn.1800a0de0
jmp 0x18002b768
xor ebx, ebx
dec esi
cmp esi, 0xde
ja 0x18002b736
mov esi, 0x61
add esi, 0x21
cmp esi, r14d
jb 0x18002b5f0
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180032b80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, qword [rsp + 0x30]
mov r13d, r8d
mov ebp, dword [rsp + 0x30]
mov r12, rdx
mov ebx, dword [rsp + 0x30]
mov r15, rcx
mov r14d, r8d
xor edi, edi
nop dword [rax]
nop dword [rax + rax]
lea eax, [r13 + 5]
cmp r14d, eax
jae 0x180032c9c
mov eax, r14d
sub eax, 0x7c
je 0x180032cf0
sub eax, 1
je 0x180032c9c
sub eax, 4
je 0x180032ccf
sub eax, 1
je 0x180032c10
cmp eax, 1
jne 0x180032d80
mov eax, 0x41
jmp 0x180032c82
xor r14d, r14d
nop dword [rax]
nop word [rax + rax]
mov edi, 0x111
mov eax, edi
sub eax, 0x110
je 0x180032c49
cmp eax, 1
jne 0x180032c68
xor r9d, r9d
lea ecx, [rax + 0x6b]
xor r8d, r8d
mov rdx, r15
call fcn.18003c5a0
mov rsi, rax
jmp 0x180032c68
test rsi, rsi
je 0x180032c74
mov r9, qword [r15]
mov r8d, reloc.SHELL32.dll_SHSetFolderPathA
mov rdx, r12
mov rcx, rsi
call fcn.18006b780
test eax, eax
cmove ebp, r14d
dec edi
cmp edi, 0x10f
ja 0x180032c25
jmp 0x180032c20
mov eax, 0x41
lea r14d, [rax + 0x42]
add eax, 0x20c1
cmp eax, 0x6243
ja 0x180032ccd
cmp eax, 0x41
je 0x180032c74
cmp eax, 0x2102
je 0x180032cc9
cmp eax, 0x41c3
jne 0x180032c7d
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebx, ebp
jmp 0x180032c7d
xor edi, edi
cmp dword [r12 + 0xc], 0
jne 0x180032d88
mov ebp, 1
inc r14d
jmp 0x180032bd0
mov r9, r15
mov qword [rsp + 0x30], 0x40
lea r8, [rsp + 0x40]
mov ecx, 0x60
lea rdx, [rsp + 0x30]
call fcn.18001b9c0
mov rbx, rax
test r12, r12
je 0x180032d35
mov r9, r12
mov r8d, ebx
mov edx, 1
mov edi, ebx
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rdi
jb 0x180032dab
test ebx, ebx
jne 0x180032cf0
mov rcx, qword [r15 + 0x20]
xor edi, edi
mov dword [rsp + 0x28], 0xbd
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call fcn.18008c4a0
mov rcx, qword [r15 + 8]
cmp rax, qword [rcx + 0x38]
jne 0x180032d7e
mov rdx, qword [r15 + 0x20]
mov ecx, 0xca
call fcn.180044ef0
mov rcx, qword [r15 + 8]
lea ebx, [rdi + 1]
cmp ax, word [rcx + 0x42]
je 0x180032d80
mov ebx, edi
inc r14d
jmp 0x180032bd0
mov qword [rsp + 0x28], rdi
mov r9d, 0x129
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, r12
mov rcx, r15
call fcn.18003aa10
jmp 0x180032c9e
xor r14d, r14d
mov eax, r14d
jmp 0x180032c9e
Function at 0x180033260
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x670
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rsp + 0x660], rax
lea ebp, [r8 + 0x1f8]
mov r15, r9
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
cmp r8d, ebp
jae 0x18003337e
mov qword [rsp + 0x6b0], rdi
mov rdi, qword [rsp + 0x30]
nop word [rax + rax]
mov eax, ebx
sub eax, 0x7e
je 0x180033358
sub eax, 0x7b
je 0x1800332fa
sub eax, 3
je 0x1800332dc
cmp eax, 0x7e
jne 0x18003336b
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18003336b
mov r8, qword [0x1800c3cb0]
mov r9, rdi
mov rcx, qword [0x1800c3ca8]
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18003336b
lea r9, [rsp + 0x1c0]
mov dword [rsp + 0x30], 8
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r15
mov edx, 0x111
lea rcx, [rsp + 0x30]
call fcn.18004fc60
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], r14
mov r9d, 0x125
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x1c0]
mov qword [rsp + 0x30], 8
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.18006ff20
jmp 0x18003336b
lea rdx, [0x1800a7668]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
add ebx, 0x7e
cmp ebx, ebp
jb 0x1800332b0
mov rdi, qword [rsp + 0x6b0]
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.1800a1820
add rsp, 0x670
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800333a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r15d, dword [rsp + 0x110]
mov r11, r9
movzx ebx, byte [rsp + 0x30]
mov r10, r8
mov qword [rsp + 0x48], r9
mov rdi, rcx
mov qword [rsp + 0x40], r8
lea r13d, [r15 + 0x66]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
cmp r15d, r13d
jae case.0x180033431.2
movzx ebp, byte [rsp + 0x30]
lea r12d, [r15 - 0xcc]
mov esi, dword [rsp + 0x38]
lea r8, [0x180000000]
cmp r12d, 0x6d
ja case.0x180033431.6
movzx eax, byte [r8 + r12 + 0x335e8]
mov ecx, dword [r8 + rax*4 + 0x335cc]
add rcx, r8
jmp rcx
mov eax, dword [rdx]
mov r8d, 0xef
mov r9, qword [0x1800c3d38]
mov rdx, r10
mov dword [rsp + 0x38], eax
mov rcx, r11
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.1800857f0
test eax, eax
jne 0x18003359e
movzx eax, bl
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
xor bpl, bpl
jmp 0x18003359e
movsxd r8, dword [r10]
xor edx, edx
mov rcx, r11
call sub.VCRUNTIME140.dll_memset
mov r9, qword [0x1800c3d38]
lea r8, [rsp + 0x60]
mov rdx, rdi
mov ecx, 0x64
call fcn.180067330
test eax, eax
je case.0x180033431.2
jmp 0x18003359e
mov r14d, 0x6c
nop dword [rax]
cmp r14d, 0x6c
je 0x180033514
cmp r14d, 0xf5
je 0x18003350e
cmp r14d, 0x17e
je case.0x180033431.2
jmp 0x180033568
movzx ebx, bpl
jmp 0x180033568
mov edi, 0x1f
nop dword [rax]
mov eax, edi
sub eax, 0x1d
je 0x18003354b
sub eax, 1
je 0x18003353b
cmp eax, 1
jne 0x18003355c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
mov esi, eax
jmp 0x18003355c
test esi, esi
jns 0x18003355c
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test bpl, bpl
movzx ecx, bpl
movzx eax, sil
cmove ecx, eax
movzx ebp, cl
dec edi
cmp edi, 0x1c
ja 0x180033520
cmp esi, 0xa
jne 0x180033514
add r14d, 0x89
cmp r14d, 0x207
jb 0x1800334f0
mov rdi, qword [rsp + 0x58]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rdi
lea rdx, [0x1800a73f4]
mov rcx, rax
call fcn.1800a0de0
mov rdx, qword [rsp + 0x50]
lea r8, [0x180000000]
mov r11, qword [rsp + 0x48]
mov r10, qword [rsp + 0x40]
add r15d, 0x11
add r12d, 0x11
cmp r15d, r13d
jb 0x180033413
jmp case.0x180033431.2
Function at 0x180034d30
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
imul edi, ecx, 0xa4
mov rbx, rdx
mov r11d, ecx
mov r9d, ecx
cmp ecx, edi
ja 0x180034de6
mov r10d, dword [rsp + 0x30]
cmp r9d, 0x6b
je 0x180034df1
cmp r9d, 0x7a
je 0x180034dc6
cmp r9d, 0x1404
je 0x180034dc0
cmp r9d, 0x278e
jne 0x180034dd6
cmp dword [rbx + 0x10], r10d
jae 0x180034dd6
nop
mov r8d, 0xa3
mov eax, r8d
sub eax, 0xa2
je 0x180034da9
cmp eax, 1
jne 0x180034dac
movzx eax, word [rbx + 0xc]
mov edx, dword [rbx + 0x10]
mov rcx, qword [rbx]
mov word [rcx + rdx*2], ax
add dword [rbx + 0xc], 2
jmp 0x180034dac
inc dword [rbx + 0x10]
dec r8d
cmp r8d, 0xa1
ja 0x180034d86
cmp dword [rbx + 0x10], r10d
jb 0x180034d80
jmp 0x180034dd6
mov r10d, dword [rbx + 0xc]
jmp 0x180034dd6
mov ecx, dword [rbx + 0xc]
mov eax, ecx
sub eax, dword [rbx + 0x10]
lea eax, [rcx + rax*2]
cmp eax, dword [rbx + 8]
ja 0x180034de6
imul eax, r11d, 0x29
add r9d, eax
cmp r9d, edi
jbe 0x180034d56
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0
jne 0x180034e1b
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rdx, str.VPMOVSXWDZ128rrk
mov rcx, rax
call fcn.1800a0de0
jmp 0x180034e24
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
cmp dword [0x1800c4df8], 0
je 0x180034e56
mov rax, qword [0x1800c4e00]
lea rbx, [0x1800c4e00]
test rax, rax
je 0x180034e56
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__unlink]
mov rax, qword [rbx + 8]
lea rbx, [rbx + 8]
test rax, rax
jne 0x180034e40
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x180041f20
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea r14d, [r9 + 0xd]
mov qword [rsp + 0x40], rcx
mov r15, rdx
mov r13, r8
mov rdx, rcx
cmp r9d, r14d
jae 0x18004218e
mov qword [r11 + 0x20], rbx
lea r8, [0x180000000]
mov qword [r11 - 0x20], rbp
xor ebx, ebx
mov qword [r11 - 0x28], rsi
lea esi, [r9 - 0x120]
mov qword [r11 - 0x30], rdi
mov r9d, 0x704f
mov qword [r11 - 0x38], r12
mov r12, qword [rsp + 0x40]
nop dword [rax]
cmp esi, 0x1a
ja case.0x180041fa4.10
mov ecx, dword [r8 + rsi*4 + 0x421ac]
add rcx, r8
jmp rcx
mov r8d, 3
mov word [rsp + 0x50], r9w
lea rdx, [0x1800a7487]
mov byte [rsp + 0x52], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x180042143
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x48]
mov qword [rsp + 0x30], rbx
mov r9d, 0xfd
mov qword [rsp + 0x28], rbx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x48], r12
call fcn.1800839f0
jmp 0x180042143
mov rdx, qword [rdx]
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
lea r9, [rsp + 0x48]
xor edx, edx
mov r8d, 0xa2
mov dword [rsp + 0x48], eax
mov rcx, r15
mov r12, rax
call fcn.18004bee0
jmp 0x180042143
lea r8, [rsp + 0x50]
mov word [rsp + 0x78], bx
lea rdx, [rsp + 0x60]
mov ecx, 0xc7
call fcn.1800054c0
mov edx, dword [0x1800c3b20]
mov rbp, rax
mov edi, ebx
test edx, edx
jle 0x180042143
nop dword [rax]
mov rcx, qword [0x1800c3c58]
mov r8d, dword [rbx + rcx]
test r8d, r8d
je 0x18004208b
xor edx, edx
lea ecx, [rdx + 1]
call rbp
mov rcx, rax
mov edx, 3
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x1800c3b20]
inc edi
add rbx, 4
cmp edi, edx
jl 0x180042060
xor ebx, ebx
jmp 0x180042143
mov dword [rsp + 0x60], 0x65006b
jmp case.0x180041fa4.10
movzx eax, word [0x1800a74aa]
movsd xmm0, qword [0x1800a74a2]
mov word [rsp + 0x70], ax
mov eax, dword [0x1800a74c2]
mov dword [rsp + 0x72], eax
movzx eax, word [0x1800a74c6]
mov word [rsp + 0x76], ax
movsd qword [rsp + 0x68], xmm0
jmp case.0x180041fa4.10
mov word [rsp + 0x5a], 0x73
jmp case.0x180041fa4.10
mov byte [rsp + 0x5a], 0
jmp case.0x180041fa4.10
mov word [rsp + 0x64], bx
jmp case.0x180041fa4.10
lea rcx, [0x1800a74d4]
call fcn.1800a0e30
mov rdx, r15
lea rcx, str._s_:
call fcn.1800657b0
jmp 0x180042143
mov eax, dword [0x1800a74e1]
mov dword [rsp + 0x55], eax
movzx eax, byte [0x1800a74e5]
mov byte [rsp + 0x59], al
jmp case.0x180041fa4.10
mov r8d, 2
lea rdx, [0x1800a7514]
lea rcx, [rsp + 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rsp + 0x68], bx
mov rdx, qword [rsp + 0x40]
lea r8, [0x180000000]
mov r9d, 0x704f
inc esi
lea eax, [rsi + 0x120]
cmp eax, r14d
jb 0x180041f90
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xe8]
mov r12, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800a1820
add rsp, 0xb0
pop r15
pop r14
pop r13
ret
Function at 0x180044770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x68]
lea r14d, [r9 + 7]
mov r15, r8
mov rbp, rdx
mov r12, rcx
cmp r9d, r14d
jae case.0x1800447ca.3
movzx edi, word [rsp + 0x68]
lea esi, [r9 - 0x79]
lea r13, [0x180000000]
cmp esi, 9
ja case.0x1800447ca.4
mov ecx, dword [r13 + rsi*4 + 0x44890]
add rcx, r13
jmp rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x84
xor ecx, ecx
call fcn.180048490
xor r9d, r9d
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x1d]
call fcn.18001af40
jmp case.0x1800447ca.4
mov word [r15], di
jmp case.0x1800447ca.4
xor ebx, ebx
jmp case.0x1800447ca.4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc1
call fcn.180096a10
mov edx, 0x79
xor ecx, ecx
call fcn.180096d60
jmp case.0x1800447ca.4
mov r9, qword [r12]
xor r8d, r8d
test r9, r9
je case.0x1800447ca.4
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [rax + rbp]
inc r8d
movzx eax, di
xor rcx, rax
movzx eax, di
shr ax, 8
movzx edx, cl
movzx edi, word [r13 + rdx*4 + 0xc21f0]
xor di, ax
mov eax, r8d
cmp rax, r9
jb 0x180044830
jmp case.0x1800447ca.4
movzx edi, word [r15]
inc esi
lea eax, [rsi + 0x79]
cmp eax, r14d
jb 0x1800447b6
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1800448c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
lea esi, [rdx - 4]
mov ebx, edx
mov rdi, rcx
cmp edx, esi
jbe 0x18004498d
xor ebp, ebp
nop
mov eax, ebx
sub eax, 0xed
je 0x18004498d
sub eax, 1
je 0x180044949
sub eax, 1
je 0x180044927
cmp eax, 4
jne 0x18004496d
movzx ecx, byte [rdi + 1]
movzx eax, byte [rdi]
shl eax, 8
or eax, ecx
movzx ecx, byte [rdi + 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [rdi + 3]
shl eax, 8
or eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x28], rbp
lea r8, [0x18000e2d0]
mov r9, rdi
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi], rax
jmp 0x18004496d
cmp qword [rdi], rbp
je 0x180044988
lea r8, [rsp + 0x60]
mov dword [rsp + 0x60], 1
mov rdx, rdi
mov ecx, 0x92
call fcn.180018cd0
mov byte [rsp + 0x58], 1
dec ebx
cmp ebx, esi
ja 0x1800448e0
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0x58], bpl
mov eax, dword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret