joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007830
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d2e0]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x180007870
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d300]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1800078b0
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d320]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x1800078f0
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d339]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x180007930
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, str.Bc_byAbj_hxhy_rkJaJ_vAUQAWP_
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x180007970
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e258]
mov ecx, dword [0x18002e25c]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0x49ec1eb6
lea r14, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r15, [0x18002d361]
lea r12, [0x18002d030]
mov r13, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov ebp, 0x1d38a5e4
mov edi, 0xc0f8f50
nop dword [rax + rax]
cmp eax, 0x49ec1eb5
jg 0x180007a00
cmp eax, 0xc0f8f50
je 0x180007a3b
cmp eax, 0x1d38a5e4
jne 0x1800079e0
jmp 0x180007aa9
cmp eax, 0x595833cb
je 0x180007a8d
cmp eax, 0x49ec1eb6
jne 0x1800079e0
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0x595833cb
cmovne eax, edi
test cl, cl
mov ecx, 0x595833cb
cmove eax, ecx
test dl, dl
cmovne eax, edi
jmp 0x1800079e0
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, r12
call rsi
call r13
mov eax, dword [0x18002e258]
mov ecx, dword [0x18002e25c]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov ebx, 0x595833cb
cmovne ebx, ebp
cmp edx, 0xffffffff
mov eax, ebx
cmove eax, ebp
cmp ecx, 0xa
cmovge eax, ebx
jmp 0x1800079e0
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, r12
call rsi
call r13
mov eax, 0xc0f8f50
jmp 0x1800079e0
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180007ac0
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, [0x18002d370]
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x180007b00
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e260]
mov ecx, dword [0x18002e264]
lea edx, [rax - 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0xf38e6b08
lea r14, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r15, str._AbN_
lea rbx, [0x18002d030]
mov rdi, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov r13d, 0x6f70aeb5
mov r12d, 0x7e7889c
mov ebp, 0x93db5b15
nop
cmp eax, 0x7e7889b
jle 0x180007b90
cmp eax, 0x7e7889c
je 0x180007bc2
cmp eax, 0x6f70aeb5
jne 0x180007b70
jmp 0x180007c23
cmp eax, 0x93db5b15
je 0x180007bda
cmp eax, 0xf38e6b08
jne 0x180007b70
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, ecx
xor dl, al
mov edx, 0x7e7889c
cmovne edx, ebp
test al, al
mov eax, edx
cmovne eax, ebp
test cl, cl
cmove eax, edx
jmp 0x180007b70
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, rbx
call rsi
call rdi
mov eax, 0x93db5b15
jmp 0x180007b70
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, rbx
call rsi
call rdi
mov eax, dword [0x18002e260]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x7e7889c
cmove eax, r13d
cmp dword [0x18002e264], 0xa
cmovge eax, r12d
setl dl
xor dl, cl
cmovne eax, r13d
jmp 0x180007b70
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180007c40
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e268]
mov ecx, dword [0x18002e26c]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0xfadc2402
lea r14, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r15, [0x18002d38b]
lea r12, [0x18002d030]
mov rdi, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov r13d, 0x48407cb5
mov ebp, 0x349ce175
nop word [rax + rax]
cmp eax, 0x349ce174
jg 0x180007d00
cmp eax, 0x9ba3ae98
je 0x180007d5f
cmp eax, 0xfadc2402
jne 0x180007cb0
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, ecx
xor dl, al
test al, al
mov eax, 0x9ba3ae98
cmovne eax, r13d
test cl, cl
mov ecx, 0x9ba3ae98
cmove eax, ecx
test dl, dl
cmovne eax, r13d
jmp 0x180007cb0
cmp eax, 0x349ce175
je 0x180007d7a
cmp eax, 0x48407cb5
jne 0x180007cb0
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, r12
call rsi
call rdi
mov eax, dword [0x18002e268]
mov ecx, dword [0x18002e26c]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete al
cmp ecx, 0xa
setl bl
xor bl, al
mov ebx, 0x9ba3ae98
cmovne ebx, ebp
cmp edx, 0xffffffff
mov eax, ebx
cmove eax, ebp
cmp ecx, 0xa
cmovge eax, ebx
jmp 0x180007cb0
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, r12
call rsi
call rdi
mov eax, 0x48407cb5
jmp 0x180007cb0
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180007d90
Capabilities:
Print debug messages

Disassembly:
push rsi
sub rsp, 0x20
lea rcx, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rsi
lea rcx, str.dEhX_DFyNZNX_eD_BMBHJ_BDE
call rsi
lea rcx, [0x18002d030]
call rsi
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x180007dd0
Capabilities:
Print debug messages

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, dword [0x18002e270]
mov ecx, dword [0x18002e274]
lea edx, [rax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [rsp + 0x26]
cmp ecx, 0xa
setl byte [rsp + 0x27]
mov eax, 0xbb8d5dfd
lea r14, section..data
mov rsi, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r15, str.IhGu
lea rbx, [0x18002d030]
mov r13, qword [sym.imp.KERNEL32.dll_DebugBreak]
mov r12d, 0x75a9d7ba
mov ebp, 0xad711cf1
mov edi, 0xf5e0aac1
nop
cmp eax, 0xf5e0aac0
jg 0x180007e80
cmp eax, 0xad711cf1
je 0x180007ed5
cmp eax, 0xbb8d5dfd
jne 0x180007e40
movzx ecx, byte [rsp + 0x26]
movzx eax, byte [rsp + 0x27]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0xad711cf1
cmovne eax, r12d
test cl, cl
cmove eax, ebp
test dl, dl
cmovne eax, r12d
jmp 0x180007e40
cmp eax, 0xf5e0aac1
je 0x180007ef1
cmp eax, 0x75a9d7ba
jne 0x180007e40
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, rbx
call rsi
call r13
mov eax, dword [0x18002e270]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0xad711cf1
cmove eax, edi
cmp dword [0x18002e274], 0xa
cmovge eax, ebp
setl dl
xor dl, cl
cmovne eax, edi
jmp 0x180007e40
mov rcx, r14
call rsi
mov rcx, r15
call rsi
mov rcx, rbx
call rsi
call r13
mov eax, 0x75a9d7ba
jmp 0x180007e40
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18001c5b8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18001c5e8
xor eax, eax
jmp 0x18001c6ab
mov rbp, rbx
cmp word [rax], si
je 0x18001c60d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001c5f4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18001c5f0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18001c4d8
movsxd r14, eax
test eax, eax
jne 0x18001c64b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18001c5e1
mov rcx, r14
call fcn.18001c6c8
mov rdi, rax
test rax, rax
jne 0x18001c664
xor ecx, ecx
call fcn.18001a71c
jmp 0x18001c640
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18001c4d8
test eax, eax
jne 0x18001c695
mov rcx, rdi
call fcn.18001a71c
jmp 0x18001c69f
xor ecx, ecx
call fcn.18001a71c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001113b
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x140011a60
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x128]
lea rcx, [0x1400220b1]
call fcn.140011393
nop
movzx eax, word [rbp + 0x100]
mov word [rbp + 4], ax
movzx eax, word [rbp + 0x108]
mov word [rbp + 6], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.14001132f
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x1400132e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x14001128a
Capabilities:
Execute command

Disassembly:
jmp 0x140011b10
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400220b1]
call fcn.140011393
nop
mov dword [rbp + 4], 0xa
mov dword [rbp + 0x24], 0xa
mov dword [rbp + 0x64], 0xa
mov dword [rbp + 0x84], 0xa
mov dword [rbp + 0xa4], 0
mov dword [rbp + 0xc4], 0
lea rcx, [0x14001acb4]
call qword [sym.imp.ucrtbased.dll_system]
nop
mov edx, dword [rbp + 0x24]
mov ecx, dword [rbp + 4]
call fcn.14001113b
nop
mov edx, dword [rbp + 0x84]
mov ecx, dword [rbp + 0x64]
call fcn.1400113de
nop
xor eax, eax
cmp eax, 1
je 0x140011ce5
call qword [sym.imp.ucrtbased.dll__kbhit]
test eax, eax
je 0x140011cd4
call qword [sym.imp.ucrtbased.dll__getch]
mov byte [rbp + 0x44], al
call qword [sym.imp.ucrtbased.dll__getch]
mov byte [rbp + 0xe4], al
movsx eax, byte [rbp + 0x44]
cmp eax, 0x71
jne 0x140011bc4
jmp 0x140011ce5
movsx eax, byte [rbp + 0xe4]
cmp eax, 0x20
jne 0x140011bed
cmp dword [rbp + 0xa4], 0
jne 0x140011bed
mov dword [rbp + 0xa4], 1
mov dword [rbp + 0xc4], 5
mov edx, dword [rbp + 0x24]
mov ecx, dword [rbp + 4]
call fcn.14001113b
nop
lea rcx, [0x14001acb8]
call fcn.1400111b3
nop
movzx eax, byte [rbp + 0x44]
mov byte [rbp + 0x1b4], al
cmp byte [rbp + 0x1b4], 0x61
je 0x140011c56
cmp byte [rbp + 0x1b4], 0x64
je 0x140011c66
cmp byte [rbp + 0x1b4], 0x73
je 0x140011c46
cmp byte [rbp + 0x1b4], 0x77
je 0x140011c36
jmp 0x140011c74
cmp dword [rbp + 0x24], 0
jle 0x140011c44
mov eax, dword [rbp + 0x24]
dec eax
mov dword [rbp + 0x24], eax
jmp 0x140011c74
cmp dword [rbp + 0x24], 0x18
jge 0x140011c54
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
jmp 0x140011c74
cmp dword [rbp + 4], 0
jle 0x140011c64
mov eax, dword [rbp + 4]
dec eax
mov dword [rbp + 4], eax
jmp 0x140011c74
cmp dword [rbp + 4], 0x4f
jge 0x140011c74
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov edx, dword [rbp + 0x84]
mov ecx, dword [rbp + 0x64]
call fcn.1400112cb
nop
cmp dword [rbp + 0xa4], 0
je 0x140011cbd
mov eax, dword [rbp + 0x84]
dec eax
mov dword [rbp + 0x84], eax
mov eax, dword [rbp + 0xc4]
dec eax
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
jg 0x140011cbb
mov dword [rbp + 0xa4], 0
jmp 0x140011cd4
cmp dword [rbp + 0x84], 0xa
jge 0x140011cd4
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x140011b88
mov edx, 0x19
xor ecx, ecx
call fcn.14001113b
nop
lea rcx, str.___n
call fcn.1400111b3
nop
xor eax, eax
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret
Function at 0x140011299
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014630
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014650
xor al, al
jmp 0x1400146d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014663
xor al, al
jmp 0x1400146d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001468d
xor al, al
jmp 0x1400146d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400146a1
xor al, al
jmp 0x1400146d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400146b3
xor al, al
jmp 0x1400146d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400146cf
xor al, al
jmp 0x1400146d1
mov al, 1
add rsp, 0x38
ret
Function at 0x140012510
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113bb
movzx eax, al
test eax, eax
jne 0x140012530
mov ecx, 7
call fcn.140011339
nop
mov byte [rsp + 0x20], 0
call fcn.14001134d
mov byte [rsp + 0x21], al
cmp dword [0x14001d8d8], 1
jne 0x140012554
mov ecx, 7
call fcn.140011339
nop
jmp 0x1400125ac
cmp dword [0x14001d8d8], 0
jne 0x1400125a7
mov dword [0x14001d8d8], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111b8
test eax, eax
je 0x140012588
mov eax, 0xff
jmp 0x1400126b1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011343
mov dword [0x14001d8d8], 2
jmp 0x1400125ac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011325
call fcn.1400112bc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012609
mov rcx, qword [rsp + 0x30]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x140012609
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140023020]
nop
call fcn.1400112f3
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001263d
mov rcx, qword [rsp + 0x38]
call fcn.140011168
movzx eax, al
test eax, eax
je 0x14001263d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001137a
nop
call fcn.140012760
mov dword [rsp + 0x28], eax
call fcn.140011299
movzx eax, al
test eax, eax
jne 0x14001265c
mov ecx, dword [rsp + 0x28]
call fcn.14001105f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001266b
call fcn.140011384
nop
xor edx, edx
mov cl, 1
call fcn.140011159
mov eax, dword [rsp + 0x28]
jmp 0x1400126b1
add rsp, 0x68
ret
Function at 0x10001e024
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1000301f8], rdi
je 0x10001e07d
cmp rax, rdi
jne 0x10001e070
mov esi, 1
jmp 0x10001e07d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10001e057
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e092
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10001e0f7
mov eax, dword [0x1000301f0]
test eax, eax
jne 0x10001e0ed
mov dword [0x1000301f0], 1
lea r12, [0x100001690]
lea rdi, [0x100001678]
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
cmp rdi, r12
jae 0x10001e0df
test eax, eax
jne 0x10001e0df
mov rcx, qword [rdi]
test rcx, rcx
je 0x10001e0d4
call rcx
mov dword [rsp + 0x30], eax
add rdi, 8
mov qword [rsp + 0x38], rdi
jmp 0x10001e0bd
test eax, eax
je 0x10001e0f7
mov eax, 0xff
jmp 0x10001e241
mov dword [0x10002f924], 1
mov eax, dword [0x1000301f0]
cmp eax, 1
jne 0x10001e11f
lea rdx, [0x100001670]
lea rcx, [0x1000015f8]
call sub.msvcrt.dll__initterm
mov dword [0x1000301f0], 2
test esi, esi
jne 0x10001e12c
xor eax, eax
xchg qword [0x1000301f8], rax
cmp qword [0x100030210], 0
je 0x10001e155
lea rcx, [0x100030210]
call fcn.10001e5dc
test eax, eax
je 0x10001e155
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100030210]
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rdi, qword [rax]
mov qword [rsp + 0x28], rdi
mov esi, dword [rsp + 0x20]
cmp byte [rdi], 0x20
ja 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e176
test esi, esi
jne 0x10001e1e0
cmp byte [rdi], 0
je 0x10001e18a
cmp byte [rdi], 0x20
ja 0x10001e18a
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e176
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rdi
xor edx, edx
lea rcx, [0x100000000]
call fcn.100008db4
mov dword [0x10002f920], eax
cmp dword [0x10002f904], 0
jne 0x10001e1c9
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10002f924], 0
jne 0x10001e1de
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10002f920]
jmp 0x10001e241
cmp byte [rdi], 0x22
jne 0x10001e1f2
xor eax, eax
test esi, esi
sete al
mov esi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rdi]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x10001e207
inc rdi
mov qword [rsp + 0x28], rdi
inc rdi
mov qword [rsp + 0x28], rdi
jmp 0x10001e168
lea r11, [rsp + 0xb0]
mov rsi, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call fcn.100162000
add rsp, 0x28
jmp 0x10001e024
Function at 0x140010b70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rbx, rdx
mov r10, qword [rdx + 0x10]
mov rdi, rcx
jbe 0x140010b8e
mov rdx, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x140010bc4
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + r8]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r10
jb 0x140010bb0
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.14002acd0
mov rcx, qword [rax + 8]
mov rax, qword [0x1400a5528]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [0x1400a5528]
je 0x140010c57
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.1400233a0
mov rcx, qword [rax]
mov rax, rdi
movups xmm0, xmmword [rcx + 0x30]
movups xmm1, xmmword [rcx + 0x40]
movaps xmmword [rdi], xmm0
movups xmm0, xmmword [rcx + 0x50]
movaps xmmword [rdi + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x60]
movaps xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x70]
movaps xmmword [rdi + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x80]
movaps xmmword [rdi + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x90]
movaps xmmword [rdi + 0x50], xmm1
movups xmm1, xmmword [rcx + 0xa0]
movaps xmmword [rdi + 0x60], xmm0
movsd xmm0, qword [rcx + 0xb0]
movaps xmmword [rdi + 0x70], xmm1
movsd qword [rdi + 0x80], xmm0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001a4f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14001a518
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14001a53e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001a540
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14001a599
test ecx, ecx
jle 0x14001a579
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14001a599
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001a599
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14001a5c0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001a5e2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14001a5f8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001a614
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001a616
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001a652
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001a6ee
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14001a68d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14001a6ce
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14001a6ee
cmp rbx, rax
ja 0x14001a6a0
test rbx, rbx
je 0x14001a6ee
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret