joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f250
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x30
xor eax, eax
mov qword [rsp + 0x28], rax
test edx, edx
jg 0x14007f265
mov edx, 1
mov rax, rcx
neg rax
lea r10, [0x1401a1188]
mov r11, rax
or r11, 1
test dword [0x14021b7d0], 0x1000
je 0x14007f290
lzcnt r11, r11
xor r11d, 0x3f
jmp 0x14007f294
bsr r11, r11
movsxd r11, r11d
movzx r10d, byte [r10 + r11]
mov r11d, r10d
shl r11, 3
lea rsi, [0x1401a5078]
add r11, rsi
cmp rax, qword [r11]
setb al
movzx eax, al
sub r10d, eax
cmp edx, r10d
jge 0x14007f2c0
jmp 0x14007f2c3
mov r10d, edx
mov r11d, dword [r8 + 8]
add r10d, r11d
cmp r10d, dword [r9 + 8]
jle 0x14007f2e0
xor eax, eax
mov r9, qword [rsp + 0x60]
mov dword [r9], eax
add rsp, 0x30
pop rsi
ret
mov rax, qword [rsp + 0x60]
mov dword [rax], r10d
mov rax, qword [r9]
mov qword [rsp + 0x28], rax
movsxd r9, r10d
lea r9, [rax + r9*2]
neg rcx
mov r10d, edx
cmp rcx, 0x64
jb 0x14007f3d2
add r9, 0xfffffffffffffffc
add r10d, 0xfffffffe
movabs rdx, 0x28f5c28f5c28f5c3
mov rax, rcx
shr rax, 2
mul rdx
shr rdx, 2
imul rax, rdx, 0x64
sub rcx, rax
lea rax, [0x1402072d0]
add ecx, ecx
movsxd rcx, ecx
mov eax, dword [rax + rcx*2 + 0xc]
mov dword [r9], eax
cmp rdx, 0x64
jae 0x14007f3ca
test rdx, rdx
je 0x14007f3c5
dec r10d
movabs rcx, 0xcccccccccccccccd
mov qword [rsp + 0x20], rdx
mov rax, rdx
mul rcx
shr rdx, 3
lea rax, [rdx + rdx*4]
add rax, rax
mov rcx, qword [rsp + 0x20]
mov rsi, rcx
sub rsi, rax
mov rcx, rdx
add r9, 0xfffffffffffffffe
add rsi, 0x30
mov word [r9], si
test rcx, rcx
jne 0x14007f3c0
test r10d, r10d
mov rdx, rcx
jg 0x14007f350
mov rax, r9
lea edx, [r11 - 1]
test edx, edx
jl 0x14007f3f2
cmp r11d, edx
jle 0x14007f3da
add rax, 0xfffffffffffffffe
mov r11d, edx
movzx ecx, word [r8 + r11*2 + 0xc]
mov word [rax], cx
dec edx
jns 0x14007f3aa
jmp 0x14007f3f2
mov rdx, rcx
jmp 0x14007f350
mov rcx, rdx
jmp 0x14007f392
mov rcx, rdx
jmp 0x14007f307
mov rdx, rcx
jmp 0x14007f34b
add rax, 0xfffffffffffffffe
cmp edx, r11d
jae 0x14007f404
mov ecx, edx
movzx ecx, word [r8 + rcx*2 + 0xc]
mov word [rax], cx
dec edx
jns 0x14007f3da
xor eax, eax
mov qword [rsp + 0x28], rax
mov eax, 1
add rsp, 0x30
pop rsi
ret
call fcn.1400ada00
int3

Function at 0x14008e170
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov rsi, rcx
mov edi, edx
call fcn.140001179
cmp byte [rax], 0
je 0x14008e18e
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
ret
call fcn.140001074
cmp byte [rax], 0
jne 0x14008e1a8
mov rcx, rsi
mov edx, edi
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.14008e810
mov edx, edi
cmp byte [rsi + 0x1b8], 0
jne 0x14008e1b9
or edx, 0x80000000
mov rcx, qword [rsi + 8]
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.14008ee30
Function at 0x14008e1d0
Capabilities:
Get geographical location

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov rsi, rcx
mov edi, edx
call fcn.140001179
cmp byte [rax], 0
je 0x14008e1ee
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
ret
call fcn.140001074
cmp byte [rax], 0
jne 0x14008e213
movzx ecx, byte [rsi + 0x1b8]
test ecx, ecx
jne 0x14008e213
mov rcx, rsi
mov edx, edi
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.14008e810
mov edx, edi
cmp byte [rsi + 0x1b8], 0
jne 0x14008e224
or edx, 0x80000000
mov rcx, qword [rsi + 8]
add rsp, 0x28
pop rsi
pop rdi
jmp fcn.14008ee30

Function at 0x14008ed60
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x50], rax
mov rax, qword [0x1402177e8]
mov qword [rbp + 0x48], rax
test dword [rsp], esp
sub rsp, 0x430
lea rsi, [rsp + 0x20]
test rcx, rcx
je 0x14008eda0
add rcx, 0xc
jmp 0x14008eda2
xor ecx, ecx
mov qword [rbp + 0x50], rcx
mov qword [rbp + 0x38], rcx
mov dword [rbp + 0x44], edx
mov r8, rsi
mov qword [rbp + 0x30], r8
mov r9d, 0x212
mov dword [rbp + 0x40], r9d
lea rcx, [rbp + 8]
call fcn.1400027f0
mov rcx, qword [rbp + 0x38]
mov edx, dword [rbp + 0x44]
mov r8, qword [rbp + 0x30]
mov r9d, dword [rbp + 0x40]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov edi, eax
lea rcx, [rbp + 8]
call fcn.140002840
xor ecx, ecx
mov qword [rbp + 0x50], rcx
test edi, edi
jle 0x14008edfa
mov rcx, rsi
call fcn.140075140
jmp 0x14008edfc
xor eax, eax
lea rcx, [0x1402177e8]
mov rcx, qword [rcx]
cmp qword [rbp + 0x48], rcx
je 0x14008ee11
call fcn.140003bb0
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14008ee30
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
or edx, 0x20000000
xor r8d, r8d
mov dword [rbp - 0x40], r8d
test rcx, rcx
je 0x14008ee66
add rcx, 0xc
jmp 0x14008ee68
xor ecx, ecx
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x58], rcx
lea r8, [rbp - 0x40]
mov qword [rbp - 0x60], r8
mov dword [rbp - 0x4c], edx
mov r9d, 4
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.1400027f0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov edx, dword [rbp - 0x4c]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
lea rcx, [rbp - 0x88]
call fcn.140002840
xor eax, eax
mov qword [rbp - 0x48], rax
mov eax, dword [rbp - 0x40]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400903a0
Capabilities:
Get geographical location

Disassembly:
sub rsp, 0x28
call fcn.140001179
cmp byte [rax], 0
jne 0x1400903d4
xor ecx, ecx
mov edx, 0x5c
call fcn.14008ed60
test rax, rax
jne 0x1400903e8
lea rcx, [0x140206910]
mov edx, 0x5c
add rsp, 0x28
jmp fcn.14008ed60
call fcn.1400012e4
mov rcx, qword [rax + 0x18]
cmp dword [rcx], ecx
add rsp, 0x28
jmp fcn.14008fc00
add rsp, 0x28
ret
Function at 0x1400985c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r15
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm7
movsd xmm6, qword [case.0x140086aaf.88]
movaps xmm7, xmm6
call fcn.140098800
call fcn.140097c20
test eax, eax
jge 0x140098612
mov dword [0x140217950], 0xffff
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x68
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
pop r15
ret
call fcn.1400010e8
mov rcx, rax
movabs rdx, 0x431bde82d7b634db
mov rax, rdx
imul qword [rcx]
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x12
lea rsi, [rdx + rcx + 1]
xor edi, edi
mov ebx, 8
add ebx, ebx
lea rcx, [rsp + 0x38]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x38]
xor r14d, r14d
cmp dword [0x14021b760], 0
jne 0x1400987cb
test ebx, ebx
jle 0x140098673
call fcn.140097c20
inc r14d
cmp r14d, ebx
jl 0x140098666
lea rcx, [rsp + 0x30]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rcx, qword [rsp + 0x30]
sub rcx, rbp
mov rbp, rcx
cmp dword [0x14021b760], 0
jne 0x1400987d5
cmp rbp, rsi
jl 0x140098641
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, ebx
divsd xmm0, xmm1
ucomisd xmm7, xmm0
jp 0x1400986b5
je 0x1400986c3
ucomisd xmm7, xmm7
jp 0x1400986cd
ucomisd xmm0, xmm7
ja 0x1400986cd
jmp 0x1400986d0
movq rcx, xmm7
test rcx, rcx
jge 0x1400986c1
movaps xmm0, xmm7
movaps xmm7, xmm0
mov ecx, ebx
sar ecx, 0x1f
and ecx, 3
add ecx, ebx
mov ebx, ecx
sar ebx, 2
add ebx, ebx
lea rcx, [rsp + 0x28]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x28]
xor r15d, r15d
cmp dword [0x14021b760], 0
jne 0x1400987df
test ebx, ebx
jle 0x140098714
call fcn.140098800
inc r15d
cmp r15d, ebx
jl 0x140098707
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rax, qword [rsp + 0x20]
sub rax, rbp
mov rbp, rax
cmp dword [0x14021b760], 0
jne 0x1400987e9
cmp rbp, rsi
jl 0x1400986e2
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, ebx
divsd xmm0, xmm1
ucomisd xmm6, xmm0
jp 0x140098756
je 0x140098764
ucomisd xmm6, xmm6
jp 0x14009876e
ucomisd xmm0, xmm6
ja 0x14009876e
jmp 0x140098771
movq rax, xmm6
test rax, rax
jge 0x140098762
movaps xmm0, xmm6
movaps xmm6, xmm0
inc edi
cmp edi, 0xa
jl 0x14009863c
movaps xmm0, xmm7
mulsd xmm0, qword [0x1401d53f8]
divsd xmm0, xmm6
cvttsd2si eax, xmm0
cmp eax, 0x1388
jle 0x1400987a0
mov edx, 0x1388
jmp 0x1400987a2
mov edx, eax
mov dword [0x140217950], edx
xor eax, eax
cmp dword [0x140217950], 5
setle al
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x68
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
pop r15
ret
call fcn.140005590
jmp 0x140098662
call fcn.140005590
jmp 0x140098695
call fcn.140005590
jmp 0x140098703
call fcn.140005590
jmp 0x140098736
Function at 0x1400d2fc0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
sub rsp, 0x28
mov esi, ecx
cmp edx, 0xffffffff
jne 0x1400d2fd4
mov edi, 0xd5313557
jmp 0x1400d2ffb
mov ecx, edx
call fcn.1400d2ef0
mov rdx, rax
lea rcx, [0x14020fb38]
lea r8, [0x140211c88]
call fcn.140075500
mov rcx, rax
call fcn.1400d2e80
mov edi, eax
mov eax, edi
rol eax, 0xd
add eax, edi
mov edi, eax
xor edi, esi
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rsi
pop rdi
ret
Function at 0x6da90f70
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6dab25e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6da910f8
mov rax, qword [0x6dab25e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6da90fbc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6da91045
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6da90fa0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6da9112d
mov rax, qword [0x6dab25e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6dab25e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6da91110
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6da9103e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6da910a0
add dword [0x6dab25e4], 1
cmp edi, 8
jae 0x6da91073
test dil, 4
jne 0x6da910e4
test edi, edi
je 0x6da91068
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6da910ff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6da91068
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6da9108c
jmp 0x6da91068
add rsi, qword [0x6dab25e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6da9103e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6da91068
xor esi, esi
jmp 0x6da90fc7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6da91068
mov rax, qword [0x6dab25e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6da91880
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6dab28c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6dab28a0]
test rbx, rbx
je 0x6da918d4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6da918cb
test rsi, rsi
je 0x6da918cb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6da918b0
lea rcx, [0x6dab28c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6da91b10
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6da91b20
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6da91b30
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6da91b71
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6da91b68
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6da91b73
add rax, 0x28
cmp rax, r9
jne 0x6da91b54
xor eax, eax
ret

Function at 0x6da91c10
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6daaf1f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6da91c7d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6da91c7d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6da91c7d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6da91c74
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6da91c7f
add rax, 0x28
cmp rax, r9
jne 0x6da91c60
xor eax, eax
add rsp, 0x28
ret

Function at 0x6da91d80
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6daaf1f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6da91da0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6da91d98
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6da91dfd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6da91df4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6da91e04
add rax, 0x28
cmp rax, r9
jne 0x6da91de0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6da91e20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6daaf1f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6da91e8e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6da91e8e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6da91e8e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6da91e8e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6da91e85
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6da91e95
add rcx, 0x28
cmp rcx, rax
jne 0x6da91e70
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6da91ea8
jmp 0x6da91e8e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6da91eb6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6da91e8e
test r9d, r9d
jg 0x6da91ea0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6da921f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x180002d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x6bc
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x8af
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x183d
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x12c5
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
xor eax, 0x192e
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
add eax, 0x1d1
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
sub eax, 0xd2e
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x821
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x320b
cmp dword [rsp + 0x28], eax
je 0x180002e4f
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x9c]
sub eax, 0x962ff
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x24]
add eax, 0xb9b
mov dword [rsp + 0x24], eax
jmp 0x180002eee
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x20], eax
jmp 0x180002e6b
mov eax, dword [rsp + 0x20]
add eax, 2
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x20], eax
jge 0x180002eee
mov eax, dword [rsp + 0x38]
sub eax, 0x2d13
sub eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0x3c]
mov ecx, dword [rcx + 0x38]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x78]
and eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x48]
sub eax, 0x2d13
mov dword [rsp + 0x3c], eax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x180002e60
mov eax, dword [rsp + 0x2c]
sub eax, 0xfd8
add rsp, 0x68
ret
Function at 0x180004660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x98]
sub eax, 0x60
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xa0]
add eax, 0x573
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x70]
sub eax, 0x2d13
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
sub eax, 0xa78
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x749
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
xor eax, 0x9c1
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x1b76
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x88]
add eax, 0x27d
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x98]
xor eax, 0xdc5
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x24]
sub eax, 0xc20
cmp dword [rsp + 0x2c], eax
je 0x1800047f4
mov eax, dword [rsp + 0x24]
sub eax, 0xc34
cmp dword [rsp + 0x2c], eax
jge 0x180004743
mov rax, qword [rsp + 0x78]
lea rcx, [0x1800b0050]
mov qword [rax + 0x70], rcx
mov eax, dword [rsp + 0x20]
add eax, 0x12c5
mov dword [rsp + 0x20], eax
jmp 0x1800047f4
mov eax, dword [rsp + 0x30]
or eax, 0x1b16
mov rcx, qword [rsp + 0x78]
sub eax, dword [rcx + 0x2c]
cmp dword [rsp + 0x20], eax
jb 0x1800047f4
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
jmp 0x180004772
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0xa4]
add eax, dword [rsp + 0x34]
and eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jbe 0x1800047f4
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0xa4]
mov ecx, dword [rcx + 0x98]
xor ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x98]
mov ecx, dword [rsp + 0x38]
or ecx, eax
mov eax, ecx
sub eax, 0x26d3
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x180004768
mov eax, dword [rsp + 0x3c]
sub eax, 0x27d
add rsp, 0x68
ret
Function at 0x180008230
Capabilities:
Get file attributes
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x68]
add eax, 0xc9
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x78]
xor eax, 0x28d2
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x80]
add eax, 0xb40
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x7d3
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
add eax, 0x7ab
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x68]
add eax, 0x700
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x78]
sub eax, 0x700
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x68]
add eax, 0x7ab
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x509
cmp dword [rsp + 0x20], eax
jg 0x1800082d2
mov eax, dword [rsp + 0x20]
xor eax, 0x2d13
mov dword [rsp + 0x20], eax
jmp 0x180008324
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x1800082e6
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x34]
and eax, 0x19a5
mov rcx, qword [rsp + 0x70]
or eax, dword [rcx + 0x90]
cmp dword [rsp + 0x24], eax
jb 0x180008324
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x2c]
mov ecx, dword [rsp + 0x28]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1800082dc
mov eax, dword [rsp + 0x28]
sub eax, 0x7ab
add rsp, 0x58
ret