joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001194
Capabilities:
Create directory

Disassembly:
mov eax, 0x3bf255f0
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x3c], 0x2fe6135
mov edx, dword [rsp + 0x3c]
cmp eax, edx
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x30], rcx
xor byte [rdx + 0x45], dh
jmp 0x14000120b
mov rax, qword [sym.imp.USER32.dll_GetDoubleClickTime]
call rax
nop
add rsp, 0x58
ret
mov eax, 0x4963226b
mov ecx, eax
mov eax, dword [rsp + 0x38]
add eax, 0x5008bf9e
invalid

Function at 0x1400011b4
Capabilities:
Create directory

Disassembly:
mov eax, 0x3bf255f0
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x3c], 0x2fe6135
mov edx, dword [rsp + 0x3c]
cmp eax, edx
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x30], rcx
xor byte [rdx + 0x45], dh
jmp 0x14000120b
mov rax, qword [sym.imp.USER32.dll_GetDoubleClickTime]
call rax
nop
add rsp, 0x58
ret
mov eax, 0x4963226b
mov ecx, eax
mov eax, dword [rsp + 0x38]
add eax, 0x5008bf9e
invalid

Function at 0x140001238
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]
and al, 0x40

Function at 0x140001240
Capabilities:
Create directory

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x65
call rax
lea rcx, str.:
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor edx, edx
call rax
mov rcx, qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x2c], eax
and al, 0x40
sub rdx, 0x67b8bbca
mov eax, dword [rsp + 0x38]
and eax, 0x4169a3e1
mov dword [rsp + 0x54], eax
mov r8, qword [rsp + 0x20]
cmp r8, rdx
cmp eax, edx
ja 0x1400011b9
invalid
push rax
invalid
invalid

Function at 0x140001280
Capabilities:
Terminate process

Disassembly:
jae 0x140001292
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffffe
call rax
ud2
add rsp, 0x28
ret

Function at 0x1400012a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
xor eax, eax
mov ecx, eax
lea rdx, [rsp + 0x80]
invalid
invalid
invalid

Function at 0x1400012f4
Capabilities:
Terminate process

Disassembly:
add byte [r8], r8b
xor eax, eax
mov esi, eax
mov qword [rsp + 0x70], rcx
mov rcx, rsi
mov qword [rsp + 0x68], r10

Function at 0x140001308
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r8
call r11
mov edi, 0x200
mov rcx, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x200
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x44], edi
call rax
lea rcx, [rsp + 0x7c]
mov rdx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
lea r9, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov qword [rsp + 0x30], rdx
mov rdx, r9
mov r9, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
call r9
call rcx
cmp eax, 0
je 0x1400013d7
jmp 0x1400013ae
mov eax, 0xc28d584
mov ecx, eax
mov rdx, qword [rsp + 0x68]
imul r8, rdx, 0x1b1eb659
mov r9, qword [rsp + 0x288]
sub r9, 0x496d631d
mov qword [rsp + 0x298], r8
cmp rcx, r9
jae 0x1400013c2
jmp 0x1400013c2
mov eax, dword [rsp + 0x2a4]
xor eax, 0x5610deef
cmp dword [rsp + 0x7c], eax
and al, 0x7c
je 0x14000137d
jmp 0x1400013cb
invalid
invalid
Function at 0x1400013d0
Capabilities:
Terminate process

Disassembly:
test al, 2
add byte [rax], al
pop rdi
pop rsi
ret

Function at 0x1400013e0
Capabilities:
Terminate process

Disassembly:
mov ecx, 0x58b483d
add byte [rax], r8b
Function at 0x180002d64
Capabilities:
Access peb ldr_data
Create thread
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
sub rsp, 0x150
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
call fcn.180001858
xor ebx, ebx
test al, al
je 0x180003054
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x180003918]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movabs rax, 0x10cec4c2d6899052
mov qword [rbp + 0x60], rax
movabs rax, 0xb3a8472c829f17c3
mov qword [rbp + 0x68], rax
movabs rcx, 0xb1780b79487a6d77
mov qword [rbp + 0x70], rcx
movabs rax, 0x8e940e9033bd8ca8
mov qword [rbp + 0x78], rax
movabs rdi, 0x75bdb783b3e4f115
mov qword [rbp + 0xc0], rdi
movabs rsi, 0xdfc42302fbf375ae
mov qword [rbp + 0xc8], rsi
mov qword [rbp + 0xd0], rcx
mov qword [rbp + 0xd8], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0x60], ymm1
lea rcx, [rbp + 0x60]
mov qword [rbp + 0x20], rcx
mov r11d, 0x811c9dc5
mov edx, r11d
vzeroupper
movsx eax, byte [rcx]
inc rcx
mov qword [rbp + 0x20], rcx
test al, al
jne 0x180002f95
mov dword [rbp], edx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x10]
mov rcx, r9
mov qword [rbp + 0x48], rcx
mov rdx, qword [rcx + 0x60]
movzx eax, word [rcx + 0x58]
shr rax, 1
lea r10, [rdx + rax*2]
mov r8d, r11d
mov qword [rbp + 0x28], rdx
cmp rdx, r10
je 0x180002e99
movsx eax, byte [rdx]
xor eax, r8d
imul r8d, eax, 0x1000193
add rdx, 2
jmp 0x180002e7d
cmp r8d, dword [rbp]
jne 0x180002ea5
mov rax, qword [rcx + 0x30]
jmp 0x180002eb4
mov rcx, qword [rcx]
cmp rcx, r9
jne 0x180002f8c
mov rax, rbx
mov qword [0x1803b10a8], rax
movabs rax, 0x14d1e7fac78d9f40
mov qword [rbp + 0x10], rax
movabs rax, 0xdfa84f66d58110d7
mov qword [rbp + 0x18], rax
mov qword [rbp + 0xa0], rdi
mov qword [rbp + 0xa8], rsi
movdqa xmm0, xmmword [rbp + 0x10]
pxor xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [rbp + 0x10]
mov qword [rbp + 0x30], rcx
mov edx, r11d
movsx eax, byte [rcx]
inc rcx
mov qword [rbp + 0x30], rcx
test al, al
jne 0x180002f7f
mov dword [rbp], edx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x10]
mov rcx, r9
mov qword [rbp + 0x40], rcx
mov rdx, qword [rcx + 0x60]
movzx eax, word [rcx + 0x58]
shr rax, 1
lea r10, [rdx + rax*2]
mov r8d, r11d
mov qword [rbp + 0x38], rdx
cmp rdx, r10
je 0x180002f59
movsx eax, byte [rdx]
xor eax, r8d
imul r8d, eax, 0x1000193
add rdx, 2
jmp 0x180002f3d
cmp r8d, dword [rbp]
jne 0x180002f65
mov rbx, qword [rcx + 0x30]
jmp 0x180002f6d
mov rcx, qword [rcx]
cmp rcx, r9
jne 0x180002f79
mov qword [0x1803b10a0], rbx
jmp 0x180003052
mov qword [rbp + 0x40], rcx
jmp 0x180002f2b
xor eax, edx
imul edx, eax, 0x1000193
jmp 0x180002f02
mov qword [rbp + 0x48], rcx
jmp 0x180002e6b
xor eax, edx
imul edx, eax, 0x1000193
jmp 0x180002e3e
mov al, 1
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800302c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rcx]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 4
jb 0x1800302cd
mov rax, rdx
ret

Function at 0x180037ba4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
cmp byte [rcx + 0x2c], sil
je 0x180037cd4
call sub.MSVCP140.dll__Xtime_get_ticks
mov rdx, rax
movabs rax, 0x346dc5d63886594b
imul rdx
mov rbx, rdx
sar rbx, 0xb
mov rax, rbx
shr rax, 0x3f
add rbx, rax
movsxd rax, dword [0x18037fc6c]
add rax, qword [0x1803ae100]
cmp rbx, rax
je 0x180037cd4
jl 0x180037cd4
lea ecx, [rsi + 0x57]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180037caf
lea ecx, [rsi + 0x26]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180037caf
lea ecx, [rsi + 0x41]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180037c9b
lea ecx, [rsi + 0x25]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180037c9b
lea ecx, [rsi + 0x53]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180037c8c
lea ecx, [rsi + 0x28]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180037c8c
lea ecx, [rsi + 0x44]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180037c7d
lea ecx, [rsi + 0x27]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180037cc1
movss xmm0, dword [rdi + 0x24]
addss xmm0, dword [0x180159598]
jmp 0x180037ca8
movss xmm0, dword [rdi + 0x28]
addss xmm0, dword [0x180159598]
jmp 0x180037cbc
movss xmm0, dword [rdi + 0x24]
subss xmm0, dword [0x180159598]
movss dword [rdi + 0x24], xmm0
jmp 0x180037cc1
movss xmm0, dword [rdi + 0x28]
subss xmm0, dword [0x180159598]
movss dword [rdi + 0x28], xmm0
mov rcx, rdi
call fcn.180040948
mov qword [rdi + 0x24], rsi
mov qword [0x1803ae100], rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180042874
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800428d0
cmp byte [rcx + 0x71], 0
je 0x1800428d0
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180042918
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800428dd
sub eax, 1
je 0x1800428e1
cmp eax, 2
jne 0x180042918
mov byte [rbx + 0x71], 0
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x18004290f
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180042918
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1800428d2
xor al, al
jmp 0x1800428d2
Function at 0x180050f3c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x180050f64
xor eax, eax
jmp 0x18005107c
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180050f92
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jae 0x180050f92
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x18005107c
cmp qword [rbx + 0x80], 0
je 0x18005107a
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180050fcd
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180050ff1
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
cmovne edi, esi
jmp 0x18005107a
lea rax, [rbp + 0x30]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18005103f
sub eax, 1
je 0x18005103f
cmp eax, 2
jne 0x18005107a
movsx ecx, byte [rbp - 0x30]
jmp 0x180050fda
mov r14, qword [rbp + 0x30]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x18005106a
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x18005107a
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp + 0x38], rax
mov eax, esi
jne 0x18005107c
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180064be8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180064c15
xor eax, eax
jmp 0x180064d04
cmp qword [rcx + 0x68], 0
je 0x180064c27
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x180064d04
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x180064c3e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180064c40
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180064c6d
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rsi
add r14, rbx
sub rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rsi + 0x80], 0
mov rbx, rbp
je 0x180064cfe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180064cab
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
jmp 0x180064cd9
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x180064d1d
cmp rbp, r15
ja 0x180064cb3
test rbx, rbx
je 0x180064cfe
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rdi, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
sub rdi, rbp
jmp 0x180064d01
Function at 0x180064d24
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180064d55
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x180064dc8
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x180064d6c
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180064d6e
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180064dc2
test ecx, ecx
jle 0x180064da2
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
add r14, rbp
test rbx, rbx
jle 0x180064dc2
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180064dc2
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18006dfdc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x18006e003
and qword [r8], 0
call fcn.18006e0e8
mov rbx, rax
test rax, rax
je 0x18006e0cb
mov rcx, rax
call fcn.18006df64
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18006e0c2
mov rax, qword [0x1803ae470]
test rax, rax
je 0x18006e03b
inc dword [rax + 0xf4]
mov rdx, qword [0x1803ae480]
lea rcx, [rdi + rbp]
call qword [0x18037fed8]
mov rsi, rax
test rax, rax
je 0x18006e0c2
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x18006e09a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1803ae470]
test rax, rax
je 0x18006e088
dec dword [rax + 0xf4]
mov rdx, qword [0x1803ae480]
mov rcx, rsi
call qword [0x18037fee0]
jmp 0x18006e0cb
test ebp, ebp
jle 0x18006e0ac
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18006e0bd
mov qword [r14], rdi
mov rax, rsi
jmp 0x18006e0cd
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x18006e430
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x18006e45e
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1801598f0]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x18006e43b
not r8d
mov eax, r8d
ret

Function at 0x18006e468
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18006e4c2
mov r11b, 0x23
lea rdi, [0x1801598f0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x18006e4ac
cmp rdx, 2
jb 0x18006e4ac
cmp byte [r10], r11b
jne 0x18006e4ac
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x18006e48a
jmp 0x18006e503
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18006e503
mov r11b, 0x23
lea rdi, [0x1801598f0]
cmp dl, r11b
jne 0x18006e4e7
cmp byte [r10], r11b
jne 0x18006e4e7
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x18006e4d5
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x180070260
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c88], 0
lea rbx, [rcx + 0x5c90]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1800702f9
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x1800702b1
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18007c110
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.18007bb50
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c88]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x1803ae478]
movsxd r8, eax
mov rax, qword [rdi + 0x5c98]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180070301
mov rcx, rbx
call fcn.18007bb50
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180077830
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1803ae470]
mov rbx, rcx
and dword [rax + 0x5bec], 0
test rcx, rcx
je 0x180077899
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.1800778a4
lea rdx, [0x18015b254]
mov rcx, rbx
mov rdi, rax
call fcn.18006e0e8
mov rbx, rax
test rax, rax
je 0x180077899
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800a931c
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x1800a9366
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x1803b20e0]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x1800a93a3
cmp rbx, rsi
jb 0x1800a939e
cmp rbx, r15
jae 0x1800a939e
cmp qword [rbx + 8], 0
jne 0x1800a94ff
mov rbx, qword [rbx]
jmp 0x1800a9384
mov r14, rdi
cmp rdi, rsi
jb 0x1800a9427
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, r14
div r12
sub r14, rdx
sub r14, r12
cmp r14, rsi
jb 0x1800a941e
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800a941e
cmp dword [rbp - 0x10], 0x10000
je 0x1800a93ee
mov r14, qword [rbp - 0x28]
cmp r14, r12
jb 0x1800a941e
jmp 0x1800a93ba
test r14, r14
je 0x1800a941e
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800a94bf
cmp r14, rsi
jae 0x1800a93ab
test rbx, rbx
jne 0x1800a94bf
cmp rdi, r15
ja 0x1800a94ff
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800a94ff
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800a94ff
cmp dword [rbp - 0x10], 0x10000
je 0x1800a9495
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jmp 0x1800a944e
test rdi, rdi
je 0x1800a94ff
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x1800a9421
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x1800a94d2
mov rax, qword [0x1803b20e0]
mov qword [rbx], rax
mov qword [0x1803b20e0], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800a9e1c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x40]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1803b20d0]
mov r8, qword [rbx]
mov al, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rbp, [r8 - 5]
cmove rbp, r8
lea rdi, [r8 - 5]
test al, al
lea r14, [rcx*2 + 5]
cmove rdi, r8
mov rdx, r14
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800a9e87
mov eax, 0xa
jmp 0x1800a9f13
test esi, esi
je 0x1800a9ea9
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800a9eca
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800a9eca
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800a9ec4
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800a9eca
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret