joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fda04
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rdi, r8
mov r14, rdx
mov rsi, rcx
mov rax, qword [0x14015bf30]
test rax, rax
je 0x1400fda39
cmp byte [0x14015bf38], 0
jne 0x1400fdbee
mov eax, 0x24
mov dword [rbp - 0x41], eax
movdqa xmm0, xmmword [0x140153050]
movdqu xmmword [rbp - 0x3d], xmm0
movdqa xmm1, xmmword [0x140152cd0]
movdqu xmmword [rbp - 0x2d], xmm1
mov dword [rbp - 0x1d], 0x66686f71
mov byte [rbp - 0x19], 9
xor ecx, ecx
mov word [rbp - 0x18], cx
mov byte [rbp - 0x16], cl
xor edx, edx
test eax, eax
je 0x1400fda85
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x3d], al
inc edx
mov eax, dword [rbp - 0x41]
cmp edx, eax
jb 0x1400fda75
mov byte [rbp + rax - 0x3d], cl
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x3d]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], cl
jne 0x1400fdaa3
lea rdx, [rbp - 0x3d]
lea rcx, [rbp + 0xf]
call fcn.140045210
nop
mov eax, 0xe
mov dword [rbp - 0x59], eax
movdqa xmm0, xmmword [0x1401525b0]
movdqu xmmword [rbp - 0x55], xmm0
xor edx, edx
test eax, eax
je 0x1400fdae5
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x55], al
inc edx
mov eax, dword [rbp - 0x59]
cmp edx, eax
jb 0x1400fdad5
mov byte [rbp + rax - 0x55], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
lea rax, [rbp - 0x55]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400fdafd
mov r8, rbx
lea rdx, [rbp - 0x55]
lea rcx, [rbp - 0x11]
call fcn.140045210
nop
lea rcx, [rbp - 0x11]
call fcn.1400fb5f8
mov rdx, rax
lea r8, [rbp + 0xf]
mov rcx, rsi
call fcn.1400fd4f0
mov rbx, rax
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x1400fdb70
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fdb6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fdb6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
movdqa xmm0, xmmword [0x1401524b0]
movdqu xmmword [rbp - 1], xmm0
mov byte [rbp - 0x11], 0
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x1400fdbbf
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fdbba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fdbba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
test rbx, rbx
je 0x1400fdc0a
mov qword [0x14015bf30], rbx
mov r9d, 0xc
mov r8, rbx
lea rdx, [0x14015bf38]
mov rcx, rsi
call fcn.1400fcf44
test al, al
je 0x1400fdc0a
mov rax, qword [0x14015bf30]
mov qword [r14], rax
movsd xmm0, qword [0x14015bf38]
movsd qword [rdi], xmm0
mov ecx, dword [0x14015bf40]
mov dword [rdi + 8], ecx
mov al, 1
jmp 0x1400fdc0c
xor al, al
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400ffc70
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ffcba
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ffcba
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ffcba
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ffcba
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ffcba
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400ffcbc
xor al, al
add rsp, 0x28
ret

Function at 0x1400fffec
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140100026
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14010002b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140100074
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140103a50]
cmp byte [rcx + rax], 0
je 0x140100074
dec r8
sub rdx, 1
jne 0x14010005a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x180001420
Capabilities:
Enumerate files on windows

Disassembly:
push rsi
sub rsp, 0x180
mov rax, qword [0x180025008]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov eax, dword [0x180025a88]
lea r9, [0x180026d20]
mov dword [rsp + 0x28], eax
lea r8, str.C:_vm3dum_log_vm3dum_s__d__d.log
mov eax, dword [0x180026cf0]
lea rcx, [0x180026d40]
mov edx, 0x80
mov dword [rsp + 0x20], eax
call fcn.180001850
mov r8d, 0x20
lea rdx, [0x180019494]
lea rcx, [0x180026d40]
call fcn.180004580
mov rsi, rax
test rax, rax
je 0x18000152f
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x198], rdi
lea rcx, str.C:_vm3dum_log_vm3dum.log
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180001513
mov qword [rsp + 0x190], rbx
lea rdx, [rsp + 0x30]
mov rcx, rax
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1800014f1
inc ebx
cmp ebx, 0x200
ja 0x1800014f1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800014d5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0x200
mov rbx, qword [rsp + 0x190]
ja 0x180001513
mov qword [0x180025a80], rsi
jmp 0x180001527
mov rcx, rsi
call fcn.1800040e0
lea rcx, [0x180026d40]
call fcn.18000479c
mov rdi, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1800021b0
add rsp, 0x180
pop rsi
ret

Function at 0x180001650
Capabilities:
Enumerate files on windows

Disassembly:
movups xmm0, xmmword [rcx]
movups xmmword [0x180026cc0], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [0x180026cd0], xmm1
movups xmm0, xmmword [rcx + 0x20]
mov ecx, dword [0x180026cb0]
movups xmmword [0x180026ce0], xmm0
test ecx, ecx
je 0x1800016e8
sub ecx, 1
je 0x1800016d4
sub ecx, 1
je 0x1800016c0
sub ecx, 1
je 0x1800016ac
cmp ecx, 1
je 0x180001698
xor eax, eax
mov dword [0x180026cac], eax
jmp 0x1800016fa
mov eax, dword [0x180026cd0]
mov dword [0x180026cac], eax
mov eax, dword [0x180026ce8]
jmp 0x1800016fa
mov eax, dword [0x180026ccc]
mov dword [0x180026cac], eax
mov eax, dword [0x180026ce4]
jmp 0x1800016fa
mov eax, dword [0x180026cc8]
mov dword [0x180026cac], eax
mov eax, dword [0x180026ce0]
jmp 0x1800016fa
mov eax, dword [0x180026cc4]
mov dword [0x180026cac], eax
mov eax, dword [0x180026cdc]
jmp 0x1800016fa
mov eax, dword [0x180026cc0]
mov dword [0x180026cac], eax
mov eax, dword [0x180026cd8]
cmp byte [0x180026cec], 0
mov dword [0x180026ca8], eax
je 0x180001717
cmp qword [0x180025a80], 0
je fcn.180001420
ret

Function at 0x18000c01c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000c03c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180009cd0
or eax, 0xffffffff
jmp 0x18000c03e
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800014c0
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x1a8
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x68], 1
mov byte [rsp + 4], 1
lea rax, [rsp + 0xc0]
lea rcx, str.nDAXfZWKb
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x60], 9
mov byte [rsp + 5], 0x52
xor eax, eax
mov word [rsp + 0x18], ax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180001588
xor eax, eax
jmp 0x1800017f5
mov rax, qword [rsp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov eax, 6
mov word [rsp + 0x24], ax
mov qword [rsp + 0x80], 0
mov byte [rsp + 7], 1
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x64], 1
mov byte [rsp + 8], 0x70
mov rax, qword [rsp + 0x10]
cmp dword [rax], 0x4550
je 0x18000163c
xor eax, eax
jmp 0x1800017f5
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xa0], 0
lea rax, [rsp + 0xf0]
lea rcx, str.aTLDIGyoRSgHfWzvlEjFnUZpA
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1a
rep movsb byte [rdi], byte [rsi]
mov dword [rsp], 0
jmp 0x18000168d
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jge 0x1800017ad
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x1d0]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x1800016d0
inc rcx
test dl, dl
jne 0x1800016bd
xor eax, eax
jmp 0x1800016d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1800017a8
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x1c8]
mov rdx, qword [rsp + 0x40]
mov eax, dword [rdx + rax + 8]
mov dword [rcx], eax
mov byte [rsp + 0xb], 0x75
mov eax, 7
mov word [rsp + 0x2c], ax
mov eax, 7
mov word [rsp + 0x30], ax
mov dword [rsp + 0x54], 5
mov byte [rsp + 0xc], 1
mov qword [rsp + 0xa8], 0
lea rax, [rsp + 0xd0]
lea rcx, str.jkNrnILVJ
mov rdi, rax
mov rsi, rcx
mov ecx, 0xa
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x1c0]
add rcx, rax
mov rax, rcx
jmp 0x1800017f5
jmp 0x180001685
xor eax, eax
jmp 0x1800017f5
add rsp, 0x1a8
pop rdi
pop rsi
ret
Function at 0x180004b70
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x518
mov rax, qword [0x18001a040]
xor rax, rsp
mov qword [rsp + 0x500], rax
mov dword [rsp + 0x3c], 0
lea rcx, [rsp + 0xe0]
call fcn.18000c750
nop
mov byte [rsp + 0x30], 0x58
mov qword [rsp + 0x90], 5
mov qword [rsp + 0x98], 0
mov byte [rsp + 0x31], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.HTTPGET
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x528]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x180004c41
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov byte [rsp + 0x32], 1
mov eax, 7
mov word [rsp + 0x48], ax
mov dword [rsp + 0x78], 2
mov eax, 3
mov word [rsp + 0x4c], ax
mov qword [rsp + 0xa0], 1
lea r9, [rsp + 0xd8]
mov r8d, 0x400
lea rdx, [rsp + 0x100]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x180004cf0
cmp dword [rsp + 0xd8], 0
jbe 0x180004cf0
mov eax, dword [rsp + 0xd8]
mov r8d, eax
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0xe0]
call fcn.18000c4e0
mov eax, 5
mov word [rsp + 0x50], ax
mov byte [rsp + 0x33], 1
mov qword [rsp + 0xa8], 0
mov byte [rsp + 0x34], 0x52
mov qword [rsp + 0xb0], 8
mov dword [rsp + 0x70], 1
mov eax, 3
mov word [rsp + 0x54], ax
jmp 0x180004c5f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 3
mov word [rsp + 0x58], ax
mov eax, 4
mov word [rsp + 0x5c], ax
mov dword [rsp + 0x74], 3
mov byte [rsp + 0x35], 1
mov byte [rsp + 0x36], 0x58
mov edx, 0x18
mov rcx, qword [rsp + 0x520]
call fcn.180004a30
lea rcx, [rsp + 0x37]
call fcn.180007a10
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xe0]
call fcn.18000c420
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xe0]
call fcn.18000c480
mov rcx, qword [rsp + 0x80]
mov r9, rcx
mov rcx, qword [rsp + 0x88]
mov r8, qword [rcx]
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x520]
call fcn.18000da80
mov qword [rsp + 0xc8], rax
mov eax, dword [rsp + 0x3c]
or eax, 1
mov dword [rsp + 0x3c], eax
lea rcx, [rsp + 0xe0]
call fcn.18000c660
mov rax, qword [rsp + 0x520]
jmp 0x180004ded
mov rcx, qword [rsp + 0x500]
xor rcx, rsp
call fcn.18000f810
add rsp, 0x518
ret
Function at 0x180005dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rsi
push rdi
sub rsp, 0x48
mov byte [rsp + 2], 0x59
mov byte [rsp + 1], 0
jmp 0x180005dfb
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x180005ecf
mov byte [rsp], 0
jmp 0x180005e18
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x180005eca
movzx eax, byte [rsp + 1]
mov rcx, qword [rsp + 0x68]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 0x60]
shl edx, 2
movzx r8d, byte [rsp + 1]
shl r8d, 2
lea edx, [r8 + rdx*4]
movzx r8d, byte [rsp]
add edx, r8d
movsxd rdx, edx
mov r8, qword [rsp + 0x70]
movzx edx, byte [r8 + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 1]
mov r8, qword [rsp + 0x68]
lea rdx, [r8 + rdx*4]
mov byte [rdx + rcx], al
lea rax, [rsp + 0x20]
lea rcx, str.iNsyuKBjTfOcHFbpmSDQvUxIEgWnX
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1e
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x10], 3
mov qword [rsp + 0x18], 0
mov byte [rsp + 3], 1
mov byte [rsp + 4], 0x6b
mov eax, 9
mov word [rsp + 8], ax
mov eax, 1
mov word [rsp + 0xc], ax
jmp 0x180005e0f
jmp 0x180005df0
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x180005ee0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov eax, 8
mov word [rsp + 4], ax
mov byte [rsp + 2], 1
lea rax, [rsp + 0x28]
lea rcx, str.dXwVjtMDQsCBZInKoiglrSEFYzfLUkcGRJp
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x10], 0
mov dword [rsp + 0xc], 1
mov qword [rsp + 0x18], 7
mov byte [rsp + 1], 0
jmp 0x180005f3f
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x180005fc0
mov byte [rsp], 0
jmp 0x180005f58
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x180005fbb
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0x70]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, [0x180015d30]
movzx edx, byte [rsp]
mov rdi, qword [rsp + 0x70]
lea rdx, [rdi + rdx*4]
movzx edi, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + rdi], al
lea rax, [rsp + 8]
lea rcx, [0x18001399c]
mov rdi, rax
mov rsi, rcx
mov ecx, 3
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x20], 4
jmp 0x180005f4f
jmp 0x180005f34
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x180006c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
mov rax, qword [0x18001a040]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov eax, 7
mov word [rsp + 0x30], ax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0x10
jmp 0x180006c6a
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xe0]
cmp dword [rsp + 0x24], eax
jae 0x180006e36
lea rax, [rsp + 0x98]
mov rcx, qword [rsp + 0xd0]
mov rdi, rax
lea rsi, [rcx + 0xb0]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov eax, 6
mov word [rsp + 0x34], ax
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x58], 0
mov rax, qword [str.YbjeqUz]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x28], 0x41
mov qword [rsp + 0x68], 0
mov eax, 5
mov word [rsp + 0x38], ax
mov rax, qword [rsp + 0xd0]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1800069d0
mov dword [rsp + 0x20], 0xf
jmp 0x180006d07
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x180006dd5
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xd0]
movzx eax, byte [rcx + rax + 0xb0]
cmp eax, 0xff
jne 0x180006d65
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xd0]
mov byte [rcx + rax + 0xb0], 0
mov dword [rsp + 0x4c], 2
mov byte [rsp + 0x29], 1
mov eax, 8
mov word [rsp + 0x3c], ax
mov qword [rsp + 0x70], 0
jmp 0x180006cfd
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xd0]
movzx eax, byte [rcx + rax + 0xb0]
inc eax
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0xd0]
mov byte [rdx + rcx + 0xb0], al
jmp 0x180006dd5
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x50], 3
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0xd8]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 0x20]
movzx ecx, byte [rsp + rcx + 0x98]
xor eax, ecx
mov ecx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0xd8]
mov byte [rdx + rcx], al
mov byte [rsp + 0x2b], 0x4b
mov dword [rsp + 0x54], 0
mov qword [rsp + 0x80], 6
mov byte [rsp + 0x2c], 1
jmp 0x180006c56
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.18000f810
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x1800083a0
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
mov rax, qword gs:[0x60]
mov qword [rsp + 0x48], rax
mov eax, 5
mov word [rsp + 0x30], ax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov byte [rsp + 0x20], 0x5a
mov dword [rsp + 0x58], 4
mov qword [rsp + 0x70], 0
mov eax, 4
mov word [rsp + 0x34], ax
mov eax, 7
mov word [rsp + 0x38], ax
mov byte [rsp + 0x21], 1
cmp qword [rsp + 0xd0], 0
jne 0x180008419
xor eax, eax
jmp 0x1800084f2
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x28], rax
jmp 0x18000843a
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x18]
add rax, 0x20
cmp qword [rsp + 0x28], rax
je 0x1800084a4
mov rax, qword [rsp + 0x28]
sub rax, 0x10
mov qword [rsp + 0x50], rax
mov eax, 6
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x5c], 5
mov qword [rsp + 0x78], 0
mov byte [rsp + 0x22], 0x5a
mov rdx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rax + 0x50]
call fcn.18000f790
test rax, rax
je 0x1800084a2
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x30]
jmp 0x1800084f2
jmp 0x18000842d
xor eax, eax
jmp 0x1800084f2
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x18000b080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x18000b0b9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x18000b1a7
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x18000b14f
cmp qword [rsp + 0x20], 0
jle 0x18000b14f
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x18000b0f9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.18000d7d0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x18000b197
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x18000b197
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x18000b1b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x18001a040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x80], 0
jg 0x18000b1e4
xor eax, eax
jmp 0x18000b396
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x18000b20d
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x18000b396
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x18000b2ac
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.18000b3b0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.18000d7d0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x18000b386
mov rcx, qword [rsp + 0x70]
call fcn.18000cae0
mov qword [rsp + 0x38], 0xfff
cmp qword [rsp + 0x40], 0xfff
jbe 0x18000b34d
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x28], 0xfff
je 0x18000b34b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x18000b396
jmp 0x18000b2d2
cmp qword [rsp + 0x40], 0
jbe 0x18000b386
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18000f810
add rsp, 0x68
ret