joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087e80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, r14
mov qword [rsp + 0x10], r14
xchg rbp, r14
xchg rsi, r11
mov qword [rsp + 0x20], r11
xchg rsi, r11
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
push rcx
mov qword [rsp], r14
push r15
nop
sub rsp, 0x74b8efc3
add rsp, 0x74b8efa3
mov r14d, r8d
mov dword [rsp - 0x28], edi
mov rdi, rdx
mov r9d, r14d
xchg r15, r13
mov r15, rcx
xchg r13, r15
cmp r8d, 0x40000
jb 0x140087f10
mov dword [rsp - 0x2c], ebx
mov r9d, 0x5b53b4e9
xor r9d, 0x295e181a
sub r9d, 0x44ef2c30
xor r9d, 0x2d1a80c3
nop
movabs rcx, 0xffffffff7b931522
sub rcx, 0x58cf8b61
xor rcx, 0xb017945
add rcx, 0x7fffffff
xor rcx, 0x563d0f7c
mov eax, 0x4b852df8
sub eax, 0x331e8e96
xor eax, 0x265defa
add eax, 0x5699ed75
sub eax, 0x709d2f09
mul r9
mov rbx, rbx
cmovo rax, rcx
mov rcx, rax
call fcn.1400984e0
xchg r13, r13
mov esi, dword [r13 + 0x18]
lea r15d, [r14 + 0xfffff]
shr r15d, 5
shr r15d, 0xe
shr r15d, 1
xor ebx, ebx
mov dword [rsp - 0x44], 0x1fb5990f
mov rbp, rax
mov r12b, 0x4c
add r12b, 0x25
xor r12b, 0x2f
sub r12b, 0x5d
test r15d, r15d
mov dword [rsp - 0x3c], 0x3997d2df
je 0x1400880b6
nop
mov r8d, ebx
mov r10d, r14d
mov rcx, rcx
shl r8d, 0xc
shl r8d, 8
xor eax, eax
xchg r11, r11
sub r10d, r8d
shr r8d, 2
cmp r10d, 0x100000
xchg rdi, rdi
jbe 0x140088020
mov r10d, 0x1a96f69a
add r10d, 0x1ba44164
sub r10d, 0x9d1e6ba
add r10d, 0x18cd47ec
sub r10d, 0x45269930
mov r11d, 0x3c5a7506
sub r11d, 0xf45cfbe
xor r11d, 0x2504b61f
xor r11d, 0x2eab581a
xor r11d, 0x26bf4b4d
jmp 0x140088037
mov r11d, r10d
xchg r13, r13
shr r11d, 2
test r11d, r11d
je 0x140088078
mov dword [rsp - 0x20], esp
xchg r9, r12
mov r12, rbp
xchg r12, r9
nop dword [rax]
mov dword [rsp - 0x1c], 0x685f1c61
lea edx, [r8 + rax]
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
lea r9, [r9 + 4]
mov r12, r12
xor ecx, 0x56362ae
inc eax
mov dword [r9 - 4], ecx
mov dword [rsp - 0x28], ebp
cmp eax, r11d
jb 0x14008804f
mov r8d, r10d
xchg r9, r9
mov rdx, rbp
xchg rsi, r13
mov rcx, rsi
xchg rsi, r13
call fcn.140084cc0
mov dword [rsp - 0x24], 0x574c0f07
test al, al
je 0x1400880b3
inc ebx
mov dword [rsp - 0x10], edi
cmp ebx, r15d
jb 0x140087faa
jmp 0x1400880b6
xor r12b, r12b
mov rcx, rbp
call fcn.1400984f0
mov r14, r14
mov rbx, qword [rsp + 0x50]
movzx eax, r12b
xchg rbp, rdi
mov rdi, qword [rsp + 0x58]
xchg rdi, rbp
mov rsi, qword [rsp + 0x68]
nop
sub rsp, 0x14fe5872
add rsp, 0x14fe5892
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x2c], 0x4471b25
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140088120
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg r8, rbx
xchg rbx, rbp
mov qword [rsp + 0x18], rbx
xchg rbx, rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
xchg r11, r11
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
push 0x4f2e76bc
mov qword [rsp], r15
mov eax, 0x578cf76
add eax, 0x574a6abb
sub eax, 0x1b6fd91e
sub eax, 0x415350f3
call fcn.14009a230
mov dword [rsp - 0xc], 0x6e496ba
sub rsp, rax
xchg r15, rcx
mov rcx, r15
xchg r15, rcx
call fcn.14009a0f0
mov dword [rsp - 0x10], 0x714c469b
mov ebp, eax
and ebp, 0x3fc
jbe 0x1400881e9
lea rdi, [rsp + 0x20]
mov rdi, rdi
mov esi, ebp
call fcn.14009a0f0
movzx ebx, ax
shl ebx, 0xc
shl ebx, 1
shl ebx, 1
shl ebx, 1
shl ebx, 1
call fcn.14009a0f0
movzx ecx, ax
xchg rdx, rdx
lea rdi, [rdi + 4]
or ecx, ebx
mov dword [rdi - 4], ecx
xchg rbx, rbx
sub rsi, 1
jne 0x1400881b5
lea r14d, [rbp*4]
mov dword [rsp - 0x2c], esi
mov eax, 0x372ceef1
sub eax, 0x2ec99818
add eax, 0x6e1db46
add eax, 0x47961006
xor eax, 0x56db4221
mov ecx, r14d
mul rcx
pushf
movabs rcx, 0xffffffff3b45a9d3
add rcx, 0x1ed85ad9
sub rcx, 0x405722b
add rcx, 0x7fffffff
add rcx, 0x29e76d7f
popf
cmovo rax, rcx
mov dword [rsp - 0x1c], ebp
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call fcn.1400984e0
mov rbp, rbp
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 0x14
xor ebx, ebx
mov dword [rsp - 0x24], esp
xchg rbp, rax
mov rsi, rbp
xchg rbp, rax
mov r12b, 0x61
add r12b, 0xf
add r12b, 0
sub r12b, 0x6f
test ebp, ebp
je 0x140088395
nop
mov rsp, rsp
mov r8d, ebx
mov r10d, r14d
shl r8d, 8
shl r8d, 4
shl r8d, 1
shl r8d, 5
shl r8d, 1
shl r8d, 1
xor eax, eax
sub r10d, r8d
mov r11, r11
shr r8d, 2
cmp r10d, 0x100000
jbe 0x140088302
mov r10d, 0x4d6acbf5
add r10d, 0x772cb67
xor r10d, 0x7569da07
add r10d, 0x582d04b8
sub r10d, 0x79d15213
mov r11d, 0x1df8c616
xor r11d, 0x36654b49
xor r11d, 0x2a789226
xor r11d, 0x1e11f79
jmp 0x140088315
mov r11d, r10d
shr r11d, 2
mov r9, r9
test r11d, r11d
je 0x140088353
xchg rsi, r9
mov rsi, r9
xchg r9, rsi
nop dword [rax]
lea edx, [r8 + rax]
mov ecx, edi
mov dword [rsp - 0x24], esp
xor ecx, dword [rsp + rdx*4 + 0x20]
lea r9, [r9 + 4]
xor ecx, 0x56362ae
mov r9, r9
inc eax
mov dword [r9 - 4], ecx
cmp eax, r11d
mov dword [rsp - 0x2c], ebx
jb 0x140088325
mov r8d, r10d
xchg r9, rsi
mov rdx, r9
xchg r9, rsi
xchg r15, r12
mov rcx, r12
xchg r15, r12
call fcn.140084cc0
test al, al
mov r8, r8
je 0x14008838a
inc ebx
cmp ebx, ebp
jb 0x14008828c
xchg r11, r11
jmp 0x140088395
xor r12b, r12b
mov dword [rsp - 0x14], 0x135c3c6c
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
call fcn.1400984f0
xchg rdi, rdi
lea r11, [rsp + 0x1020]
movzx eax, r12b
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
xchg r11, r11
mov rsp, r11
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
pop r12
mov r13, r13
nop
add rsp, 8
mov rdi, qword [rsp - 8]
pop rsi
xchg r12, r12
ret
Function at 0x14008bd70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, edx
xchg r8, r8
mov r8d, ecx
test ecx, ecx
jne 0x14008bd96
xor eax, eax
xchg r15, r15
xchg rbx, r11
mov r11, qword [rsp + 8]
xchg rbx, r11
ret
xor r10d, r10d
mov r11d, r8d
mov edx, r10d
xchg r11, r11
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
xchg r14, r14
lea eax, [r9 + r9]
mov ecx, edx
xor ecx, r9d
mov r10, r10
mov r9d, eax
test r11b, 1
cmove ecx, edx
xchg r10, r10
xor r9d, ebx
cmp eax, 0x100
mov edx, ecx
cmovb r9d, eax
xchg r14, r14
shr r11d, 1
jne 0x14008bdb6
mov r11d, r8d
mov r9d, r10d
mov dword [rsp - 0x10], ebx
test ecx, ecx
je 0x14008be3d
lea eax, [r11 + r11]
xchg r10, r10
mov ecx, r9d
xor ecx, r11d
mov r11d, eax
test dl, 1
mov dword [rsp - 0x44], 0x4e54d4fa
cmove ecx, r9d
xor r11d, ebx
cmp eax, 0x100
mov r9d, ecx
mov dword [rsp - 0x44], esi
cmovb r11d, eax
shr edx, 1
jne 0x14008bdfb
mov dword [rsp - 0x14], 0x124c472f
mov r11d, r9d
mov edx, r10d
test r9d, r9d
mov rbp, rbp
je 0x14008be99
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + r11]
mov r10, r10
mov ecx, edx
xor ecx, r11d
mov r11d, eax
xchg rsp, rsp
test r9b, 1
cmove ecx, edx
xor r11d, ebx
cmp eax, 0x100
mov dword [rsp - 0x1c], 0x1132d8a9
mov edx, ecx
cmovb r11d, eax
shr r9d, 1
jne 0x14008be5d
mov dword [rsp - 0x1c], esi
test edx, edx
je 0x14008bee2
nop word [rax + rax]
mov r12, r12
mov ecx, r10d
xor ecx, r8d
test dl, 1
cmove ecx, r10d
mov dword [rsp - 0x38], edi
mov r10d, ecx
lea ecx, [r8 + r8]
mov r8d, ecx
mov dword [rsp - 0x34], edx
xor r8d, ebx
cmp ecx, 0x100
cmovb r8d, ecx
shr edx, 1
mov dword [rsp - 0x2c], edx
jne 0x14008beaa
mov rbx, qword [rsp + 8]
mov eax, r10d
mov dword [rsp - 0xc], 0x124b4667
ret
Function at 0x140495d40
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov dword [rsp - 0x18], 0x3a827a28
mov eax, dword [0x1404a3094]
cmp qword [0x1404a30a8], 0
jne 0x140088ba0
xchg r12, r12
syscall
ret
jmp 0x1400896e7
Function at 0x180348058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1803481df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180348089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18034806f
add dl, dl
jne 0x180348096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1803480f6
xor eax, eax
add dl, dl
jne 0x1803480a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1803481ad
add dl, dl
jne 0x1803480b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1803480c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1803480d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1803480dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1803480ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18034807e
mov eax, 1
add dl, dl
jne 0x180348106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180348113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1803480fb
sub eax, ebx
mov ebx, 1
jne 0x18034814c
mov ecx, 1
add dl, dl
jne 0x18034812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18034813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180348123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18034807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180348168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180348175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18034815d
cmp eax, 0x7d00
jae 0x18034819b
cmp eax, 0x500
jb 0x180348196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18034807e
cmp eax, 0x7f
ja 0x18034819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18034807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1803481d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18034807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001258
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov r9d, 1
mov rbx, rcx
mov rdx, rcx
xor ecx, ecx
lea r8d, [r9 + 0x22]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dil, 0x1f
mov dword [rbp - 0xf], 0x7c7e5c43
mov cl, dil
mov dword [rbp - 0xb], 0x7e5b7a77
mov byte [rbp - 0x10], cl
xor eax, eax
mov dword [rbp - 7], 0x437e6b
xor byte [rbp + rax - 0xf], cl
inc rax
cmp rax, 0xb
jae 0x1800012b4
mov cl, byte [rbp - 0x10]
jmp 0x1800012a2
lea rdx, [rbp - 0xf]
mov byte [rbp - 4], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rcx, rbx
call fcn.180001208
test eax, eax
jne 0x1800012dc
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [rbp + 0x18], 0x6b7e7b1f
xor eax, eax
mov word [rbp + 0x1c], 0x7e
xor byte [rbp + rax + 0x19], dil
inc rax
cmp rax, 4
jae 0x1800012ff
mov dil, byte [rbp + 0x18]
jmp 0x1800012eb
lea rdx, [rbp + 0x19]
mov byte [rbp + 0x1d], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x180001320
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov r9d, 1
mov rdi, rcx
mov rdx, rcx
xor ecx, ecx
lea r8d, [r9 + 0x22]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
mov dword [rbp - 0x10], 0x7e5c431f
mov bl, 0x1f
mov byte [rbp - 4], al
mov dl, bl
mov dword [rbp - 0xc], 0x5b7a777c
mov dword [rbp - 8], 0x437e6b7e
xor byte [rbp + rax - 0xf], dl
inc rax
cmp rax, 0xb
jae 0x18000137a
mov dl, byte [rbp - 0x10]
jmp 0x180001368
lea rdx, [rbp - 0xf]
mov byte [rbp - 4], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
mov dword [rbp + 0x18], 0x6574731f
mov byte [rbp + 0x1c], al
xor byte [rbp + rax + 0x19], bl
inc rax
cmp rax, 3
jae 0x1800013a9
mov bl, byte [rbp + 0x18]
jmp 0x180001397
lea rdx, [rbp + 0x19]
mov byte [rbp + 0x1c], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret

Function at 0x1800013cc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
movsxd r14, edx
mov ecx, r8d
mov ebp, r8d
call fcn.180010bcc
mov rdi, r14
test r14d, r14d
jle 0x18000141c
mov rsi, rbx
call fcn.180010ba0
cdq
idiv r14d
inc dl
xor dl, byte [rsi]
xor dl, bpl
mov byte [rsi], dl
inc rsi
sub rdi, 1
jne 0x180001401
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18000143c
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x50
mov rax, qword [0x18002e008]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea r9, [r11 - 0x18]
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [r11 - 0x28], rbx
xor edx, edx
mov qword [r11 - 0x30], rbx
mov qword [r11 - 0x38], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x18000147f
mov ebx, dword [rsp + 0x40]
xor ebx, 6
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180008180
add rsp, 0x50
pop rbx
ret

Function at 0x180001494
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x458
mov rax, qword [0x18002e008]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
movzx r8d, word [rsp + 0x20]
lea rdx, str._c:_
lea rcx, [rsp + 0x230]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x230]
call fcn.18000143c
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.180008180
add rsp, 0x458
ret

Function at 0x180001500
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x18002e008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, rdx
mov r15, r8
mov rdx, rcx
lea r8, [0x18002a654]
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
call fcn.180010ca0
test eax, eax
jne 0x1800015a0
mov rcx, qword [rsp + 0x20]
lea r8d, [rbx + 2]
xor edx, edx
call fcn.180010f68
mov rcx, qword [rsp + 0x20]
call fcn.180011524
mov rcx, qword [rsp + 0x20]
xor r8d, r8d
xor edx, edx
movsxd rsi, eax
call fcn.180010f68
test esi, esi
jle 0x180001596
mov rcx, rsi
call fcn.180008210
mov r9, qword [rsp + 0x20]
lea edx, [rbx + 1]
mov r8, rsi
mov rcx, rax
mov rdi, rax
call fcn.18001181c
mov qword [r14], rdi
mov bl, 1
mov dword [r15], esi
mov rcx, qword [rsp + 0x20]
call fcn.180011a08
mov al, bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180008180
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180001880
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0xa8]
sub rsp, 0x190
mov rax, qword [0x18002e008]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x70]
call fcn.18000a550
lea rcx, [rsp + 0x70]
call fcn.180001258
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x70]
call fcn.180001500
test al, al
je 0x180001a14
call fcn.180001494
mov esi, eax
mov rdi, qword [rsp + 0x28]
test eax, eax
je 0x180001942
mov ecx, eax
call fcn.180010bcc
movsxd r14, dword [rsp + 0x20]
test r14, r14
jle 0x180001942
mov r15, rdi
call fcn.180010ba0
cdq
idiv dword [rsp + 0x20]
inc dl
mov al, sil
xor al, byte [r15]
xor al, dl
mov byte [r15], al
inc r15
sub r14, 1
jne 0x180001922
xor eax, eax
mov qword [rsp + 0x60], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
and qword [rsp + 0x60], rax
and qword [rsp + 0x30], rax
and qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], al
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x180001972
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.18000742c
nop
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180001630
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1800019d7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800019d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180001a69
call fcn.1800081a0
mov rcx, rdi
call fcn.1800081a0
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
sub rcx, rdx
sar rcx, 5
test rcx, rcx
je 0x180001a0a
mov rcx, rbx
call fcn.180007348
nop
lea rcx, [rsp + 0x50]
call fcn.1800071e0
jmp 0x180001a3a
lea rcx, [rsp + 0x50]
call fcn.1800071e0
and qword [rbx], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
xor r8d, r8d
lea rdx, [0x18002a640]
mov rcx, rbx
call fcn.18000742c
mov rax, rbx
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.180008180
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180010a98
nop
int3
Function at 0x180011340
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1800209f0
sub rsp, rax
mov rax, qword [0x18002e008]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180015288
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18001138f
mov rax, rbp
jmp 0x180011497
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x2f660]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.180016324
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x2f660]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180011493
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180011493
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.180016324
test rax, rax
js 0x180011493
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180011493
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180011485
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180011485
cmp byte [rcx], 0xd
jne 0x18001146b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x18001147a
cmp byte [rcx + 1], 0xa
jne 0x18001147a
inc rcx
jmp 0x18001147a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x2e320]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x18001144d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180011497
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180008180
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800163d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x18002f660]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x180016427
cmp word [rdx], r13w
jne 0x180016427
or byte [rax + rdi*8 + 0x38], cl
jmp 0x18001642c
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x180016551
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x180016572
lea r9, [rdx + 2]
cmp cx, r11w
je 0x180016465
mov rdx, r9
mov word [rbx], cx
jmp 0x18001648c
cmp r9, r8
jae 0x18001649c
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x180016446
jmp 0x180016551
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180016546
cmp dword [rsp + 0x80], esi
je 0x180016546
lea r8, [0x18002f660]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x18001651e
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1800164ee
mov word [rbx], r13w
jmp 0x18001654e
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1800164fb
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x18001654e
cmp word [rsp + 0x70], r13w
jne 0x18001652b
cmp rbx, r14
je 0x1800164e8
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.18001632c
cmp word [rsp + 0x70], r13w
je 0x180016551
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x18002f660]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x18001654b
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x180016551
Function at 0x180017f94
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180017faa
mov al, 1
jmp 0x18001800a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180017fbb
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x180018008
mov ecx, dword [rcx + 0x18]
nop
call fcn.18001a9e0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180018008
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180018008
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180018008
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x18001800a
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180019d44
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180019d74
xor eax, eax
jmp 0x180019e37
mov rbp, rbx
cmp word [rax], si
je 0x180019d99
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180019d80
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180019d7c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180019c64
movsxd r14, eax
test eax, eax
jne 0x180019dd7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180019d6d
mov rcx, r14
call fcn.180013d04
mov rdi, rax
test rax, rax
jne 0x180019df0
xor ecx, ecx
call fcn.180013178
jmp 0x180019dcc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180019c64
test eax, eax
jne 0x180019e21
mov rcx, rdi
call fcn.180013178
jmp 0x180019e2b
xor ecx, ecx
call fcn.180013178
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret