joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180014d80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x180014ea0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x180014de0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x180014de0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x180014de0
Function at 0x1800909a0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
lea rcx, [0x18046fd20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800909d1
lea rcx, [0x18046fd30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x180090ae2
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov ecx, eax
call fcn.180212b48
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180090ad4
mov r9, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x180090ad4
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x28]
lea rdx, [0x18046f65c]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x180090ad4
cmp qword [rsp + 0x28], 0
je 0x180090ad4
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0xc]
mov dword [rcx + rax], edx
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 8]
mov dword [rcx + rax], edx
mov rcx, qword [rsp + 0x30]
call fcn.180211bf4
mov al, 1
jmp 0x180090ae4
xor al, al
add rsp, 0x160
pop rdi
ret
Function at 0x180090af0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
lea rcx, [0x18046fd40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x180090b21
lea rcx, str.version.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov byte [rsp + 0x50], 0
lea rax, [rsp + 0x51]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x180090c29
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov ecx, eax
call fcn.180212b48
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x180090c1b
mov r9, qword [rsp + 0x30]
mov r8d, dword [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x180090c1b
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x28]
lea rdx, [0x18046f71c]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.VERSION.dll_VerQueryValueA]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x180090c1b
cmp qword [rsp + 0x28], 0
je 0x180090c1b
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 0xc]
mov dword [rcx + rax], edx
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x28]
mov edx, dword [rdx + 8]
mov dword [rcx + rax], edx
mov rcx, qword [rsp + 0x30]
call fcn.180211bf4
mov al, 1
jmp 0x180090c2b
xor al, al
add rsp, 0x160
pop rdi
ret

Function at 0x180090c40
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x278
mov edx, dword [rsp + 0x280]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x180090cd5
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x180090cc3
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x288], rax
jne 0x180090caf
mov rax, qword [rsp + 0x290]
mov ecx, dword [rsp + 0x3c]
mov dword [rax], ecx
jmp 0x180090cc3
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x180090c90
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180090cd7
xor eax, eax
add rsp, 0x278
ret
Function at 0x180091ee0
Capabilities:
Accept command line arguments
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov qword [rsp + 0xa0], 0xfffffffffffffffe
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov rcx, qword [rsp + 0xc0]
mov qword [rcx + 0x20], rax
cmp qword [rsp + 0xc8], 0
je 0x180091f58
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx]
mov qword [rax + 0x28], rcx
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx + 8]
mov qword [rax + 0x30], rcx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0xc0]
lea r8, [0x180091ce0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, qword [rsp + 0xc0]
mov qword [rcx + 0x38], rax
mov rax, qword [rsp + 0xc0]
cmp qword [rax + 0x38], 0
je 0x180092160
cmp qword [rsp + 0xc8], 0
je 0x18009209a
mov ecx, Ordinal_211
call fcn.1800b7518
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0xc0], 0
je 0x180091fef
mov rax, qword [rsp + 0xc0]
add rax, 0x18
mov qword [rsp + 0x30], rax
jmp 0x180091ff8
mov qword [rsp + 0x30], 0
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x80]
call fcn.180093020
mov qword [rsp + 0x38], rax
jmp 0x18009201a
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x88], rax
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x60]
call fcn.180092550
nop
lea rcx, [rsp + 0x60]
call fcn.180080b20
cmp dword [rax + 0x10], 0
je 0x18009208b
lea rcx, [rsp + 0x60]
call fcn.180080b20
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rax, qword [rax]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
call qword [rax]
test eax, eax
je 0x18009208b
mov rax, qword [rsp + 0xc0]
add rax, 0x40
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.180092420
nop
lea rcx, [rsp + 0x60]
call fcn.1800767d0
jmp 0x180092160
mov ecx, 0x1c0
call fcn.1800b7518
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0xc0], 0
je 0x1800920ca
mov rax, qword [rsp + 0xc0]
add rax, 0x18
mov qword [rsp + 0x48], rax
jmp 0x1800920d3
mov qword [rsp + 0x48], 0
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x90]
call fcn.18007f3e0
mov qword [rsp + 0x50], rax
jmp 0x1800920f5
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x98], rax
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x70]
call fcn.180092590
nop
lea rcx, [rsp + 0x70]
call fcn.180080b20
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call qword [rax]
test eax, eax
je 0x180092156
mov rax, qword [rsp + 0xc0]
add rax, 0x40
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.180092420
nop
lea rcx, [rsp + 0x70]
call fcn.1800767d0
mov eax, 1
add rsp, 0xb8
ret
Function at 0x180093980
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x90]
call fcn.1800821a0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x459
jne 0x1800939f3
lea rcx, str.Utf82Unicode:_Invalid_UTF_8_sequence._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [rsp + 0x30], 0
jne 0x180093a07
lea rcx, str.Utf82Unicode:_Error_in_conversion._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movsxd rax, dword [rsp + 0x30]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180093e60
nop
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180093e00
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x90]
call fcn.1800821a0
mov ecx, dword [rsp + 0x30]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x38], eax
je 0x180093a7b
lea rcx, str.Utf82Unicode:_MultiByteToWideChar_CP_UTF8_failed._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.180093e00
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.180081ed0
mov eax, dword [rsp + 0x34]
or eax, 1
mov dword [rsp + 0x34], eax
lea rcx, [rsp + 0x50]
call fcn.180093e30
mov rax, qword [rsp + 0x88]
add rsp, 0x78
ret
Function at 0x180093ac0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov dword [rsp + 0x44], 0
mov rcx, qword [rsp + 0xa0]
call fcn.180081e60
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x459
jne 0x180093b48
lea rcx, str.WideByte2Acsi:_Invalid_UTF_8_sequence._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [rsp + 0x40], 0
jne 0x180093b5c
lea rcx, str.WideByte2Acsi:_Error_in_conversion._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movsxd rax, dword [rsp + 0x40]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180093d60
nop
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180093d00
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0xa0]
call fcn.180081e60
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov ecx, dword [rsp + 0x40]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x48], eax
je 0x180093be2
lea rcx, str.WideByte2Acsi:_WideCharToMultiByte_CP_OEMCP_failed._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.180093d00
mov rdx, rax
mov rcx, qword [rsp + 0x98]
call fcn.180082700
mov eax, dword [rsp + 0x44]
or eax, 1
mov dword [rsp + 0x44], eax
lea rcx, [rsp + 0x60]
call fcn.180093d30
mov rax, qword [rsp + 0x98]
add rsp, 0x88
ret
Function at 0x180096240
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
xor edx, edx
mov rax, qword [rsp + 0xa0]
movabs rcx, 0x100000000
div rcx
mov rax, rdx
cmp rax, 0x7fffffff
jbe 0x180096277
mov byte [rsp + 0x20], 1
jmp 0x18009627c
mov byte [rsp + 0x20], 0
xor edx, edx
mov rax, qword [rsp + 0xa0]
movabs rcx, 0x100000000
div rcx
movabs rcx, 0x100000000
imul rax, rcx
movzx ecx, byte [rsp + 0x20]
movabs rdx, 0x100000000
imul rcx, rdx
add rax, rcx
mov qword [rsp + 0x28], rax
movabs rax, 0x800000000000
cmp qword [rsp + 0x28], rax
jne 0x1800962dc
movabs rax, 0x7fff80000000
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x58]
lea rcx, [0x18059f520]
call fcn.180080e50
lea rdx, [rsp + 0x70]
lea rcx, [0x18059f520]
call fcn.180080900
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.180080660
movzx eax, al
test eax, eax
je 0x1800964ca
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
movsx eax, byte [0x18059f49a]
mov ecx, dword [0x18059f49c]
imul ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], 0
cmp qword [rsp + 0x30], 0
jne 0x18009636a
xor edx, edx
mov eax, 0x10000
div dword [0x18059f49c]
imul eax, dword [0x18059f49c]
mov eax, eax
mov qword [rsp + 0x30], rax
mov r9d, 1
mov r8d, 0x2000
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180096469
mov eax, dword [0x18059f49c]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x18009644c
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x68], eax
mov eax, dword [0x18059f49c]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x6c], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], 1
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
mov rax, qword [rsp + 0x50]
mov ecx, dword [0x18059f49c]
mov dword [rax + 4], ecx
lea rdx, [rsp + 0x28]
lea rcx, [0x18059f520]
call fcn.1800983a0
lea rcx, [rsp + 0x60]
mov rdi, rax
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x28]
lea rcx, [0x18059f520]
call fcn.1800983a0
jmp 0x1800964d8
mov dword [rsp + 0x40], 0x13f
lea rdx, [0x180499598]
lea rcx, [rsp + 0x40]
call fcn.1802100d8
xor eax, eax
jmp 0x1800964d8
mov eax, dword [0x18059f49c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18009636a
mov eax, dword [0x18059f49c]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x18009636a
mov dword [rsp + 0x44], 0x146
lea rdx, [0x180499598]
lea rcx, [rsp + 0x44]
call fcn.1802100d8
xor eax, eax
jmp 0x1800964d8
lea rcx, [rsp + 0x58]
call fcn.180080640
add rax, 8
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x180098250
Capabilities:
Allocate thread local storage
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18059f4a0], eax
cmp dword [0x18059f4a0], 0xffffffff
jne 0x180098287
mov dword [rsp + 0x20], 0x47a
lea rdx, [0x180499598]
lea rcx, [rsp + 0x20]
call fcn.1802100d8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [0x18059f470], rax
cmp qword [0x18059f470], 0
jne 0x1800982be
mov dword [rsp + 0x24], 0x47f
lea rdx, [0x180499598]
lea rcx, [rsp + 0x24]
call fcn.1802100d8
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov byte [0x18059f498], 1
mov byte [0x18059f499], 0
mov byte [0x18059f49a], 1
mov eax, dword [rsp + 0x2c]
mov dword [0x18059f49c], eax
lea rax, [0x1800964f0]
mov qword [0x18059f490], rax
lea rax, [0x180096830]
mov qword [0x18059f488], rax
lea rax, [fcn.180096970]
mov qword [0x18059f480], rax
lea rax, [0x180096b00]
mov qword [0x18059f478], rax
mov qword [0x18059f468], 0
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x18009ff00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov esi, r8d
mov rbp, rdx
mov r14d, ecx
test r8d, r8d
jle 0x18009ff5f
nop word [rax + rax]
mov r8d, esi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
mov ecx, r14d
call fcn.1802349c4
mov edi, eax
test eax, eax
je 0x18009ff5f
cmp eax, 0xffffffff
jne 0x18009ff59
call fcn.180216a1c
cmp dword [rax], 4
jne 0x18009ff7c
add ebx, edi
cmp ebx, esi
jl 0x18009ff30
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
or eax, 0xffffffff
jmp 0x18009ff61
Function at 0x1800a0000
Capabilities:
Read file on windows

Disassembly:
push r12
push r15
mov eax, 0x2048
call fcn.1800b8180
sub rsp, rax
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov r15d, r8d
mov r12d, ecx
mov ecx, r15d
xor r8d, r8d
xor edx, edx
call fcn.18022a2bc
cmp eax, 0xffffffff
je 0x1800a0174
xor r8d, r8d
xor edx, edx
mov ecx, r12d
call fcn.18022a2bc
cmp eax, 0xffffffff
je 0x1800a0174
mov qword [rsp + 0x2068], rbx
mov qword [rsp + 0x2078], rbp
mov qword [rsp + 0x2040], rsi
mov qword [rsp + 0x2038], rdi
mov qword [rsp + 0x2030], r14
xor r14d, r14d
xor ebx, ebx
mov r8d, 0x2000
movsxd rax, ebx
lea rdx, [rsp + 0x20]
sub r8d, ebx
add rdx, rax
mov ecx, r15d
call fcn.1802349c4
mov edi, eax
test eax, eax
je 0x1800a00c1
cmp eax, 0xffffffff
jne 0x1800a00b7
call fcn.180216a1c
cmp dword [rax], 4
jne 0x1800a0163
add ebx, edi
cmp ebx, 0x2000
jl 0x1800a0082
test ebx, ebx
jle 0x1800a0161
mov edi, ebx
lea rsi, [rsp + 0x20]
xor ebp, ebp
mov r8d, edi
mov rdx, rsi
mov ecx, r12d
call fcn.18022fab4
cmp eax, 0xffffffff
je 0x1800a00f5
test eax, eax
je 0x1800a00ff
movsxd rcx, eax
sub edi, eax
add rsi, rcx
add ebp, eax
jmp 0x1800a00ff
call fcn.180216a1c
cmp dword [rax], 4
jne 0x1800a0110
test edi, edi
jg 0x1800a00d2
cmp ebp, 0xffffffff
je 0x1800a0110
add r14d, ebx
jmp 0x1800a0080
mov dword [0x18059f4a4], 0xf
or eax, 0xffffffff
mov rdi, qword [rsp + 0x2038]
mov rsi, qword [rsp + 0x2040]
mov rbp, qword [rsp + 0x2078]
mov rbx, qword [rsp + 0x2068]
mov r14, qword [rsp + 0x2030]
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0x2048
pop r15
pop r12
ret
jns 0x1800a016f
mov dword [0x18059f4a4], 0xe
jmp 0x1800a011a
mov eax, r14d
jmp 0x1800a011d
mov dword [0x18059f4a4], 0xd
or eax, 0xffffffff
jmp 0x1800a0145
Function at 0x1800a37a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x4a0
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rbx, rcx
mov rdi, rdx
xor ecx, ecx
call fcn.180216fac
mov r9, qword [0x1804bd008]
mov r10, rax
mov qword [rsp + 0x40], rax
test r9, r9
je 0x1800a3822
movabs r11, 0x1845c8a0ce512957
mov rax, r11
imul qword [0x1804bcef0]
mov rax, r11
mov r8, rdx
imul r10
sar r8, 0xd
sar rdx, 0xd
mov rcx, r8
mov rax, rdx
shr rcx, 0x3f
shr rax, 0x3f
add r8, rcx
add rdx, rax
cmp r8, rdx
je 0x1800a3977
xor eax, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], eax
call fcn.180217d84
xor edx, edx
lea rcx, [rsp + 0x90]
mov r8d, 0x400
call fcn.18020fe90
lea rcx, [rsp + 0x70]
call fcn.1800abe60
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800a3877
mov r8, qword [rax]
mov edx, dword [rsp + 0x58]
lea r9, [0x1804bcfd0]
mov ecx, dword [rsp + 0x5c]
inc edx
mov eax, dword [rsp + 0x54]
add ecx, 0x76c
mov dword [rsp + 0x38], eax
mov eax, dword [section..data]
mov dword [rsp + 0x30], edx
lea rdx, str._slog_s__d__04d__02d__02d.log
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x20], eax
call fcn.1800a2c50
mov rax, qword [rsp + 0x88]
cmp rax, 0x10
jb 0x1800a390f
mov rcx, qword [rsp + 0x70]
inc rax
cmp rax, 0x1000
jb 0x1800a390a
test cl, 0x1f
jne 0x1800a39b5
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800a39bb
sub rcx, rax
cmp rcx, 8
jb 0x1800a39c1
cmp rcx, 0x27
ja 0x1800a39c7
mov rcx, rax
call fcn.1800b7554
mov rcx, qword [0x1804bd008]
mov qword [rsp + 0x88], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x80], 0
mov byte [rsp + 0x70], 0
test rcx, rcx
je 0x1800a3942
call fcn.180217070
call fcn.1800a31a0
mov r8d, 0x40
lea rdx, [0x18032e100]
lea rcx, [rsp + 0x90]
call fcn.180217488
mov qword [0x1804bd008], rax
mov r9, rax
test rax, rax
je 0x1800a3994
mov r8, qword [rsp + 0x40]
mov qword [0x1804bcef0], r8
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
call fcn.1802176e8
mov rcx, qword [0x1804bd008]
call fcn.180217290
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1800b8140
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x4a0
pop rdi
ret
call fcn.1802119b4
int3
call fcn.1802119b4
int3
call fcn.1802119b4
int3
call fcn.1802119b4
int3