joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011ce0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x140049e10]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x140011dfa
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x140011d3a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140012d10
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x140011d4e
mov edx, 8
mov rcx, rbx
call fcn.140012d10
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x140011d9a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140011d70
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140011da9
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x14003d824]
test rax, rax
movsxd rsi, esi
lea rdi, [0x140049e08]
mov rcx, r15
cmovne rdi, rax
call fcn.1400025e0
mov rbx, rax
test rax, rax
je 0x140011df5
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x140019ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push r13
push r14
sub rsp, 0xb8
mov r13, rcx
movsxd rax, r9d
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xe8], ecx
mov r14, rdx
test r9d, r9d
jle 0x140019f02
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rbp
movzx ebp, byte [r13 + 0x24]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], rdi
mov edi, pe_nt_image_headers64
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
movzx r11d, byte [r13 + 0x20]
movss xmm8, dword [0x140042ac0]
nop word [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x140019d6a
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, di
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, di
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x140019d89
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
xor edi, edi
mov byte [rbx], r11b
mov byte [rbx + 1], bpl
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x140019ea0
mov r15, qword [rsp + 0xf0]
mov rax, r12
shl rax, 4
add r15, 6
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x140019dd0
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x140019dd3
mov edx, dword [rax + rsi]
mov eax, dword [r13 + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [r13 + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140014fd0
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.140017900
movzx ecx, word [r13 + 0x1c]
inc r12
movzx r11d, word [r13 + 0x20]
movzx eax, cx
sub ax, word [rsp + 0x50]
dec cx
movzx ebp, word [r13 + 0x24]
dec ax
add ax, r11w
inc edi
add ax, word [rsp + 0x54]
add rsi, 4
mov word [r15 - 2], ax
movzx eax, bp
sub ax, word [rsp + 0x58]
add ax, cx
mov ecx, dword [rsp + 0xe8]
add ax, word [rsp + 0x5c]
inc ecx
mov word [r15], ax
add r15, 0x10
mov dword [rsp + 0xe8], ecx
cmp edi, dword [rbx - 0x10]
jl 0x140019dc0
jmp 0x140019ea7
mov ecx, dword [rsp + 0xe8]
add rbx, 0x28
mov edi, pe_nt_image_headers64
sub qword [rsp + 0x60], 1
jne 0x140019d20
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov eax, ecx
add rsp, 0xb8
pop r14
pop r13
ret
Function at 0x14001d730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001d8e9
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001d7c6
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001d0a0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001c690
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001d7b7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140012990
mov dword [rbx + 0x80], 0
jmp 0x14001d8d5
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.14001b570
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002d880
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140049040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov edi, dword [0x140049fb8]
movsxd rax, dword [0x1400490c4]
xor edx, edx
cmp eax, 0xa5
ja 0x14002d8c1
lea rdx, str.None
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x140042760]
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x30], 0
mov rbx, 0xffffffffffffffff
mov r8, rbx
test rdx, rdx
jne 0x14002d950
movsd xmm0, qword [str.cTVWA]
movsd qword [rbp - 0x40], xmm0
movzx ecx, word [0x1400420c0]
mov word [rbp - 0x38], cx
movzx eax, byte [0x1400420c2]
mov byte [rbp - 0x40], 0x53
xor byte [rbp - 0x3f], 0x31
xor byte [rbp - 0x3e], 0x32
xor byte [rbp - 0x3d], 0x33
xor byte [rbp - 0x3c], 0x34
xor byte [rbp - 0x3b], 0x35
xor byte [rbp - 0x3a], 0x36
xor byte [rbp - 0x39], 0x37
xor cl, 0x38
mov byte [rbp - 0x38], cl
xor byte [rbp - 0x37], 0x39
xor al, 0x3a
mov byte [rbp - 0x36], al
lea rax, [rbp - 0x40]
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14002d940
lea rdx, [rbp - 0x40]
jmp 0x14002d95a
inc r8
cmp byte [rdx + r8], 0
jne 0x14002d950
lea rcx, [rbp - 0x30]
call fcn.1400394d0
cmp edi, 1
jne 0x14002d9ce
movsd xmm0, qword [str._CW_G]
movsd qword [rbp - 0x40], xmm0
movzx eax, word [0x1400421f0]
mov word [rbp - 0x38], ax
cmp byte [0x1400421f1], 0
je 0x14002d9b1
mov byte [rbp - 0x40], 0x50
xor byte [rbp - 0x3f], 0x31
xor byte [rbp - 0x3e], 0x32
xor byte [rbp - 0x3d], 0x33
xor byte [rbp - 0x3c], 0x34
xor byte [rbp - 0x3b], 0x35
xor byte [rbp - 0x3a], 0x36
xor byte [rbp - 0x39], 0x37
xor byte [rbp - 0x38], 0x38
xor byte [rbp - 0x37], 0x39
lea rax, [rbp - 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14002d9b5
mov r8, rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x30]
call fcn.1400394d0
mov dword [rbp - 0x40], 0x42fa0000
mov dword [rbp - 0x3c], 0x41c80000
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
lea rdx, [rbp - 0x40]
call fcn.140023920
test al, al
je 0x14002da1d
test edi, edi
jne 0x14002da1d
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x14002d830]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14002da5b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002da56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002da56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003ac64
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14003a850
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14003b580
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003b5ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003b5ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003b5ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003b5ca
cmp dword [rcx + 0x84], 0xe
jbe 0x14003b5ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003b5cc
xor al, al
add rsp, 0x28
ret
Function at 0x180012230
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001228d
lea rbx, [0x1800559c0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180012274
cmp r10, 2
jb 0x180012274
cmp byte [r9], r8b
jne 0x180012274
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180012250
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800122cf
lea rbx, [0x1800559c0]
cmp r8b, 0x23
jne 0x1800122b3
cmp byte [r9], r8b
jne 0x1800122b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800122a0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180012430
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18001244a
mov qword [r8], 0
lea rdx, [0x1800537c0]
call fcn.1800122e0
mov rbx, rax
test rax, rax
jne 0x18001246a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180012541
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180012541
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180012541
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180012541
cmp rdi, 0xffffffffffffffff
je 0x180012541
mov rax, qword [0x1800670a0]
test rax, rax
je 0x1800124de
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180012541
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18001252e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1800670a0]
test rax, rax
je 0x180012523
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18001254a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18001253c
mov qword [r14], rdi
mov rax, rsi
jmp 0x18001254c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180015920
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov rax, qword [rcx + 0xf0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1800559c0]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x1800670a0]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3f00], ebx
jne 0x1800159b6
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.180028390
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180019250
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1800192a0
lea r11, [0x1800559c0]
nop dword [rax]
cmp r9b, 0x23
jne 0x180019283
cmp byte [r8], r9b
jne 0x180019283
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180019270
mov rcx, qword [0x1800670a0]
not eax
movsxd rdx, dword [rcx + 0x3e98]
mov r9, qword [rcx + 0x3ea0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180019301
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x1800192f9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x1800192fc
mov rdx, r8
test rdx, rdx
jne 0x1800192d0
cmp r9, r10
je 0x180019310
cmp dword [r9], eax
jne 0x180019310
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x180026a90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c38], 0
lea rbx, [rcx + 0x5c40]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180026b37
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180026aea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180029530
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180012950
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c38]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c48]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180067098]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180026b3f
mov rcx, rbx
call fcn.180012950
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180026fc0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1800670a0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180027023
mov qword [rsp], rbx
lea rbx, [0x1800559c0]
nop dword [rax]
cmp r9b, 0x23
jne 0x180027003
cmp byte [r8], r9b
jne 0x180027003
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180026ff0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bb0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x180027057
mov r10, qword [r10 + 0x5bb8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x18002705e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x180027044
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x180049130
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180066040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x18004917f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1800672b0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x1800491bd
cmp rsi, r14
jb 0x1800491b5
cmp rsi, r15
jae 0x1800491b5
cmp qword [rsi + 8], 0
jne 0x180049387
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800491a0
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x180049252
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x180049249
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180049249
cmp dword [rsp + 0x40], 0x10000
je 0x1800492cb
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x180049249
sub rbx, rbp
cmp rbx, r14
jae 0x180049210
test rsi, rsi
jne 0x180049330
cmp rdi, r15
ja 0x18004936f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18004936f
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18004936f
cmp dword [rsp + 0x40], 0x10000
je 0x180049301
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x180049282
jmp 0x18004936f
test rbx, rbx
je 0x180049249
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180049330
cmp rbx, r14
jae 0x1800491f0
jmp 0x180049252
test rdi, rdi
je 0x18004936f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180049330
cmp rdi, r15
jbe 0x180049260
jmp 0x18004936f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x180049340
mov rax, qword [0x1800672b0]
mov qword [rsi], rax
mov qword [0x1800672b0], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800500d0
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x180049da0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180066040]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180049eef
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180049ee6
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x180049e9c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180049e9c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180049e9c
mov rdx, qword [rdi]
test rdx, rdx
jne 0x180049e5d
mov rcx, qword [0x1800670b8]
mov r8d, 0x200
mov dword [rdi + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x180049ec5
lea rbx, [rdi + 0xc]
jmp 0x180049e91
mov eax, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], eax
jb 0x180049e91
mov rcx, qword [0x1800670b8]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rdi + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180049ec5
mov qword [rdi], rax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180049e03
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180049ee1
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x180049ee1
mov rcx, qword [0x1800670b8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800500d0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret