joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.oWmjcrXaELKRDSucyLCqfAsQLQpAscgtHIPfVVqWGSspmyDLiQpSyhFlNZtMGzRcZWxLeUJgCwxwrATdBpjrTBWkdNBGrOoKNfXYhgHjIFRPhjGOishNyaWvrSbSmWEZzmHejCoBdoluwgYuhiRuTHwrEVFBeiWTSUnLJIHpUdmONmbjVJEEwghMUMzMcrvgDfymPyowlsvsUYKIwwimirBkSWUBPfTlfMMsSxriLluTxnQameTXsYYdNCnULyGrwwAIkcPDrftzxYKkEnbwyeLMFoGrzCGUIwBDZZQORjIEiXcqbwHruvxeTxhnIkxiLXRzaomKPnCwHQpNvdgsSbyzKmLyHrwOmtxJaiDrLEDpdWeCRPVseWEzmzhoKPEiLQDfOkpLmjyQLeSXhUQjvvzbruJmwEnElwmPIcsxJyCsaamMrCmnDCTUmKWIewzHdNlDxAQVdWuOUIKqncEcbHkQioITcRt
mov r10, rax
sub rbx, rax
movabs rdi, 0x8888888888888889
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1e0
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140004dc0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x4b
mov dword [rbp - 0x20], 0x120024
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x24003f
mov dword [rbp - 0x18], 0x3e0026
mov dword [rbp - 0x14], 0x20001a
mov dword [rbp - 0x10], 0x90016
call fcn.140004d70
mov rcx, rax
call 0x140009bb0
mov qword [0x1400101b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x45
mov dword [rbp - 0x20], 0x120024
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x24003f
mov dword [rbp - 0x18], 0x3e0026
mov dword [rbp - 0x14], 0x53006b
call fcn.140002330
mov rcx, rax
call 0x140009bb0
lea rcx, [rbp - 0x20]
mov qword [0x1400101a8], rax
mov dword [rbp - 0x20], 0x230001
mov dword [rbp - 0x1c], 0x60009
mov dword [rbp - 0x18], 0x72000f
call fcn.140004c00
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x140009bb0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140009c12
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000a410
test al, al
jne 0x140009c24
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140009be0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009bb0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x4b
mov dword [rbp - 0x20], 0x120024
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x24003f
mov dword [rbp - 0x18], 0x3e0026
mov dword [rbp - 0x14], 0x20001a
mov dword [rbp - 0x10], 0x90016
call fcn.140004d70
mov rcx, rax
call 0x140009bb0
mov qword [0x1400101b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x45
mov dword [rbp - 0x20], 0x120024
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x24003f
mov dword [rbp - 0x18], 0x3e0026
mov dword [rbp - 0x14], 0x53006b
call fcn.140002330
mov rcx, rax
call 0x140009bb0
lea rcx, [rbp - 0x20]
mov qword [0x1400101a8], rax
mov dword [rbp - 0x20], 0x230001
mov dword [rbp - 0x1c], 0x60009
mov dword [rbp - 0x18], 0x72000f
call fcn.140004c00
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x140009bb0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140009c12
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000a410
test al, al
jne 0x140009c24
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140009be0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000a9c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400101c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x3f003c
mov dword [rbp - 0x1c], 0x60008
mov dword [rbp - 0x18], 0x41000f
mov dword [rbp - 0x14], 0x4f006a
mov dword [rbp - 0x10], 0x200021
mov dword [rbp - 0xc], 0x520027
call fcn.140002a50
mov rcx, rax
call rbx
mov rbx, qword [0x1400101c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400101a0], rax
mov dword [rbp - 0x20], 0x3e0038
mov dword [rbp - 0x1c], 0x30003
mov dword [rbp - 0x18], 0x17000d
mov dword [rbp - 0x14], 0x4f002c
mov dword [rbp - 0x10], 0x200021
mov dword [rbp - 0xc], 0x520027
call fcn.140002a50
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x14000ef90]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400101b0], rax
mov word [rbp - 0x10], 0x1b0f
mov byte [rbp - 0xe], 0x43
call fcn.1400043c0
mov rcx, qword [0x1400101a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140010130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x6083f3c
mov dword [rbp - 0x1c], 0x420370f
mov dword [rbp - 0x18], 0x373f3926
mov word [rbp - 0x14], 0x5313
call fcn.140001180
mov rcx, qword [0x1400101a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140010130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xf193926
mov dword [rbp - 0x1c], 0x153d1c11
mov dword [rbp - 0x18], 0x3c2e3c0a
mov word [rbp - 0x14], 0x5305
call fcn.140001180
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f080]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100e8], rax
mov byte [rbp - 0x10], 0x79
call fcn.1400014c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000eff0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100f0], rax
mov dword [rbp - 0x10], 0x7126201d
call fcn.1400026f0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000efc0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100e0], rax
mov byte [rbp - 0x10], 0x79
call fcn.1400014c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f050]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100d8], rax
mov dword [rbp - 0x10], 0x302d2310
mov byte [rbp - 0xc], 0x66
call fcn.1400031c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000efe0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0xd17
mov byte [rbp - 0xe], 0x43
call fcn.1400043c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x14000cce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000cf0e
mov word [rbp + 0x50], 0x576f
mov word [rbp + 0x58], 0x576f
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000cd94
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000cd80
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000cdc5
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000cdb0
cmp rdi, rbx
jne 0x14000cee2
mov r13, rsi
mov word [rbp - 0x50], 0x576f
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000ce06
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001850
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000cdf2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000cf08
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x57000e
call fcn.140002520
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000ce78
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x570015
call fcn.140002520
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000ce78
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x57000e
mov dword [rbp - 0x42], 0x57002e
call fcn.140002520
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002520
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x57000e
call fcn.140002520
movzx eax, word [rax]
cmp edi, eax
jl 0x14000ced5
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x570015
call fcn.140002520
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000ced5
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x57000e
mov dword [rbp - 0x32], 0x57002e
call fcn.140002520
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002520
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000cee2
inc r14
jmp 0x14000cde0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000cf0e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000cd50
mov rax, qword [rbp - 8]
jmp 0x14000cf10
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800478c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rsp + 0x30]
lea r15d, [r8 - 6]
mov rsi, r9
mov r12, rdx
mov rbp, rcx
cmp r8d, r15d
jbe case.0x18004791a.11
lea r14d, [r8 - 0x8a]
lea r13, [0x180000000]
cmp r14d, 0x12
ja case.0x18004791a.1
mov ecx, dword [r13 + r14*4 + 0x47a54]
add rcx, r13
jmp rcx
mov edi, 0x1b
mov eax, edi
sub eax, 0x17
je case.0x18004791a.1
sub eax, 1
je case.0x18004791a.1
cmp eax, 3
jne 0x180047949
cmp byte [0x18007ce61], 0
je 0x180047949
call qword [0x18007ce48]
dec edi
cmp edi, 0x18
ja 0x180047921
jmp case.0x18004791a.1
test rsi, rsi
je case.0x18004791a.11
xor edi, edi
cmp qword [rsi + 0x10], rdi
jbe case.0x18004791a.1
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 0x20]
cmp qword [rcx + rdi*8], rdx
jae 0x1800479a1
nop dword [rax + rax]
mov r8, qword [rbp + 0x30]
mov edx, 0xbc
xor ecx, ecx
call fcn.1800451e0
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov rdx, qword [rax + 0x20]
cmp qword [rcx + rdi*8], rdx
jb 0x180047980
inc rdi
cmp rdi, qword [rsi + 0x10]
jb 0x180047975
jmp case.0x18004791a.1
mov r9, qword [rsp + 0x90]
mov rcx, rbp
mov r8, qword [r12]
mov rdx, qword [rsi]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, rax
jmp case.0x18004791a.1
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x84
xor edx, edx
xor ecx, ecx
call fcn.18005d010
mov rbx, rax
test rax, rax
je 0x180047a4d
xor r9d, r9d
mov r8, rax
mov edx, SHSetInstanceExplorer
xor ecx, ecx
call fcn.180053660
test eax, eax
jne 0x180047a3d
dec r14d
lea eax, [r14 + 0x8a]
cmp eax, r15d
ja 0x180047905
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor edx, edx
mov r8d, 0xeb
mov rcx, rbx
call fcn.18005e5f0
xor eax, eax
jmp 0x180047a1d
Function at 0x18004cca0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
imul eax, r8d, 0x2b0
mov r15, r9
mov r13d, r8d
mov r14, rdx
mov rdi, rcx
mov esi, r8d
mov dword [rsp + 0x90], eax
cmp r8d, eax
ja 0x18004cdd6
mov rbp, qword [rsp + 0x48]
xor ebx, ebx
mov r12, qword [rsp + 0x48]
nop
cmp esi, 0x1569
ja 0x18004ce2c
je 0x18004cdf9
mov eax, esi
sub eax, 0x35
je 0x18004ce64
sub eax, 0xa
je 0x18004cdae
sub eax, 0x67
je 0x18004cd45
cmp eax, 8
jne 0x18004ce44
mov r9, qword [rsp + 0xa0]
mov rcx, rdi
mov r8, qword [r14]
mov rdx, qword [r15]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov qword [rsp + 0x30], rax
jmp 0x18004ce44
test rdi, rdi
je 0x18004ce5c
mov rax, qword [r15]
lea r9, [rsp + 0x48]
mov rdx, qword [rdi + 0x18]
mov r8d, 0x1d
mov rcx, qword [rdi]
mov qword [rsp + 0x38], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.1800587a0
mov r12, rax
test rax, rax
je 0x18004ce5c
mov rax, qword [r15]
mov qword [rdi + 8], rax
mov qword [rdi], r12
jmp 0x18004ce44
mov qword [r14 + 8], rbx
mov r9d, 0x40
mov qword [r14], rbx
mov r8d, 0x1000
mov rdx, qword [rdi + 0x10]
xor ecx, ecx
call qword [r15]
mov rbp, rax
test rax, rax
jne 0x18004ce44
mov byte [rsp + 0x30], bl
mov rax, qword [rsp + 0x30]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x18004ce06
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rdi + 0x20]
add rax, rbp
mov byte [rsp + 0x30], 1
mov qword [r14 + 8], rax
mov eax, dword [rdi + 0x24]
add rax, rbp
mov qword [r14], rax
jmp 0x18004ce44
cmp esi, 0x2a93
je 0x18004cdd6
cmp esi, 0x386a
je 0x18004ce79
cmp esi, 0x3b22
je 0x18004cdd6
imul eax, r13d, 0x56
add esi, eax
cmp esi, dword [rsp + 0x90]
jbe 0x18004ccf0
jmp 0x18004cdd6
mov rax, rbx
jmp 0x18004cddb
mov rax, qword [rdi]
movzx ecx, byte [rax]
inc rax
mov qword [rdi], rax
mov byte [rsp + 0x30], cl
jmp 0x18004cdd6
mov rax, r12
jmp 0x18004cddb
Function at 0x18004ce90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
lea esi, [rdx + 0x244]
mov r14, r8
mov ebx, edx
mov rdi, rcx
cmp edx, esi
jae 0x18004cf6e
xor ebp, ebp
nop word [rax + rax]
mov eax, ebx
sub eax, 0x58
je 0x18004cf1b
sub eax, 0x91
je 0x18004cf62
sub eax, 0xa
je 0x18004cee4
cmp eax, 0x91
je 0x18004cf6e
jmp 0x18004cf52
mov rax, qword [r14]
lea r8, [rsp + 0x30]
mov rcx, qword [rdi + 0x260]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov r9d, 0x39
mov rax, qword [rdi + 0x268]
mov qword [rsp + 0x38], rax
call fcn.180068750
mov qword [rsp + 0x78], rax
jmp 0x18004cf52
mov qword [0x18007cde8], rdi
lea r8, [0x18004d8d0]
mov qword [rsp + 0x28], rbp
mov r9, rdi
xor edx, edx
mov qword [rdi + 0x80], r14
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18004cf69
xchg qword [0x18007cdf0], rax
add ebx, 0x91
cmp ebx, esi
jb 0x18004cec0
jmp 0x18004cf6e
mov byte [rsp + 0x78], 1
jmp 0x18004cf6e
mov byte [rsp + 0x78], bpl
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800503c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
lea ebp, [rcx - 8]
mov r15, r8
mov rsi, rdx
mov ebx, ecx
cmp ecx, ebp
jbe case.0x18005041d.0
mov r14, qword [rsp + 0xa8]
lea edi, [rcx - 0x32]
lea r12, [0x180000000]
nop dword [rax + rax]
cmp edi, 0x21
ja case.0x18005041d.7
movzx eax, byte [r12 + rdi + 0x50630]
mov ecx, dword [r12 + rax*4 + 0x50610]
add rcx, r12
jmp rcx
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x1800505d0
cmp qword [r8 + 8], 2
jne 0x1800505d0
mov r9, r14
mov qword [rsp + 0x38], 1
mov edx, 0x7f
lea rcx, [rsp + 0x38]
call fcn.180062810
mov r8, rax
xor edx, edx
mov ecx, 0xa9
call fcn.18004c030
lea r8, [rsp + 0x90]
mov byte [rsp + 0x90], 1
mov rdx, r14
mov ecx, 0x91
call fcn.18006b1e0
mov r14, rax
jmp case.0x18005041d.7
test rsi, rsi
je case.0x18005041d.0
xor edx, edx
mov r8d, 0xeb
mov rcx, rsi
call fcn.18005e5f0
jmp case.0x18005041d.7
mov r9d, 0xef
mov qword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180042520
mov r14, rax
mov qword [rsp + 0x30], 0
mov edx, 0x23
mov qword [rsp + 0x40], 1
lea rax, [rsp + 0x30]
mov r9, r14
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x22]
call fcn.180062560
mov edx, 0x23
mov qword [rsp + 0x48], 3
lea rax, [rsp + 0x30]
mov r9, r14
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x20]
call fcn.180062560
mov edx, 0x23
mov qword [rsp + 0x50], 2
lea rax, [rsp + 0x30]
mov r9, r14
lea r8, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea ecx, [rdx - 0x21]
call fcn.180062560
jmp case.0x18005041d.7
test rsi, rsi
je 0x180050600
mov rdx, qword [rsi + 0x10]
xor ecx, ecx
test rdx, rdx
je 0x18005057a
mov rax, qword [rsi]
mov r8, qword [rax + 0x20]
mov rax, qword [rsi + 8]
cmp qword [rax], r8
jb 0x1800505f6
inc rcx
add rax, 8
cmp rcx, rdx
jb 0x180050565
mov byte [rsp + 0xa8], 1
jmp case.0x18005041d.7
mov eax, dword [r15]
xchg dword [rsi + 0xc], eax
jmp case.0x18005041d.7
test byte [rsi + 0x20], 4
jne 0x18005060a
mov dword [rsi + 0x20], 4
mov dword [rsp + 0xa8], 0
dec ebx
dec edi
cmp ebx, ebp
ja 0x180050400
mov eax, dword [rsp + 0xa8]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.function_verifuint_value__max__
call fcn.18006e7b0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov byte [rsp + 0xa8], 0
jmp case.0x18005041d.0
mov byte [rsp + 0xa8], 1
jmp case.0x18005041d.0
xor eax, eax
jmp 0x1800505b7
Function at 0x18005a1e0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea edi, [r9 + 0xb]
mov ebp, r9d
mov dword [rsp + 0x88], edi
mov r14, r8
mov rbx, rdx
mov rsi, rcx
cmp r9d, edi
jae 0x18005a43a
mov r13, qword [rsp + 0x38]
lea r15d, [r9 - 0xcd]
mov r12, qword [rsp + 0x38]
lea rdx, [0x180000000]
cmp r15d, 0x2d
ja case.0x18005a251.11
movzx eax, byte [rdx + r15 + 0x5a490]
mov ecx, dword [rdx + rax*4 + 0x5a460]
add rcx, rdx
jmp rcx
mov r13, qword [r14]
sub r13, qword [rsi + 0x18]
jmp case.0x18005a251.11
mov qword [r12 + 0x20], rsi
mov qword [rsi + 0x28], r12
mov qword [rsi + 0x10], r13
mov qword [rsi + 8], r13
jmp case.0x18005a251.11
mov edi, 0x25
nop word [rax + rax]
cmp edi, 0x25
je 0x18005a2a8
cmp edi, 0xd3
je 0x18005a29e
cmp edi, 0x181
je 0x18005a43a
jmp 0x18005a326
mov dword [rsp + 0x30], 0
jmp 0x18005a326
mov rcx, qword [rbx]
test rcx, rcx
je 0x18005a2da
mov rax, qword [rbx + 0x10]
cmp qword [r14], rax
jbe 0x18005a314
xor edx, edx
mov r8d, 0xeb
call fcn.18005e5f0
mov rdx, qword [rsi]
add rdx, qword [r14]
mov qword [rbx + 0x10], rdx
mov rax, qword [rsi + 0x10]
imul rax, rdx
jmp 0x18005a2f8
mov rcx, qword [rsi]
mov qword [rbx + 0x10], rcx
mov rax, qword [r14]
cmp rax, rcx
jbe 0x18005a2f0
add rcx, rax
mov qword [rbx + 0x10], rcx
mov rax, qword [rsi + 0x10]
imul rax, rcx
mov r9d, 0x58
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call fcn.18005dee0
mov qword [rbx], rax
cmp qword [rbx], 0
mov qword [rbx + 8], 0
je 0x18005a419
add edi, 0xae
cmp edi, 0x22f
jb 0x18005a280
mov edi, dword [rsp + 0x88]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x18005a423
lea rdx, [0x180000000]
jmp case.0x18005a251.11
mov rax, qword [rbx]
lea r9, [rsp + 0x38]
mov dword [rsp + 0x28], 0xa5
mov r8, r14
mov rdx, rsi
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov qword [rsp + 0x20], 0
call fcn.180069980
lea rdx, [0x180000000]
jmp case.0x18005a251.11
cmp byte [rsi + 0x118], 0
je 0x18005a43a
jmp case.0x18005a251.11
lea r9, [rsi + 0x48]
mov dword [rsp + 0x20], 0xc6
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18004a6f0
lea rdx, [0x180000000]
jmp case.0x18005a251.11
xor edx, edx
mov r8d, 0xbd
mov rcx, rbx
call fcn.18005e5f0
mov rcx, qword [rsi + 0x10]
mov r12, rax
sub rcx, r13
mov qword [rax + 0x10], rcx
mov qword [rax + 8], rcx
mov rdx, qword [rsi]
add rdx, r13
mov qword [rax], rdx
mov rdx, qword [rsi + 0x18]
add rdx, r13
mov qword [rax + 0x18], rdx
lea rdx, [0x180000000]
jmp case.0x18005a251.11
mov qword [r12 + 0x28], 0
inc ebp
inc r15d
cmp ebp, edi
jb 0x18005a234
jmp 0x18005a43a
mov dword [rsp + 0x30], 2
jmp 0x18005a43a
mov dword [rsp + 0x30], 0
jmp 0x18005a43a
mov rax, r12
jmp 0x18005a43f
mov dword [rsp + 0x30], 1
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret