joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b640
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x28
call fcn.180060d60
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x18000b680
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180060d60
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x18000b6a0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.180060d60
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x18000cf40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x40
call fcn.180060d60
sub rsp, rax
mov rdx, qword [rcx + 0x18]
mov eax, dword [rcx + 8]
xor ebx, ebx
lea r8, [rdx + rax*8]
mov rsi, rcx
cmp rdx, r8
je 0x18000cf83
nop dword [rax]
cmp qword [rdx], rbx
jne 0x18000cf80
add rdx, 8
cmp rdx, r8
jne 0x18000cf70
jmp 0x18000cf83
mov rbx, qword [rdx]
test rbx, rbx
je 0x18000d0ef
mov rbx, qword [rbx + 8]
mov rax, qword [rsi]
mov rdx, rsi
mov rcx, qword [rbx]
call qword [rax + 8]
mov dl, 1
mov rcx, rbx
call fcn.18000a200
test eax, eax
jne 0x18000d0f1
mov rcx, rbx
call fcn.180008fc0
mov rcx, rbx
call fcn.18000b860
mov r11d, dword [rsi + 8]
mov r9, qword [rsi + 0x18]
test r11d, r11d
je 0x18000d0ad
movzx ecx, bl
mov r8, rbx
xor ecx, 0x811c9dc5
shr r8, 8
movzx eax, r8b
shr r8, 8
imul ecx, ecx, 0x1000193
xor eax, ecx
movzx ecx, r8b
shr r8, 8
imul eax, eax, 0x1000193
xor ecx, eax
movzx eax, r8b
shr r8, 8
imul ecx, ecx, 0x1000193
xor eax, ecx
movzx ecx, r8b
shr r8, 8
imul eax, eax, 0x1000193
xor ecx, eax
movzx eax, r8b
shr r8, 8
imul ecx, ecx, 0x1000193
xor eax, ecx
movzx ecx, r8b
shr r8, 8
movzx edx, r8b
shr r8, 8
imul eax, eax, 0x1000193
xor ecx, eax
movzx eax, r8b
imul ecx, ecx, 0x1000193
xor edx, ecx
imul edx, edx, 0x1000193
xor eax, edx
xor edx, edx
imul eax, eax, 0x1000193
div r11d
mov rax, qword [r9 + rdx*8]
lea rdx, [r9 + rdx*8]
test rax, rax
je 0x18000d084
cmp qword [rax + 8], rbx
je 0x18000d084
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x18000d073
test rdx, rdx
je 0x18000d0ad
mov rcx, qword [rdx]
test rcx, rcx
je 0x18000d0ad
mov rax, qword [rcx]
mov qword [rdx], rax
call fcn.18000b860
dec qword [rsi + 0x10]
mov rdx, qword [rsi + 0x10]
lea rcx, [rsi + 8]
call fcn.18000c820
mov rcx, qword [rsi + 0x18]
mov eax, dword [rsi + 8]
xor ebx, ebx
lea rdx, [rcx + rax*8]
cmp rcx, rdx
je 0x18000d0e0
nop
cmp qword [rcx], rbx
jne 0x18000d0dd
add rcx, 8
cmp rcx, rdx
jne 0x18000d0c0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rdx
jmp 0x18000cf83
mov rbx, qword [rcx]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rdx
jmp 0x18000cf83
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18000d9d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x20
call fcn.180060d60
sub rsp, rax
xor ebx, ebx
mov rsi, rcx
mov ebp, ebx
test rcx, rcx
je 0x18000dab7
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
or rcx, 0xffffffffffffffff
mov rdi, rsi
mov r12d, eax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
lea ecx, [r12 + 1]
add rdx, rcx
lea ecx, [rbx + 0x40]
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
test rax, rax
je 0x18000daba
mov edx, r12d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [rax - 1]
cmp word [rbp + rcx*2], 0x5c
je 0x18000da64
mov ecx, eax
mov edx, 0x5c
inc eax
mov word [rbp + rcx*2], dx
or rcx, 0xffffffffffffffff
movsxd r8, eax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x18000dab7
add r8, r8
mov rdx, rsi
sub r8, rsi
add r8, rbp
nop word [rax + rax]
movzx eax, word [rdx]
or rcx, 0xffffffffffffffff
inc ebx
mov word [r8 + rdx], ax
xor eax, eax
mov rdi, rsi
repne scasw ax, word [rdi]
mov eax, ebx
add rdx, 2
not rcx
dec rcx
cmp rax, rcx
jb 0x18000da90
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret

Function at 0x18000e360
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x180087ca4], 0
jne 0x18000e3b2
lea rcx, str.HWLOC_HIDE_ERRORS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18000e39d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x180087ca0], eax
mov dword [0x180087ca4], 1
add rsp, 0x28
ret
mov eax, dword [0x180087ca0]
mov dword [0x180087ca4], 1
add rsp, 0x28
ret
mov eax, dword [0x180087ca0]
add rsp, 0x28
ret
Function at 0x1800165e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1800824f0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
xor ebx, ebx
nop
mov ecx, ebx
call fcn.180012ec0
mov r9, rax
lea rcx, [rsp + 0x20]
mov edx, 0x40
lea r8, str.HWLOC__s_DISTANCES
call fcn.18000e2f0
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18001663d
mov r8, rax
mov edx, ebx
mov rcx, rdi
call fcn.180015fb0
inc ebx
cmp ebx, 0xc
jl 0x180016600
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180060dd0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x180018ce0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
mov rbp, rcx
mov ebx, 1
xor eax, eax
lock cmpxchg dword [0x180087cb8], ebx
je 0x180018d12
nop
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor eax, eax
lock cmpxchg dword [0x180087cb8], ebx
jne 0x180018d00
mov eax, dword [0x180087cc0]
mov ecx, eax
inc eax
mov qword [rsp + 0x30], rsi
mov dword [0x180087cc0], eax
test ecx, ecx
je 0x180018d32
xor esi, esi
jmp 0x180018ebc
lea rcx, str.HWLOC_COMPONENTS_VERBOSE
mov qword [rsp + 0x40], r14
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor esi, esi
test rax, rax
je 0x180018d5c
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x180087cbc], eax
jmp 0x180018d62
mov dword [0x180087cbc], esi
mov rdx, qword [0x180074160]
lea r14, [0x180074160]
mov qword [0x180087cf8], rsi
mov dword [0x180087cf0], esi
test rdx, rdx
je 0x180018db9
mov ecx, dword [0x180087cf0]
inc ecx
mov dword [0x180087cf0], ecx
cmp qword [r14 + rcx*8], rsi
jne 0x180018d82
test ecx, ecx
je 0x180018db9
mov edx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdx, qword [0x180074160]
mov qword [0x180087cf8], rax
mov dword [0x180087cf0], esi
mov ebx, esi
test rdx, rdx
je 0x180018eb7
mov qword [rsp + 0x38], rdi
nop dword [rax]
mov eax, ebx
mov rax, qword [r14 + rax*8]
mov edi, dword [rax + 0x1c]
test edi, edi
je 0x180018dff
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, edi
lea rdx, str.Ignoring_static_component_with_invalid_flags__lx_n
mov rcx, rax
call fcn.18000e2a0
jmp 0x180018ea6
mov rax, qword [rax + 8]
test rax, rax
je 0x180018e38
xor ecx, ecx
call rax
test eax, eax
jns 0x180018e38
cmp dword [0x180087cbc], esi
je 0x180018ea6
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.Ignoring_static_component__failed_to_initialize_n
call fcn.18000e2a0
jmp 0x180018ea6
mov eax, ebx
mov rax, qword [r14 + rax*8]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x180018e5e
mov ecx, dword [0x180087cf0]
mov rax, qword [0x180087cf8]
mov qword [rax + rcx*8], rdx
inc dword [0x180087cf0]
mov eax, ebx
mov rcx, qword [r14 + rax*8]
mov eax, dword [rcx + 0x18]
test eax, eax
jne 0x180018e76
mov rcx, qword [rcx + 0x20]
call fcn.180018a20
jmp 0x180018ea6
cmp eax, 1
jne 0x180018ea6
cmp qword [0x180087cd0], rsi
mov rdx, qword [rcx + 0x20]
jne 0x180018e92
mov rax, qword [rdx]
mov qword [0x180087cd0], rax
cmp qword [0x180087ce0], rsi
jne 0x180018ea6
mov rax, qword [rdx + 8]
mov qword [0x180087ce0], rax
inc ebx
cmp qword [r14 + rbx*8], rsi
jne 0x180018dd0
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov dword [0x180087cb8], esi
mov qword [rbp + 0x7e8], rsi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
Function at 0x1800197a0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x7e8]
mov rbx, rcx
mov dword [rcx + 0x66c], 1
mov rdx, rax
xor ecx, ecx
test rax, rax
je 0x1800197de
cmp dword [rdx + 0x10], ecx
jne 0x1800197d5
cmp dword [rdx + 0x28], 0xffffffff
je 0x1800197d5
mov dword [rbx + 0x66c], ecx
mov rdx, qword [rdx + 0x18]
test rdx, rdx
jne 0x1800197c4
test byte [rbx + 0x608], 2
je 0x1800197f1
mov dword [rbx + 0x66c], 1
test rax, rax
je 0x180019811
cmp dword [rax + 0x10], 1
jne 0x180019808
cmp dword [rax + 0x28], 0xffffffff
je 0x180019808
mov dword [rbx + 0x66c], ecx
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1800197f6
lea rcx, str.HWLOC_THISSYSTEM
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x180019832
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [rbx + 0x66c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x180019f50
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x18001a09a
lea rdx, str.GetActiveProcessorGroupCount
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetActiveProcessorCount
mov rcx, rbx
mov qword [0x180087d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLogicalProcessorInformation
mov rcx, rbx
mov qword [0x180087d00], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCurrentProcessorNumber
mov rcx, rbx
mov qword [0x180087d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCurrentProcessorNumberEx
mov rcx, rbx
mov qword [0x180087d20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetThreadGroupAffinity
mov rcx, rbx
mov qword [0x180087d30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetThreadGroupAffinity
mov rcx, rbx
mov qword [0x180087d38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNumaAvailableMemoryNode
mov rcx, rbx
mov qword [0x180087d60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNumaAvailableMemoryNodeEx
mov rcx, rbx
mov qword [0x180087d40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetLogicalProcessorInformationEx
mov rcx, rbx
mov qword [0x180087d10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.K32QueryWorkingSetEx
mov rcx, rbx
mov qword [0x180087d18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualAllocExNuma
mov rcx, rbx
mov qword [0x180087d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualFreeEx
mov rcx, rbx
mov qword [0x180087d08], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180087d28], rax
mov rax, qword [0x180087d58]
test rax, rax
je 0x18001a0b1
call rax
movzx eax, ax
mov dword [0x180082528], eax
cmp qword [0x180087d08], 0
jne 0x18001a0e4
lea rcx, str.psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18001a0e4
lea rdx, str.QueryWorkingSetEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180087d08], rax
add rsp, 0x20
pop rbx
ret

Function at 0x18001c380
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x18008252c], 0
je 0x18001c3d2
lea rcx, str.HWLOC_XML_VERBOSE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18001c3bd
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x180087cd8], eax
mov dword [0x18008252c], 0
add rsp, 0x28
ret
mov eax, dword [0x180087cd8]
mov dword [0x18008252c], 0
add rsp, 0x28
ret
mov eax, dword [0x180087cd8]
add rsp, 0x28
ret
Function at 0x18001c3e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
cmp dword [0x180082590], 0
je 0x18001c432
lea rcx, str.HWLOC_NO_LIBXML_IMPORT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18001c41d
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [0x180087cdc], eax
mov dword [0x180082590], 0
add rsp, 0x28
ret
mov eax, dword [0x180087cdc]
mov dword [0x180082590], 0
add rsp, 0x28
ret
mov eax, dword [0x180087cdc]
add rsp, 0x28
ret
Function at 0x180020410
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x78
mov rax, qword [0x1800824f0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx r9d, byte [rcx]
mov r13, r8
movzx eax, byte [0x180076008]
mov r12, rdx
sub r9d, eax
jne 0x18002044f
movzx r9d, byte [rcx + 1]
movzx eax, byte [0x180076009]
sub r9d, eax
mov qword [rsp + 0xb8], rsi
lea rbx, str._dev_stdin
test r9d, r9d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x68], r14
lea rdx, [0x18007601c]
cmovne rbx, rcx
mov qword [rsp + 0x60], r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbp, rax
test rax, rax
je 0x18002056e
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov edi, 0x1000
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800204bc
mov eax, 0x8000
test word [rsp + 0x26], ax
je 0x1800204bc
mov eax, dword [rsp + 0x34]
inc eax
movsxd rdi, eax
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180020565
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r15, rax
mov byte [rax + rsi], 0
cmp rax, rdi
jne 0x180020543
nop dword [rax]
nop word [rax + rax]
add rdi, rdi
mov rcx, rsi
lea rdx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r14, rax
test rax, rax
je 0x18002055c
mov rbx, rdi
lea rcx, [rax + r15]
shr rbx, 1
mov r9, rbp
mov r8, rbx
mov edx, 1
mov rsi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r15, rax
mov byte [rsi + r15], 0
cmp rax, rbx
je 0x180020500
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rax, [r15 + 1]
mov qword [r12], rsi
mov qword [r13], rax
xor eax, eax
jmp 0x180020571
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
or eax, 0xffffffff
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180060dd0
add rsp, 0x78
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x18003d670
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
test rcx, rcx
je 0x18003d74d
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp rcx, 0x64
jbe 0x18003d6dc
imul rax, rbx, 0xfffffffffffffff6
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x50], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
xor r9d, r9d
lea rdx, [rsp + 0x50]
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rbx
ret
lea rcx, [rsp + 0x60]
movaps xmmword [rsp + 0x30], xmm6
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movss xmm6, dword [0x180067fd8]
nop
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x50]
xorps xmm1, xmm1
sub rax, qword [rsp + 0x58]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x60]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
mulss xmm1, xmm6
mulss xmm1, xmm6
cvttss2si rax, xmm1
cmp rax, rbx
jb 0x18003d700
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
ret

Function at 0x180041bf0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x38]
xor r8d, r8d
lea r9, str.XMRSTAK_NOWAIT
xor edx, edx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv_s]
cmp qword [rsp + 0x38], 0
jne 0x180041c39
call fcn.18002a2b0
mov rcx, rax
lea rdx, str.Press_any_key_to_exit.
call fcn.180041b50
call fcn.180041910
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x180057ad0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
pshufd xmm0, xmmword [rdx], 0x55
lea rbp, [0x180071210]
mov rdi, rcx
movd eax, xmm0
pshufd xmm0, xmmword [rdx], 0xff
mov rsi, rdx
movzx ebx, r8b
mov r10d, eax
movdqa xmm5, xmmword [rdi]
shr rax, 0x10
movzx r9d, al
mov eax, r10d
shr rax, 0x18
pslldq xmm5, 4
movdqa xmm4, xmm5
pslldq xmm5, 4
movzx r11d, byte [r9 + rbp]
movzx eax, byte [rax + rbp]
pxor xmm4, xmmword [rdi]
shl eax, 8
or r11d, eax
mov eax, r10d
shr rax, 8
movzx ecx, al
shl r11d, 8
movzx eax, byte [rcx + rbp]
or r11d, eax
movzx eax, r10b
shl r11d, 8
movzx ecx, byte [rax + rbp]
movd eax, xmm0
or r11d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r11d
movzx r8d, byte [rcx + rbp]
movzx eax, byte [rax + rbp]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rbp]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rbp]
mov eax, r11d
ror eax, 8
or r8d, ecx
xor eax, ebx
mov edx, r8d
ror edx, 8
xor edx, ebx
movd xmm0, r8d
movd xmm2, eax
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, edx
pxor xmm0, xmm4
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pxor xmm0, xmm5
pshufd xmm1, xmm3, 0xff
pxor xmm1, xmm0
pshufd xmm0, xmm1, 0x55
movd eax, xmm0
movdqa xmmword [rdi], xmm1
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movzx r9d, byte [rcx + rbp]
movzx eax, byte [rax + rbp]
shl eax, 8
movdqa xmm5, xmmword [rsi]
or r9d, eax
mov rbx, qword [rsp + 8]
mov eax, edx
mov rdi, qword [rsp + 0x20]
shr rax, 8
movzx ecx, al
pshufd xmm0, xmm1, 0xff
shl r9d, 8
pslldq xmm5, 4
movzx eax, byte [rcx + rbp]
movdqa xmm4, xmm5
pxor xmm4, xmmword [rsi]
or r9d, eax
movzx eax, dl
shl r9d, 8
pslldq xmm5, 4
movzx ecx, byte [rax + rbp]
movd eax, xmm0
or r9d, ecx
mov edx, eax
shr rax, 0x10
movzx ecx, al
mov eax, edx
shr rax, 0x18
movd xmm3, r9d
movzx r8d, byte [rcx + rbp]
movzx eax, byte [rax + rbp]
shl eax, 8
or r8d, eax
mov eax, edx
shr rax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rbp]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx ecx, byte [rax + rbp]
mov rbp, qword [rsp + 0x10]
or r8d, ecx
mov eax, r8d
mov ecx, r9d
ror eax, 8
ror ecx, 8
movd xmm0, r8d
punpckldq xmm3, xmm0
movdqa xmm0, xmm5
movd xmm1, eax
pxor xmm0, xmm4
movd xmm2, ecx
punpckldq xmm2, xmm1
punpckldq xmm3, xmm2
pslldq xmm5, 4
pshufd xmm1, xmm3, 0xaa
pxor xmm0, xmm5
pxor xmm1, xmm0
movdqa xmmword [rsi], xmm1
mov rsi, qword [rsp + 0x18]
ret
Function at 0x1800589b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a8
mov rax, qword [0x1800824f0]
xor rax, rsp
mov qword [rsp + 0x190], rax
movsxd r13, r9d
mov r12d, edx
mov qword [rsp + 0x20], r8
mov r14, rcx
cmp r13d, 0xc8
jne 0x1800589f3
lea ebp, [r13 - 0x40]
jmp 0x1800589fd
mov ebp, 0x64
sub ebp, r13d
add ebp, ebp
mov eax, ebp
lea rcx, [rsp + 0x30]
cdq
mov r8d, 0xc8
and edx, 7
add eax, edx
xor edx, edx
sar eax, 3
movsxd rdi, eax
call sub.VCRUNTIME140.dll_memset
xor r15d, r15d
mov rsi, rdi
cmp r12d, ebp
jl 0x180058b14
movsxd rbx, ebp
nop
mov rax, r15
test edi, edi
jle 0x180058ac9
cmp edi, 4
jb 0x180058ac9
lea ecx, [rdi - 1]
movsxd rdx, ecx
lea r8, [rsp + 0x30]
lea rcx, [r14 + rdx*8]
lea r8, [r8 + rdx*8]
lea rdx, [rsp + 0x30]
cmp rdx, rcx
ja 0x180058a66
cmp r8, r14
jae 0x180058ac9
mov edx, edi
and edx, 0x80000003
jge 0x180058a77
dec edx
or edx, 0xfffffffc
inc edx
mov ecx, edi
sub ecx, edx
mov rdx, r14
movsxd r8, ecx
lea rcx, [rsp + 0x30]
sub rdx, rcx
nop dword [rax]
movdqu xmm0, xmmword [rsp + rax*8 + 0x30]
lea rcx, [rdx + rax*8]
movdqu xmm1, xmmword [rsp + rcx + 0x30]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax*8 + 0x30], xmm1
movdqu xmm0, xmmword [rsp + rax*8 + 0x40]
movdqu xmm1, xmmword [rsp + rcx + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax*8 + 0x40], xmm1
add rax, 4
cmp rax, r8
jl 0x180058a90
cmp rax, rsi
jge 0x180058af6
lea rcx, [rsp + 0x30]
mov r8, r14
sub r8, rcx
nop dword [rax]
lea rcx, [r8 + rax*8]
mov rdx, qword [rsp + rcx + 0x30]
xor qword [rsp + rax*8 + 0x30], rdx
inc rax
cmp rax, rsi
jl 0x180058ae0
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.180058c30
sub r12d, ebp
add r14, rbx
cmp r12d, ebp
jge 0x180058a30
movsxd rbx, r12d
lea rcx, [rsp + 0x100]
mov r8, rbx
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
mov eax, ebp
mov byte [rsp + rbx + 0x100], 1
inc r12d
lea rcx, [rsp + 0x100]
sub eax, r12d
xor edx, edx
movsxd r8, eax
movsxd rax, r12d
add rcx, rax
call sub.VCRUNTIME140.dll_memset
lea eax, [rbp - 1]
movsxd rcx, eax
or byte [rsp + rcx + 0x100], 0x80
mov ecx, r15d
test edi, edi
jle 0x180058bc5
cmp edi, 4
jb 0x180058bc5
mov eax, edi
and eax, 0x80000003
jge 0x180058b7c
dec eax
or eax, 0xfffffffc
inc eax
sub edi, eax
movsxd rax, edi
movdqu xmm0, xmmword [rsp + r15*8 + 0x30]
add ecx, 4
movdqu xmm1, xmmword [rsp + r15*8 + 0x100]
pxor xmm1, xmm0
movdqu xmmword [rsp + r15*8 + 0x30], xmm1
movdqu xmm0, xmmword [rsp + r15*8 + 0x40]
movdqu xmm1, xmmword [rsp + r15*8 + 0x110]
pxor xmm1, xmm0
movdqu xmmword [rsp + r15*8 + 0x40], xmm1
add r15, 4
cmp r15, rax
jl 0x180058b81
movsxd r8, ecx
cmp r8, rsi
jge 0x180058be5
nop dword [rax]
mov rax, qword [rsp + r8*8 + 0x100]
xor qword [rsp + r8*8 + 0x30], rax
inc r8
cmp r8, rsi
jl 0x180058bd0
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.180058c30
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.180060dd0
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret