joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x60], 0
jne 0x180003c11
xor eax, eax
jmp 0x180003e24
mov dword [rsp + 0x24], 0x522d6f4e
mov dword [rsp + 0x28], 0xb0000b9
mov dword [rsp + 0x2c], 0x6174535c
mov dword [rsp + 0x30], 0x20736968
mov dword [rsp + 0x34], 0x89182444
mov dword [rsp + 0x38], 0xe801e283
mov dword [rsp + 0x3c], 0xc35b5d5f
mov r8d, dword [rsp + 0x24]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003b90
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003c89
mov eax, dword [rsp + 0x58]
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.180003b00
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 6
jmp 0x180003e24
mov r8d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003b90
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003cc9
mov eax, dword [rsp + 0x58]
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.180003b00
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 7
jmp 0x180003e24
mov r8d, dword [rsp + 0x2c]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003b90
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003d09
mov eax, dword [rsp + 0x58]
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.180003b00
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 8
jmp 0x180003e24
mov r8d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003b90
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003d5d
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
add rdx, rcx
mov rcx, rdx
mov edx, eax
call fcn.180003b00
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 9
jmp 0x180003e24
cmp dword [rsp + 0x58], 0x185d
jbe 0x180003e1f
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003b90
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003da7
mov edx, 0x185d
mov rcx, qword [rsp + 0x50]
call fcn.180003b00
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 0xa
jmp 0x180003e24
mov r8d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003b90
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003de3
mov edx, 0x1810
mov rcx, qword [rsp + 0x50]
call fcn.180003b00
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 0xb
jmp 0x180003e24
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003b90
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003e1f
mov edx, 0x1810
mov rcx, qword [rsp + 0x50]
call fcn.180003b00
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 0xb
jmp 0x180003e24
mov eax, 1
add rsp, 0x48
ret
Function at 0x1800047e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1800e0020]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x18000484c
xor eax, eax
jmp 0x180004993
mov qword [rsp + 0x80], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.1800049b0
test eax, eax
jne 0x180004893
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x41]
call fcn.180004a10
xor eax, eax
jmp 0x180004993
cmp qword [rsp + 0xb8], 0
je 0x1800048b1
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x80]
mov qword [rax], rcx
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x4c], 0x3000
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x42]
call fcn.180004580
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x180004904
xor eax, eax
jmp 0x180004993
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x18000497f
mov dword [rsp + 0x54], 0x8000
mov dword [rsp + 0x58], 0
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x43]
call fcn.1800046a0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x44]
call fcn.180004a10
xor eax, eax
jmp 0x180004993
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x45]
call fcn.180004a10
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800c95f0
add rsp, 0xa8
ret

Function at 0x180007730
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1800e0020]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.180003ab0
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180003940
lea rcx, [rsp + 0x30]
call fcn.1800039b0
movzx eax, al
test eax, eax
je 0x1800077c7
lea rcx, [rsp + 0x30]
call fcn.1800039f0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1800077c7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180003a10
mov rcx, rax
call fcn.180007eb0
cmp eax, 0x3285501
jne 0x1800077c5
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180003a50
jmp 0x1800077de
jmp 0x18000777f
lea rcx, [rsp + 0x28]
call fcn.180003ad0
movzx eax, al
test eax, eax
jne 0x18000774d
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c95f0
add rsp, 0x58
ret
Function at 0x180007bb0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1800e0020]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.180003ab0
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180003940
lea rcx, [rsp + 0x30]
call fcn.1800039b0
movzx eax, al
test eax, eax
je 0x180007c47
lea rcx, [rsp + 0x30]
call fcn.1800039f0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x180007c47
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180003a10
mov rcx, rax
call fcn.180007eb0
cmp eax, 0xfaba0065
jne 0x180007c45
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180003a50
jmp 0x180007c5e
jmp 0x180007bff
lea rcx, [rsp + 0x28]
call fcn.180003ad0
movzx eax, al
test eax, eax
jne 0x180007bcd
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c95f0
add rsp, 0x58
ret

Function at 0x18000cf00
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1800e0020]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.180003ab0
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180003940
lea rcx, [rsp + 0x30]
call fcn.1800039b0
movzx eax, al
test eax, eax
je 0x18000cf97
lea rcx, [rsp + 0x30]
call fcn.1800039f0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x18000cf97
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180003a10
mov rcx, rax
call fcn.180007eb0
cmp eax, 0x2fa62ca8
jne 0x18000cf95
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180003a50
jmp 0x18000cfae
jmp 0x18000cf4f
lea rcx, [rsp + 0x28]
call fcn.180003ad0
movzx eax, al
test eax, eax
jne 0x18000cf1d
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c95f0
add rsp, 0x58
ret

Function at 0x18000e930
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1800e0020]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.180003ab0
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180003940
lea rcx, [rsp + 0x30]
call fcn.1800039b0
movzx eax, al
test eax, eax
je 0x18000e9c7
lea rcx, [rsp + 0x30]
call fcn.1800039f0
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x18000e9c7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180003a10
mov rcx, rax
call fcn.180007eb0
cmp eax, 0x820621f3
jne 0x18000e9c5
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180003a50
jmp 0x18000e9de
jmp 0x18000e97f
lea rcx, [rsp + 0x28]
call fcn.180003ad0
movzx eax, al
test eax, eax
jne 0x18000e94d
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c95f0
add rsp, 0x58
ret
Function at 0x180017700
Capabilities:
Enumerate pe sections

Disassembly:
push rdi
sub rsp, 0x80
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x20]
movzx r8d, byte [rsp + 0x21]
movzx edx, byte [rsp + 0x24]
lea rcx, [rsp + 0x60]
call fcn.1800178c0
mov rcx, rax
call fcn.1800184b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x18001776b
xor eax, eax
jmp 0x1800178b6
mov rcx, qword [rsp + 0x30]
call fcn.1800176a0
mov dword [0x180cc28e0], eax
cmp dword [0x180cc28e0], 0
jne 0x18001778b
xor eax, eax
jmp 0x1800178b6
mov dword [rsp + 0x50], 0x5f000000
cmp dword [0x180cc28e0], 0x5f000000
ja 0x1800177a6
xor eax, eax
jmp 0x1800178b6
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800177c6
xor eax, eax
jmp 0x1800178b6
mov rax, qword [rsp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 0
jmp 0x18001780b
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x28], eax
jae 0x1800178b4
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x22]
movzx r8d, byte [rsp + 0x23]
movzx edx, byte [rsp + 0x25]
lea rcx, [rsp + 0x70]
call fcn.1800178f0
mov rcx, rax
call fcn.180018470
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x180017883
inc rcx
test dl, dl
jne 0x180017870
xor eax, eax
jmp 0x180017888
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1800178a1
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
jmp 0x1800178b6
mov rax, qword [rsp + 0x38]
add rax, 0x28
mov qword [rsp + 0x38], rax
jmp 0x180017801
xor eax, eax
add rsp, 0x80
pop rdi
ret
Function at 0x18003cf20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
test eax, eax
je 0x18003cf51
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.18003c550
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jle 0x18003cfac
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
shr eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
sub eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x10], eax
jmp 0x18003cf59
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jge 0x18003cfc8
lea rcx, [0x1800d0158]
call fcn.18002fce0
jmp 0x18003d10c
cmp dword [rsp + 0x20], 4
jge 0x18003cfee
mov rcx, qword [rsp + 0x50]
call fcn.18003c440
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x18003cfc8
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 0
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 1
imul rax, rax, 3
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
xor eax, 0xffff
cmp dword [rsp + 0x2c], eax
je 0x18003d05e
lea rcx, str.zlib_corrupt
call fcn.18002fce0
jmp 0x18003d10c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 8]
jbe 0x18003d087
lea rcx, str.read_past_buffer
call fcn.18002fce0
jmp 0x18003d10c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x28]
jbe 0x18003d0c0
mov r8d, dword [rsp + 0x24]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
call fcn.18003c7e0
test eax, eax
jne 0x18003d0c0
xor eax, eax
jmp 0x18003d10c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rdx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x18004e7c0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1800d1110]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x18004e84e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x18004e7f2
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x18004e860
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1800d1110]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x18004e964
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x18004e95f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x18004e934
cmp qword [rsp + 0x38], 2
jb 0x18004e934
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004e934
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004e934
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18004e8a7
jmp 0x18004e9f6
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x18004e9f6
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x18004e9cc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004e9cc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004e9cc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18004e964
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x180099eb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1800e0020]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [0x180cc28f8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x1988]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x1990]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
call fcn.180012430
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
cmp qword [rsp + 0x30], rax
jae 0x180099fff
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x180099fc1
movss xmm1, dword [rsp + 0x20]
movss xmm0, dword [rsp + 0x60]
call fcn.18006f3d0
movss dword [rsp + 0x60], xmm0
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0xa8]
test eax, eax
je 0x180099fbf
jmp 0x180099fff
jmp 0x180099f43
cmp dword [rsp + 0x28], 0xd
jne 0x180099fcd
jmp 0x180099f43
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.1800902c0
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x180099f43
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rsp + 0x60]
jbe 0x18009a018
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x60], xmm0
cmp qword [rsp + 0xa0], 0
je 0x18009a050
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.180012430
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa0]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x1800d9084]
ja 0x18009a070
movss xmm0, dword [rsp + 0x64]
ucomiss xmm0, dword [0x1800d9084]
jp 0x18009a082
jne 0x18009a082
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x64], xmm0
cmp qword [rsp + 0x98], 0
je 0x18009a09d
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800c95f0
add rsp, 0x78
ret
Function at 0x1800b9d30
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [0x180cc2db8]
call fcn.180003900
mov qword [rsp + 0x30], rax
mov rcx, qword [0x180cc2db8]
call fcn.180003900
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0
jmp 0x1800b9d8c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rcx, qword [0x180cc2db8]
call fcn.180003900
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x1800b9e2c
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x68]
call fcn.18000f260
mov rcx, qword [rsp + 0x40]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x1800b9dee
inc rcx
test dl, dl
jne 0x1800b9ddb
xor eax, eax
jmp 0x1800b9df3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1800b9e27
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [0x180cc2db8]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov al, 1
jmp 0x1800b9e2e
jmp 0x1800b9d82
xor al, al
add rsp, 0x58
ret

Function at 0x1800c95d0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x50
syscall
ret

Function at 0x180ce209f
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], 0x5f4318d9
lea rsp, [rsp + 0x10]
call fcn.180dd7f67
push r15
movabs r15, 0x748db9b30619eb8a
push r8
pushfq
test r15w, 0xb611
jg 0x180e398f8
sub r15, r15
mov qword [rsp + 0x18], 0x6a1564fe
mov r15, qword [rsp + r15 + 0x10]
movabs r8, 0xaf165a12b8314603
xor r8b, 0x9d
movzx r8, r8w
shl r8d, 1
not r8
jo 0x180ce20c6
call fcn.180cd39c7
call 0x180ce209f
outsb dx, byte [rsi]
push r8
push rcx
movabs rcx, 0x730d4eb8941ae885
pushfq
xor cl, 0x39
push 0xffffffffe732323e
mov qword [rsp + 0x18], 0xffffffffdb84b52b
mov rcx, qword [rsp + 0x10]
xor dword [rsp], 0xb912df8a
call fcn.1800b8846
wait
push r9
pushfq
movabs r9, 0x86b73d00af89df98
and r9w, 0x85b0
bswap r9d
mov r9, qword [rsp + 8]
mov qword [rsp + 8], 0xffffffffcc9975fa
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.180de347a
cmp eax, ebp
xlatb
mov cl, 0xe9
call qword [rdx + 0x57]
push rbp
push r13
movabs r13, 0x350aebb4a99657a1
push rcx
pushfq
movabs rbp, 0x2385f30b22994b22
add r13, rbp
mov qword [rsp + 0x20], 0xffffffffd75caee3
mov r13, qword [rsp + 0x10]
and bp, 0x542e
popfq
call fcn.180cf89ba
add dword [rcx + 0x50], 0x17b8499c
cdq
invalid