joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180050d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
lea ebp, [rdx + 4]
mov rsi, r8
mov edi, edx
mov r14, rcx
cmp edx, ebp
jae 0x180050f7e
xor ebx, ebx
lea r15, [0x1800df560]
lea r13, [0x1800dfd60]
lea r12d, [rbx + 1]
nop
mov eax, edi
sub eax, 0x8d
je 0x180050f12
sub eax, 4
je 0x180050f62
sub eax, 4
je 0x180050efa
cmp eax, 4
jne 0x180050eeb
mov r11d, 0x80000000
mov dword [0x1800df560], ebx
mov r10d, r12d
nop word [rax + rax]
mov ecx, r11d
lea eax, [r11 + r11]
sar ecx, 0x1f
and ecx, 0x1edc6f41
mov r11d, ecx
xor r11d, eax
mov eax, ebx
test r10d, r10d
je 0x180050e29
mov r9, r15
mov r8d, dword [r9]
lea ecx, [rax + r10]
xor r8d, r11d
lea r9, [r9 + 4]
inc eax
mov dword [r15 + rcx*4], r8d
cmp eax, r10d
jb 0x180050e10
add r10d, r10d
cmp r10d, 0x100
jb 0x180050df0
mov r8, r13
mov r9d, 0x100
nop
mov ecx, dword [r8 - 0x800]
lea r8, [r8 + 4]
mov eax, ecx
shl ecx, 8
shr rax, 0x18
mov edx, dword [r15 + rax*4]
xor edx, ecx
mov dword [r8 - 0x404], edx
mov eax, edx
shr rax, 0x18
shl edx, 8
mov ecx, dword [r15 + rax*4]
xor ecx, edx
mov dword [r8 - 4], ecx
mov eax, ecx
shr rax, 0x18
shl ecx, 8
mov edx, dword [r15 + rax*4]
xor edx, ecx
mov dword [r8 + 0x3fc], edx
mov eax, edx
shr rax, 0x18
shl edx, 8
mov ecx, dword [r15 + rax*4]
xor ecx, edx
mov dword [r8 + 0x7fc], ecx
mov eax, ecx
shr rax, 0x18
shl ecx, 8
mov edx, dword [r15 + rax*4]
xor edx, ecx
mov dword [r8 + 0xbfc], edx
mov eax, edx
shr rax, 0x18
shl edx, 8
mov ecx, dword [r15 + rax*4]
xor ecx, edx
mov dword [r8 + 0xffc], ecx
mov eax, ecx
shr rax, 0x18
shl ecx, 8
mov eax, dword [r15 + rax*4]
xor eax, ecx
mov dword [r8 + 0x13fc], eax
sub r9, r12
jne 0x180050e40
inc edi
cmp edi, ebp
jb 0x180050db0
jmp 0x180050f7e
test byte [rsi + 0x60], 0x80
je 0x180050f0a
mov ebx, dword [rsi + 0x150]
shl rbx, 0x20
mov eax, dword [rsi + 4]
or rax, rbx
jmp 0x180050f83
mov r8d, 0x114
movabs r9, 0x8888888888888889
mov eax, r8d
sub eax, 0x113
je 0x180050f7e
cmp eax, r12d
jne 0x180050f56
mov rcx, rsi
mov rax, r9
sub rcx, r14
imul rcx
add rdx, rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmove rdx, r12
mov dword [rsp + 0x48], edx
dec r8d
cmp r8d, 0x112
ja 0x180050f22
mov rax, qword [rsi]
mov rdx, qword [rax + 0x20]
mov rax, qword [r14]
mov ecx, dword [rdx + 0x14]
sub rax, rcx
mov ecx, dword [rdx + 0x20]
xor edx, edx
div rcx
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180057620
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbx
push r14
sub rsp, 0x68
lea r9d, [rdx + 0x1ff]
mov rbx, r8
mov dword [rsp + 0x88], r9d
mov r14, rcx
cmp edx, r9d
jae 0x180057827
mov qword [rax - 0x18], rbp
mov ebp, dword [rsp + 0x88]
mov qword [rax - 0x20], rsi
mov esi, dword [rsp + 0x88]
mov qword [rax - 0x28], rdi
mov edi, dword [rsp + 0x88]
mov qword [rax - 0x30], r12
mov r12d, dword [rsp + 0x88]
mov qword [rax - 0x38], r13
mov r13, qword [rsp + 0x98]
mov qword [rax - 0x40], r15
mov r15d, dword [rsp + 0x88]
nop word [rax + rax]
cmp edx, 0x12e
ja 0x180057776
je 0x180057750
mov eax, edx
sub eax, 0xa3
je 0x180057748
sub eax, 0x42
je 0x180057739
cmp eax, 7
jne 0x1800577fd
mov ecx, dword [rbx]
sub ecx, 0xbab106
je 0x18005772b
cmp ecx, 1
je 0x180057719
lea r9, str.Nvda.Messaging.CoIpcMessenger.MessagingThread
xor edx, edx
lea r8, [0x1800caf84]
lea rcx, [0x1800c80fb]
call fcn.1800ab460
xor r8d, r8d
xor edx, edx
mov ecx, 0x107
call fcn.180061e00
mov r9d, dword [rsp + 0x88]
mov edx, 0xec
jmp 0x1800577fd
mov rax, qword [r13 + 0x50]
mov edx, 0xec
mov qword [rax + 0x38], r14
jmp 0x1800577fd
mov qword [r13 + 0x38], r14
mov edx, 0xec
jmp 0x1800577fd
mov edi, dword [rbx]
xor ebp, ebp
mov esi, dword [rbx + 4]
mov r12d, dword [r14]
jmp 0x1800577fd
mov r13, rbx
jmp 0x1800577fd
mov eax, dword [r14 + 4]
mov r15d, 0x10
mov dword [rsp + 0x98], eax
mov eax, dword [r14 + 8]
mov dword [rsp + 0x20], eax
mov eax, dword [r14 + 0xc]
mov dword [rsp + 0x24], eax
jmp 0x1800577fd
mov eax, edx
sub eax, 0x177
je 0x180057792
sub eax, 0x49
je 0x18005778e
cmp eax, 0x49
jne 0x1800577fd
add dword [rbx + 4], esi
jmp 0x1800577fd
add dword [rbx], edi
jmp 0x1800577fd
mov r14d, dword [rsp + 0x98]
mov r8d, dword [rsp + 0x20]
mov ebx, dword [rsp + 0x24]
nop dword [rax]
nop word [rax + rax]
add ebp, 0x9e3779b9
mov ecx, esi
shr ecx, 5
mov eax, esi
add ecx, r14d
shl eax, 4
add eax, r12d
xor ecx, eax
lea eax, [rsi + rbp]
xor ecx, eax
add edi, ecx
mov ecx, edi
mov eax, edi
shr ecx, 5
shl eax, 4
add ecx, ebx
add eax, r8d
xor ecx, eax
lea eax, [rdi + rbp]
xor ecx, eax
add esi, ecx
sub r15d, 1
jne 0x1800577b0
mov rbx, qword [rsp + 0x90]
mov r14, qword [rsp + 0x80]
add edx, 0x49
cmp edx, r9d
jb 0x1800576a0
mov r15, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
pop r14
pop rbx
ret
Function at 0x1800684a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1800dbea8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebx, dword [rsp + 0x30]
lea ebp, [rdx - 0xa]
mov r14, r8
mov edi, edx
mov r13, rcx
cmp edx, ebp
jbe case.0x180068503.0
mov r12, qword [rsp + 0x40]
lea esi, [rdx - 0x18]
mov r15, qword [rsp + 0x40]
lea rdx, [0x180000000]
nop
cmp esi, 0x15
ja case.0x180068503.2
mov ecx, dword [rdx + rsi*4 + 0x68720]
add rcx, rdx
jmp rcx
lea rcx, str.InternalStop
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r12, rax
jmp 0x1800686fe
mov rcx, qword [0x1800dd548]
test rcx, rcx
je 0x180068531
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
jmp 0x1800686fe
mov dword [0x1800dd504], 0x8000
jmp case.0x180068503.2
test r15, r15
je case.0x180068503.2
lea rdx, [0x1800cbb20]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x1800dd548], rax
jmp 0x1800686fe
mov eax, dword [r13]
lea r8, [rsp + 0x48]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x30]
mov rax, qword [r14]
xor r9d, r9d
mov ecx, 0x8f
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], 0
call fcn.180086a80
mov ebx, eax
jmp 0x1800686fe
cmp qword [0x1800dd548], 0
jne case.0x180068503.2
lea rdx, [0x1800cbb20]
lea rcx, str._dev_tty
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x1800dd548], rax
jmp 0x1800686fe
mov eax, dword [r13]
lea r9, [rsp + 0x30]
xor edx, edx
lea r8, [rsp + 0x38]
div dword [r14 + 0x60]
mov rcx, r14
xor ebx, ebx
lea edx, [rdx*4 + 0xac]
mov dword [rsp + 0x30], edx
mov edx, 0xe6
call fcn.1800b29a0
cmp eax, 0xffffffff
je 0x180068716
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x1800686fe
nop dword [rax]
mov r9, r14
mov dword [rsp + 0x30], eax
mov r8d, 0x29
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1800b2b50
cmp eax, 0xffffffff
je 0x180068716
cmp dword [rsp + 0x64], 0xfee1dead
jne 0x180068641
inc ebx
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x38], eax
test eax, eax
jne 0x180068610
jmp 0x1800686fe
test dword [0x1800dd504], 0x8000
je case.0x180068503.2
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800c0ae0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test r12, r12
je 0x1800686c4
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
mov dword [0x1800dd504], eax
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
jne 0x1800686ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0
je 0x1800686c4
mov dword [0x1800dd504], 0
mov eax, dword [0x1800dd504]
bts eax, 0xf
mov dword [0x1800dd504], eax
cmp eax, 0x8000
je case.0x180068503.0
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
lea rcx, str.shld_m32_r32_imm8
mov r8d, 0x103
call fcn.1800ad430
mov r15, rax
lea rdx, [0x180000000]
dec edi
dec esi
cmp edi, ebp
ja 0x1800684f0
jmp case.0x180068503.0
xor eax, eax
jmp 0x180068664
Function at 0x18006a860
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rdi, r9
lea esi, [r8 + 9]
xor r9d, r9d
mov r12, rdx
mov qword [rsp + 0x58], r9
mov rdx, rcx
mov qword [rsp + 0x60], r9
cmp r8d, esi
jae case.0x18006a8d4.13
mov r14, qword [rsp + 0x50]
lea ebx, [r8 - 0x80]
mov rbp, qword [rsp + 0x50]
lea r8, [0x180000000]
mov r13d, dword [rsp + 0xc0]
mov r15, qword [rsp + 0x50]
nop
cmp ebx, 0x13
ja case.0x18006a8d4.2
mov ecx, dword [r8 + rbx*4 + 0x6aa60]
add rcx, r8
jmp rcx
cmp r14, rbp
je case.0x18006a8d4.2
mov qword [rsp + 0x38], r9
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x30], 0xc7
xor r8d, r8d
mov qword [rsp + 0x28], r9
xor edx, edx
mov qword [rsp + 0x20], r9
xor r9d, r9d
call fcn.180059440
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [rax]
jmp 0x18006aa48
mov ebp, dword [rdi + 0x50]
lea r9, [rsp + 0x40]
mov r13d, dword [rdi]
lea r8, [rsp + 0x48]
shl rbp, 3
xor edx, edx
mov ecx, 0x102
mov dword [rsp + 0x40], ebp
call fcn.18007a8d0
test eax, eax
jne 0x18006aa48
mov rdx, qword [rsp + 0xb0]
lea r8, [0x180000000]
xor r9d, r9d
jmp case.0x18006a8d4.2
mov eax, dword [rdx]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x50]
mov rax, qword [rdi]
mov r9d, 0x8c
mov rdx, qword [rax + 0x38]
mov qword [rsp + 0x50], rax
call fcn.180091000
movzx ecx, word [r12]
lea r8, [0x180000000]
mov rdx, qword [rsp + 0xb0]
mov r15, rax
xor r9d, r9d
mov word [rax + 0x10], cx
jmp case.0x18006a8d4.2
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x58], rax
mov dword [rsp + 0xc0], r9d
jmp case.0x18006a8d4.2
mov rax, qword [rdi]
mov rcx, qword [rax + 0x20]
test byte [rcx + 0x60], 0x80
je case.0x18006a8d4.2
movzx eax, word [r12 + 2]
mov word [r15 + 0x30], ax
jmp case.0x18006a8d4.2
mov rdx, qword [rsp + 0x48]
mov r8d, ebp
mov ecx, r13d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
mov rdx, qword [rsp + 0xb0]
lea r8, [0x180000000]
movsxd r14, eax
xor r9d, r9d
jmp case.0x18006a8d4.2
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
jb 0x18006aa01
mov rax, qword [rdi]
mov qword [rsp + 0x58], rax
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x60], rax
inc ebx
lea eax, [rbx + 0x80]
cmp eax, esi
jb 0x18006a8c0
jmp case.0x18006a8d4.13
mov qword [rsp + 0x20], r9
xor r8d, r8d
lea r9, [rsp + 0x58]
mov edx, 0x100
xor ecx, ecx
call fcn.180037340
mov byte [rsp + 0xc0], al
mov eax, dword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800752d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
lea ebp, [rdx + 7]
mov rdi, r8
mov r14, rcx
cmp edx, ebp
jae 0x1800753f5
mov rsi, qword [rsp + 0x78]
lea ebx, [rdx - 0xee]
mov rdx, qword [rsp + 0x78]
lea r15, [0x180000000]
cmp ebx, 0x15
ja case.0x180075318.1
mov ecx, dword [r15 + rbx*4 + 0x7540c]
add rcx, r15
jmp rcx
mov qword [0x1800dbf88], rdi
lea r8, [0x180043b00]
mov qword [rsp + 0x28], 0
mov r9, rdi
xor edx, edx
mov qword [rdi + 0x80], r14
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
jmp case.0x180075318.1
mov eax, dword [rdi]
movzx ecx, byte [rsi]
and eax, 7
bts ecx, eax
mov byte [rsi], cl
jmp case.0x180075318.1
test rdx, rdx
je 0x180075389
mov rax, rdx
xchg qword [0x1800dbf90], rax
jmp case.0x180075318.1
mov esi, dword [rdi]
shr rsi, 3
add rsi, r14
inc ebx
lea eax, [rbx + 0xee]
cmp eax, ebp
jb 0x180075308
jmp 0x1800753f5
mov byte [rsp + 0x68], 0
jmp 0x1800753f5
mov rax, qword [rdi]
lea r8, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0x78], rax
mov rdx, r14
mov ecx, 0x109
call fcn.180035fd0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rdi]
cmp dword [rcx], 0x7f2bb70f
je 0x1800753dc
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rcx + 0x10]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0x68], 1
mov eax, dword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18007ce20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x60
imul r15d, ecx, 0x2a7
mov rdi, r9
movaps xmmword [rsp + 0x50], xmm6
mov r14, r8
movaps xmmword [rsp + 0x40], xmm7
mov rsi, rdx
mov ebp, ecx
mov ebx, ecx
cmp ecx, r15d
ja 0x18007d00f
movsd xmm7, qword [0x1800d3df8]
xor r12d, r12d
movsd xmm0, qword [0x1800e2ab0]
xorps xmm6, xmm6
nop dword [rax + rax]
cmp ebx, 0x3cde
ja 0x18007cf3c
je 0x18007d002
mov eax, ebx
sub eax, 0x9f
je 0x18007cebd
sub eax, 0x4d
je 0x18007cfd1
cmp eax, 0xd
jne 0x18007cfc1
movsd qword [0x1800e2ab0], xmm6
movaps xmm0, xmm6
jmp 0x18007cfc1
mov rcx, qword [rsi]
mov rax, qword [rcx + 0x20]
test byte [rax + 0x64], 8
je 0x18007ced9
test dword [r14 + 0x20], 0x40000
je 0x18007ced9
mov rdx, qword [rdi]
jmp 0x18007ceed
mov eax, dword [rcx + 0x28]
mov rdx, qword [rdi]
shr rax, 9
imul rdx, rax
mov qword [rdi], rdx
mov rcx, qword [rsi]
mov ecx, dword [rcx + 0xb8]
mov eax, 1
shl eax, cl
movsxd rcx, eax
imul rcx, rdx
mov qword [rdi], rcx
mov dword [r14 + 0x1c], ecx
mov rax, qword [rsi]
mov rdx, qword [rdi]
shr rdx, 0x20
mov rcx, qword [rax + 0x20]
test byte [rcx + 0x64], 8
je 0x18007cf26
mov word [r14 + 0x74], dx
jmp 0x18007cfc1
test rdx, rdx
je 0x18007cfc1
mov dword [rsp + 0x30], 0x84
jmp 0x18007d00f
cmp ebx, 0x5f52
je 0x18007cf62
cmp ebx, 0xbdab
je 0x18007cf5a
cmp ebx, 0x11c04
je 0x18007d00f
jmp 0x18007cfc1
movsd qword [rsp + 0x30], xmm0
jmp 0x18007cfc1
ucomisd xmm0, xmm6
jp 0x18007d009
jne 0x18007d009
lea rcx, str.V1408_DeltaInt
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x18007cfb6
cmp byte [rax], r12b
je 0x18007cfb6
mov qword [rsp + 0x28], r12
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x117
call fcn.180085f30
mov qword [0x1800e2ab0], rax
movsd xmm0, qword [0x1800e2ab0]
jmp 0x18007cfc1
movsd qword [0x1800e2ab0], xmm7
movaps xmm0, xmm7
imul eax, ebp, 0x61
add ebx, eax
cmp ebx, r15d
jbe 0x18007ce80
jmp 0x18007d00f
mov edx, dword [r14]
test edx, edx
je 0x18007d002
mov rax, qword [rsi + 0x130]
mov r9d, 2
mov qword [rsp + 0x28], 1
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call qword [rax + 0x28]
mov dword [rsp + 0x30], eax
jmp 0x18007d00f
mov dword [rsp + 0x30], r12d
jmp 0x18007d00f
movsd qword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x30]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180088890
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x1800dbea8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov ebx, dword [rsp + 0x20]
mov r14, rdx
imul r12d, ecx, 0x5c0
mov ebp, ecx
mov esi, ecx
cmp ecx, r12d
ja 0x1800889b0
mov r15, qword [rsp + 0x20]
nop dword [rax + rax]
cmp esi, 0x601d
ja 0x180088951
je 0x1800889b0
mov eax, esi
sub eax, 0x85
je 0x180088928
sub eax, 0x18
je 0x180088921
sub eax, 4
je 0x180088918
cmp eax, 0x3e
jne 0x18008899f
mov rcx, qword [r14 + 0x10]
call fcn.1800c05d0
jmp 0x18008899f
mov r15, qword [r14]
add r15, 0x78
jmp 0x18008899f
mov ebx, dword [r14]
bswap ebx
jmp 0x18008899f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__getpid]
mov r8d, eax
lea rdx, str.__kernel_void_arithm_binary_op_mat_mask___global_T__src1__int_src1_step__int_src1_offset_
lea rcx, [rsp + 0x30]
call fcn.1800c0420
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ebx, eax
jmp 0x18008899f
cmp esi, 0x7175
je 0x1800889b0
cmp esi, 0xe811
jne 0x18008899f
mov rdi, qword [r14]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [r15]
lea rdx, str.__1CvBlobDetector__UAE_XZ
mov r8, qword [rdi + 0x48]
mov rcx, rax
call fcn.1800c02b0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
lea rdx, str.PxdFluidGetQuat:_Fluidhas_no_property_of_type_Quat
call fcn.1800c02b0
imul eax, ebp, 0xb8
add esi, eax
cmp esi, r12d
jbe 0x1800888e0
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800c0ae0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800aea80
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov edi, dword [rsp + 0xb8]
lea r15d, [r9 + 0xa]
mov rsi, r8
mov r14, rcx
cmp r9d, r15d
jae case.0x1800aeaeb.8
mov r13, qword [rsp + 0x50]
lea ebp, [r9 - 0xc2]
mov r12, qword [rsp + 0x50]
lea rdx, [0x180000000]
xor ebx, ebx
nop dword [rax]
cmp ebp, 0x1e
ja case.0x1800aeaeb.10
movzx eax, byte [rdx + rbp + 0xaecdc]
mov ecx, dword [rdx + rax*4 + 0xaecb0]
add rcx, rdx
jmp rcx
mov rax, qword [r14]
mov r13, qword [rax + 0x18]
mov eax, dword [rsi]
cmp eax, dword [r13 + 4]
ja 0x1800aec14
lea rcx, [rax + rax*2]
mov rax, qword [r13 + 8]
cmp dword [rax + rcx*4], ebx
jne case.0x1800aeaeb.10
mov eax, 2
jmp 0x1800aebfc
cmp byte [rsi], 0x21
jne case.0x1800aeaeb.10
movsxd rcx, dword [r14]
mov rax, qword [0x1800dd4e8]
mov rcx, qword [rax + rcx*8]
test byte [rcx + 0x50], 1
je 0x1800aec1b
mov eax, 0xb6d0a
jmp 0x1800aebfc
mov edi, ebx
jmp case.0x1800aeaeb.10
mov eax, dword [r14]
lea r8, [rsp + 0x30]
mov r9d, 0xf4
mov dword [rsp + 0xb8], eax
lea rdx, [rsp + 0xb8]
mov rcx, rsi
call fcn.1800afbd0
mov r12, rax
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1800aec35
mov dword [rsp + 0x38], eax
lea r9, [rsp + 0x38]
mov eax, dword [r14]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov ecx, 0xfb
call fcn.18008b420
mov dword [rsp + 0x48], eax
jmp 0x1800aebe2
movzx eax, byte [rsi]
cmp al, 0x20
je 0x1800aebbb
cmp al, 9
jne case.0x1800aeaeb.10
inc rsi
jmp case.0x1800aeaeb.0
mov eax, dword [rsi]
mov rdx, qword [rsp + 0xc0]
lea rcx, [rax + rax*2]
mov rax, qword [r13 + 8]
movsd xmm0, qword [rax + rcx*4]
movsd qword [rdx], xmm0
mov eax, dword [rax + rcx*4 + 8]
mov dword [rdx + 8], eax
lea rdx, [0x180000000]
inc ebp
lea eax, [rbp + 0xc2]
cmp eax, r15d
jb 0x1800aead0
mov eax, edi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0x7f2bb747
jmp 0x1800aebfc
lea rcx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jns 0x1800aec31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
mov eax, ebx
jmp 0x1800aebfc
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
jmp 0x1800aebfc
xor eax, eax
lock cmpxchg dword [r14 + 0xc], ebx
jmp 0x1800aebfc
mov rax, qword [rsp + 0xc0]
lea rdx, [rsp + 0x48]
mov r9, qword [rsp + 0xa8]
lea rcx, [rsp + 0xb8]
mov r8d, 0xe1
mov eax, dword [rax]
mov dword [rsp + 0xb8], eax
mov rax, qword [rsi]
mov qword [rsp + 0x50], rax
mov rax, qword [r14]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.180064cf0
jmp 0x1800aebfc
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [rsp + 0x48]
jmp 0x1800aebfc
Function at 0x1800b6b10
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
mov r10, rcx
lea edx, [r8 + 0x540]
cmp r8d, edx
jae 0x1800b6ceb
movsd xmm0, qword [rsp + 0x48]
xor edi, edi
movsd xmm1, qword [rsp + 0x48]
movabs r11, 0x3ff0000000000000
movsd xmm2, qword [rsp + 0x48]
movsd xmm3, qword [rsp + 0x48]
nop dword [rax]
nop dword [rax + rax]
cmp r8d, 0xd9
ja 0x1800b6c1d
je 0x1800b6ceb
cmp r8d, 0x13
je 0x1800b6c6a
cmp r8d, 0x19
je 0x1800b6b99
cmp r8d, 0xc8
jne 0x1800b6c4b
mov dword [rsp + 0x70], edi
jmp 0x1800b6c4b
mov eax, dword [r9]
test eax, eax
je 0x1800b6c12
dec eax
mov ecx, 0x91
mov dword [r9], eax
nop word [rax + rax]
mov eax, ecx
sub eax, 0x8d
je 0x1800b6bfb
sub eax, 1
je 0x1800b6bf1
sub eax, 1
je 0x1800b6be3
sub eax, 1
je 0x1800b6bd9
cmp eax, 1
jne 0x1800b6bff
movsd xmm0, qword [rbx]
movaps xmm1, xmm0
movaps xmm2, xmm0
jmp 0x1800b6bff
movsd qword [r10], xmm1
movaps xmm3, xmm0
jmp 0x1800b6bff
movsd qword [r10 + 8], xmm2
movsd qword [r10 + 0x10], xmm3
jmp 0x1800b6bff
mov qword [r10 + 0x18], r11
add rbx, 8
jmp 0x1800b6bff
add r10, 0x20
dec ecx
cmp ecx, 0x8c
ja 0x1800b6bb0
mov eax, dword [r9]
test eax, eax
jne 0x1800b6ba0
mov eax, edi
dec eax
mov dword [r9], eax
mov dword [rsp + 0x70], eax
jmp 0x1800b6c4b
mov eax, r8d
sub eax, 0x10a
je 0x1800b6c3b
sub eax, 0x7e
je 0x1800b6ceb
cmp eax, 0x42
je 0x1800b6ceb
jmp 0x1800b6c4b
mov eax, dword [rbx]
mov ecx, edi
sub eax, dword [r10]
test eax, eax
setg cl
mov dword [rsp + 0x70], ecx
add r8d, 0xc0
cmp r8d, edx
jb 0x1800b6b60
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rax, qword [rbx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov r8d, 0xf2
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 2
call fcn.180043f80
cmp al, 2
je 0x1800b6ce6
test al, al
je 0x1800b6cfa
mov rax, qword [rbx]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x48], rax
xor edx, edx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov r8d, 0xf2
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 2
call fcn.180043f80
cmp al, 2
jne 0x1800b6ca6
mov byte [rsp + 0x70], 1
mov eax, dword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
mov byte [rsp + 0x70], dil
mov eax, dword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14001141f
Capabilities:
Terminate process

Disassembly:
jmp 0x140019360
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011532
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001c150
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001c170
xor al, al
jmp 0x14001c1f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001c183
xor al, al
jmp 0x14001c1f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001c1ad
xor al, al
jmp 0x14001c1f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001c1c1
xor al, al
jmp 0x14001c1f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001c1d3
xor al, al
jmp 0x14001c1f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001c1ef
xor al, al
jmp 0x14001c1f1
mov al, 1
add rsp, 0x38
ret