joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d8660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rdx]
mov rbp, rcx
mov rcx, rdx
mov esi, r8d
mov rbx, rdx
call qword [rax + 0x28]
mov r9, qword [rbx]
mov rcx, rbx
test eax, eax
movsxd rdi, eax
setns dl
call qword [r9 + 0xd0]
test al, al
je 0x1800d87eb
test esi, esi
js 0x1800d86b6
cmp edi, esi
je 0x1800d86b6
xor edx, edx
jmp 0x1800d86b8
mov dl, 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd0]
test al, al
je 0x1800d87eb
lea rcx, [rbp + 0x18]
mov edx, edi
call fcn.1800da130
mov rcx, qword [rbp + 0x20]
lea r8, [rdi*8]
xor edx, edx
mov rsi, rdi
call fcn.1801cf320
test edi, edi
jle 0x1800d8735
xor edi, edi
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test al, al
je 0x1800d8719
mov rax, qword [rbx]
mov edx, 2
mov rcx, rbx
call qword [rax + 0x88]
mov rcx, qword [rbp + 0x20]
mov qword [rcx + rdi*8], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd8]
test al, al
je 0x1800d87eb
inc rdi
cmp rdi, rsi
jl 0x1800d86f3
mov rax, qword [rbx]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [rax + 0x70]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd8]
test al, al
je 0x1800d87eb
movss xmm1, dword [rsp + 0x40]
movss xmm2, dword [rsp + 0x38]
comiss xmm1, xmm2
jb 0x1800d879e
movss xmm0, dword [rsp + 0x44]
movss xmm3, dword [rsp + 0x3c]
comiss xmm0, xmm3
jb 0x1800d879e
subss xmm1, xmm2
xorps xmm4, xmm4
mulss xmm1, xmm4
ucomiss xmm1, xmm1
jp 0x1800d879e
jne 0x1800d879e
subss xmm0, xmm3
mulss xmm0, xmm4
ucomiss xmm0, xmm0
jp 0x1800d879e
jne 0x1800d879e
mov dl, 1
jmp 0x1800d87a0
xor dl, dl
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd0]
test al, al
je 0x1800d87eb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbp], xmm0
mov dword [rbp + 0x10], eax
mov eax, dword [rbx + 0x24]
dec eax
movups xmmword [rsp + 0x20], xmm0
cmp eax, 0x26
ja 0x1800d87dd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd8]
jmp 0x1800d87ed
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801ccd30
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800fd820
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov rsi, rdx
call fcn.1801dfe58
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800fd8d9
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800fd8d9
cmp qword [rsp + 0x50], 0
jl 0x1800fd8d9
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x40], rdi
mov rcx, rbx
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
je 0x1800fd8bb
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x1800fd8bb
mov rax, qword [rsp + 0x50]
mov qword [rsi], rax
jmp 0x1800fd8bd
xor edi, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rsi
ret
Function at 0x1801062b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
sub rsp, 0x60
cmp dword [rcx + 0x4c], 0
movzx r10d, r8b
mov rdi, rcx
jle 0x18010644e
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x50], rsi
test dl, dl
je 0x180106387
movzx eax, byte [rcx + 0x50]
lea rdx, [rcx + 0x24]
movss xmm0, dword [rcx + 4]
lea r9, [rcx + 0x3c]
movss xmm1, dword [rcx]
lea r8, [rcx + 0x2c]
mov byte [rsp + 0x40], r10b
mov byte [rsp + 0x38], al
movss dword [rsp + 0x30], xmm0
movss dword [rsp + 0x28], xmm1
mov qword [rsp + 0x20], rdx
lea rdx, [rcx + 0x68]
add rcx, 0x78
call qword [rdi + 0x60]
lea rcx, [rdi + 0x78]
call fcn.1800ac630
mov rax, qword [rdi + 0x68]
movsxd rcx, dword [rax + 0x3c]
test ecx, ecx
jle 0x18010634b
mov rax, qword [rax + 0x28]
movsd xmm0, qword [rax + rcx*8 - 8]
movaps xmm1, xmm0
movsd qword [rsp + 0x70], xmm0
movss xmm3, dword [rsp + 0x70]
shufps xmm1, xmm1, 0x55
jmp 0x18010635d
xorps xmm3, xmm3
xorps xmm1, xmm1
movss dword [rsp + 0x70], xmm3
movss dword [rsp + 0x74], xmm1
movaps xmm2, xmm1
lea rcx, [rdi + 0x78]
movaps xmm1, xmm3
call fcn.1800ac090
lea rdx, [rdi + 0x68]
lea rcx, [rdi + 0x78]
call fcn.1800adc40
lea rcx, [rdi + 0x78]
call fcn.1800ac630
jmp 0x180106444
mov rax, qword [rcx + 0x68]
lea rsi, [rcx + 0x68]
mov qword [rsp + 0x58], rbp
movsxd rcx, dword [rax + 0x3c]
test ecx, ecx
jle 0x1801063ae
mov rax, qword [rax + 0x28]
movsd xmm0, qword [rax + rcx*8 - 8]
movsd qword [rsp + 0x70], xmm0
jmp 0x1801063b7
mov qword [rsp + 0x70], 0
xor ebp, ebp
lea r8, [rdi + 0x1c]
test r10b, r10b
lea rdx, [rdi + 0x3c]
mov rax, rsi
lea r9, [rsp + 0x70]
cmove rax, rbp
lea rcx, [rdi + 0x78]
mov qword [rsp + 0x20], rax
call qword [rdi + 0x58]
mov rdx, rsi
lea rcx, [rdi + 0x78]
call fcn.1800adc40
movss xmm0, dword [rdi + 0x14]
lea r9, [rdi + 0x44]
xorps xmm0, xmmword [0x18023b2f0]
lea rdx, [rdi + 0x34]
cmp byte [rdi + 0x50], bpl
lea r8, [rsp + 0x88]
movss dword [rsp + 0x88], xmm0
lea rcx, [rdi + 0x78]
movss xmm0, dword [rdi + 0x18]
cmove rsi, rbp
xorps xmm0, xmmword [0x18023b2f0]
movss dword [rsp + 0x8c], xmm0
mov qword [rsp + 0x20], rsi
call qword [rdi + 0x58]
lea rcx, [rdi + 0x78]
call fcn.1800ac630
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x50]
lea rcx, [rdi + 0x68]
call fcn.1800abb70
mov dword [rdi + 0x4c], 0xffffffff
add rsp, 0x60
pop rdi
ret
Function at 0x18010ea30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r14
sub rsp, 0x98
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov eax, dword [rcx + 0xa0]
lea r14, [rcx + 0x10]
mov rdx, qword [rcx]
mov rbx, rcx
mov r8d, dword [rcx + 0x9c]
mov r10d, dword [rcx + 0x98]
mov ecx, dword [rdx + 0x18]
lea r11d, [rax + r8]
lea r9d, [rax + r10]
mov eax, dword [rdx + 0x1c]
test ecx, ecx
jle 0x18010ec77
test eax, eax
jle 0x18010ec77
cmp r10d, r9d
jge 0x18010ec77
cmp r8d, r11d
jge 0x18010ec77
test r9d, r9d
jle 0x18010ec77
cmp r10d, ecx
jge 0x18010ec77
test r11d, r11d
jle 0x18010ec77
cmp r8d, eax
jge 0x18010ec77
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xc0], rsi
mov rsi, qword [rdx + 0x10]
mov qword [rsp + 0xc8], rdi
xor edi, edi
test r10d, r10d
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r13
mov r12d, r8d
mov r13, qword [rdx]
mov qword [rsp + 0x80], r15
mov r15d, r10d
cmovle r15d, edi
test r8d, r8d
cmovle r12d, edi
cmp ecx, r9d
cmovle r9d, ecx
cmp eax, r11d
cmovle r11d, eax
test r13, r13
je 0x18010eb42
movsxd rbp, dword [rdx + 0x20]
lea rcx, [0x180222180]
movsxd rax, r15d
movsxd rdi, r12d
imul rdi, rsi
movzx ecx, byte [rbp + rcx]
imul rax, rcx
add rax, r13
add rdi, rax
jmp 0x18010eb45
mov ebp, dword [rdx + 0x20]
mov eax, dword [rdx + 0x24]
sub r9d, r15d
mov ecx, dword [rdx + 0x28]
sub r11d, r12d
mov dword [rsp + 0x40], r9d
neg r10d
mov dword [rsp + 0x4c], eax
lea r9, [rbx + 0x40]
mov rax, qword [rdx + 8]
neg r8d
mov dword [rsp + 0x44], r11d
mov edx, r10d
mov qword [r14], rdi
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rsi
mov dword [rsp + 0x48], ebp
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14 + 0x18], xmm0
mov dword [r14 + 0x28], ecx
mov rcx, qword [rbx + 8]
call fcn.1800e3040
mov r9d, dword [rbx + 0xa0]
xor eax, eax
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x3c], r9d
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
cmp byte [rbx + 0x71], al
je 0x18010ec46
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x60]
mov r8, qword [rsp + 0x30]
mov rdi, 0xffffffffffffffff
shr rax, 0x20
xor edx, edx
shr r8, 0x20
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x70], rdi
call fcn.1800bfe10
lea r9, [rbx + 0x40]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x60]
lea rcx, [rbx + 0x40]
call fcn.1800c08b0
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18010ec5a
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x18010ec5a
mov rcx, qword [rsp + 0x70]
call fcn.1801d1bbc
jmp 0x18010ec5a
lea rcx, [rbx + 0x58]
mov r8d, 1
lea rdx, [rsp + 0x40]
call fcn.1800e5990
mov dl, 1
lea rcx, [rbx + 0x40]
call fcn.1800e21a0
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
jmp 0x18010ec80
lea rcx, [rbx + 0x40]
call fcn.1800e23f0
lea rax, [rbx + 0x40]
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x80], rax
cmp byte [rax + 0x32], 0
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1801ccd30
add rsp, 0x98
pop r14
pop rbx
ret
Function at 0x1801278f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11d, r8d
mov rbx, rcx
sar r11d, 3
mov edi, 0x7e0
sub rbx, rdx
nop dword [rax]
movzx eax, word [rdx]
dec r9d
movzx r10d, word [rbx + rdx]
lea rdx, [rdx + 2]
mov r8d, eax
mov ecx, r10d
and ecx, edi
and r8d, edi
shl ecx, 0x10
or ecx, r10d
shl r8d, 0x10
or r8d, eax
and ecx, 0xfffff81f
and r8d, 0xfffff81f
sub ecx, r8d
imul ecx, r11d
shr ecx, 5
add ecx, r8d
mov eax, ecx
shr eax, 0x10
xor ax, cx
and ax, di
xor ax, cx
mov word [rdx - 2], ax
test r9d, r9d
jg 0x180127910
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1801572f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov esi, dword [reloc.gdiplus.dll_Ordinal_1]
xor r10d, r10d
movaps xmmword [rax - 0x28], xmm6
mov r11, rcx
movaps xmmword [rax - 0x38], xmm7
mov r14, r8
movsd xmm7, qword [0x18023b2d0]
mov rbp, rdx
movaps xmmword [rax - 0x48], xmm8
lea r15d, [r10 + 2]
movsd xmm8, qword [0x18023aa60]
lea r12d, [r10 + 4]
movaps xmmword [rax - 0x58], xmm9
mov dil, 1
movaps xmmword [rax - 0x68], xmm10
mov rbx, rcx
movaps xmmword [rax - 0x78], xmm11
movq xmm10, r11
movsd xmm11, qword [0x18023aab0]
xorps xmm9, xmm9
movaps xmmword [rsp + 0x10], xmm12
movdqa xmm12, xmmword [0x18023b3b0]
punpcklqdq xmm10, xmm10
nop dword [rax]
nop word [rax + rax]
movd xmm1, r10d
mov r8d, 1
pshufd xmm1, xmm1, 0
cmp esi, r15d
jl 0x1801573fa
movdqa xmm3, xmmword [0x18023afc0]
movq xmm0, xmm1
paddd xmm3, xmmword [0x18023af90]
movq xmm1, xmm1
pxor xmm3, xmm0
movd xmm0, r15d
psubd xmm3, xmm1
movdqa xmm1, xmm3
psrad xmm1, xmm0
pmovsxdq xmm0, xmm3
pandn xmm1, xmm12
pmovsxdq xmm2, xmm1
pand xmm2, xmm0
movd xmm0, r12d
psllq xmm2, xmm0
paddq xmm2, xmm10
movdqu xmmword [rsp], xmm2
jmp 0x180157431
lea r9, [rsp]
nop
mov edx, r8d
lea r9, [r9 + 8]
xor edx, r10d
inc r8d
sub edx, r10d
mov eax, edx
sar eax, 2
not eax
movsxd rcx, eax
movsxd rax, edx
and rcx, rax
shl rcx, 4
add rcx, r11
mov qword [r9 - 8], rcx
cmp r8d, 3
jl 0x180157400
mov rax, qword [rsp]
movsd xmm2, qword [rbx + 8]
movsd xmm0, qword [rbx]
movsd xmm5, qword [rax]
movsd xmm6, qword [rax + 8]
subsd xmm0, xmm5
mov rax, qword [rsp + 8]
subsd xmm2, xmm6
movsd xmm3, qword [rax]
movsd xmm4, qword [rax + 8]
subsd xmm3, xmm5
subsd xmm4, xmm6
mulsd xmm2, xmm3
mulsd xmm0, xmm4
subsd xmm2, xmm0
movaps xmm0, xmm2
andps xmm0, xmm7
comisd xmm11, xmm0
ja 0x1801574d6
xor dil, dil
mov rax, rbp
xor ecx, ecx
nop word [rax + rax]
movsd xmm1, qword [rax + 8]
movsd xmm0, qword [rax]
subsd xmm1, xmm6
subsd xmm0, xmm5
mulsd xmm1, xmm3
mulsd xmm0, xmm4
subsd xmm1, xmm0
movaps xmm0, xmm1
mulsd xmm0, xmm2
comisd xmm0, xmm9
jbe 0x1801574c5
andps xmm1, xmm7
comisd xmm8, xmm1
jbe 0x1801574d6
inc rcx
add rax, 0x10
cmp rcx, 3
jl 0x180157490
xor al, al
jmp 0x1801574ec
inc r10d
add rbx, 0x10
cmp r10d, 3
jl 0x180157390
mov byte [r14], dil
mov al, 1
movaps xmm6, xmmword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm7, xmmword [rsp + 0x60]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180157540
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [reloc.gdiplus.dll_Ordinal_1], 2
mov r10d, edx
mov r11, rcx
mov r9, r8
mov eax, 1
movd xmm1, r10d
movq xmm4, r11
pshufd xmm1, xmm1, 0
punpcklqdq xmm4, xmm4
jl 0x1801575d0
movdqa xmm3, xmmword [0x18023afc0]
movq xmm0, xmm1
paddd xmm3, xmmword [0x18023af90]
movq xmm1, xmm1
pxor xmm3, xmm0
mov eax, 2
psubd xmm3, xmm1
movdqa xmm1, xmm3
movd xmm0, eax
mov eax, 4
psrad xmm1, xmm0
pmovsxdq xmm0, xmm3
pandn xmm1, xmmword [0x18023b3b0]
pmovsxdq xmm2, xmm1
pand xmm2, xmm0
movd xmm0, eax
psllq xmm2, xmm0
paddq xmm2, xmm4
movdqu xmmword [r8], xmm2
ret
mov r8d, eax
lea r9, [r9 + 8]
xor r8d, r10d
inc eax
sub r8d, r10d
mov ecx, r8d
sar ecx, 2
not ecx
movsxd rdx, ecx
movsxd rcx, r8d
and rdx, rcx
shl rdx, 4
add rdx, r11
mov qword [r9 - 8], rdx
cmp eax, 3
jl 0x1801575d0
ret

Function at 0x180159340
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x18029d6c8], 0
jne 0x1801593c1
mov eax, 0xffffffff
lock xadd dword [0x18028f608], eax
test eax, eax
jg 0x180159378
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39c0
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x18029d6c8], 0
jne 0x180159394
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18029d548], eax
mov byte [0x18029d6c8], 1
mov eax, 1
lock xadd dword [0x18028f608], eax
test eax, eax
jns 0x1801593c1
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39c0
xor r8d, r8d
mov rcx, qword [rax]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, dword [0x18029d548]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x18017e220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov r14, rdx
mov rsi, rcx
mov eax, 0xffffffff
lock xadd dword [0x18028f5e0], eax
test eax, eax
jg 0x18017e25a
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39c0
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.180104030
cmp qword [rax + 0x18], 0
mov rbx, qword [rax + 0x38]
jne 0x18017e27d
mov rax, qword [rax + 0x30]
test rbx, rbx
je 0x18017e27a
cmp rbx, rax
cmovb rax, rbx
mov rbx, rax
mov eax, 1
lock xadd dword [0x18028f5e0], eax
test eax, eax
jns 0x18017e2aa
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39c0
xor r8d, r8d
mov rcx, qword [rax]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test rbx, rbx
jne 0x18017e2ba
mov al, 1
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rcx, qword [rsi + 0x48]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
xor edi, edi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r15
lea ebp, [rdi + 5]
test rcx, rcx
je 0x18017e2f3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x48]
mov eax, ebp
mov edx, dword [rcx + 0x10]
jmp 0x18017e307
movups xmm0, xmmword [rsi + 0x28]
mov rcx, rdi
movups xmmword [rsp + 0x34], xmm0
mov eax, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x34]
cdqe
lea r12, [0x180222180]
movzx r15d, byte [rax + r12]
movsxd rax, edx
imul r15, rax
test rcx, rcx
je 0x18017e33b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rsi + 0x48]
mov edx, dword [rax + 0x10]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], edx
jmp 0x18017e34c
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rsp + 0x20], xmm0
mov ebp, dword [rsp + 0x28]
mov edx, dword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
shr r8, 0x20
test r8d, r8d
jne 0x18017e35f
mov rdx, rdi
jmp 0x18017e37b
movsxd rax, ebp
movzx ecx, byte [rax + r12]
lea eax, [r8 - 1]
imul ecx, edx
movsxd rdx, ecx
movsxd rcx, eax
imul rcx, r15
add rdx, rcx
movss xmm2, dword [0x18023ae0c]
xorps xmm1, xmm1
mov r15, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
movsxd rax, edx
cmp rax, rdx
cmove rdi, rax
test rdi, rdi
cvtsi2ss xmm1, rdi
mov rdi, qword [rsp + 0x78]
jns 0x18017e3b8
addss xmm1, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, rbx
test rbx, rbx
jns 0x18017e3c9
addss xmm0, xmm2
mulss xmm0, dword [r14]
mulss xmm0, dword [r14 + 0x10]
comiss xmm0, xmm1
seta al
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
Function at 0x1801e3e24
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1801e3cc4
call fcn.1801d1b9c
mov dword [rax], 0x16
call fcn.1801d1a4c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1801e3cac
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1801e3cac
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1801e3cf6
lock or dword [rax + 0x14], 0x10
jmp 0x1801e3cac
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1801e3d13
mov rcx, qword [rbp + 0x10]
call fcn.1801e578c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1801dfed0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1801e36fc
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1801e3d6a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1801e3cac
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1801e3dd6
mov rcx, qword [rbp + 0x10]
call fcn.1801dfed0
cmp eax, 0xffffffff
je 0x1801e3dbd
mov rcx, qword [rbp + 0x10]
call fcn.1801dfed0
cmp eax, 0xfffffffe
je 0x1801e3dbd
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1801dfed0
movsxd rdi, eax
lea rsi, [0x180295bf0]
mov rcx, rbx
sar rdi, 6
call fcn.1801dfed0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1801e3dc4
lea rax, [0x18028e410]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1801e3dd6
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1801e3e0c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1801e3e08
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1801e3e08
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1801e3caf
jmp 0x1801e3c7c
Function at 0x140002768
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x40], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp rdi, 0xffffffffffffffff
je 0x140002970
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x140002967
mov r15d, eax
lea rdx, [rsp + 0x6c]
lea rcx, [rbp + 0x3e0]
call fcn.1400064d0
nop
xor r14b, r14b
mov rax, qword [rsi]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140002848
lea rcx, [rbx + 0x10]
lea rdx, [rbp + 0x3e8]
call fcn.140001d64
nop
mov rdx, qword [rax]
test rdx, rdx
je 0x140002985
mov rcx, qword [rbp + 0x3e0]
call fcn.1401776c4
test eax, eax
sete r12b
mov rdx, qword [rbp + 0x3e8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002836
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test r12b, r12b
jne 0x140002845
mov rbx, qword [rbx]
cmp rbx, qword [rsi]
jne 0x1400027e6
jmp 0x140002848
mov r14b, 1
test r14b, r14b
jne 0x140002930
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x180]
call fcn.140137f50
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400028ab
mov dword [rbp + 0x3d8], 0x104
lea r9, [rbp + 0x3d8]
lea r8, [rbp + 0x180]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x3e0]
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x20]
call fcn.1400064d0
nop
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400064d0
nop
lea rdx, [0x1406bd050]
lea rcx, [rsp + 0x30]
call fcn.1400064d0
nop
mov rbx, qword [rsi]
lea r9, [rsp + 0x20]
mov r8, qword [rbx + 8]
mov rdx, rbx
call fcn.14000a994
mov rcx, rax
mov rdx, qword [rsi + 8]
movabs rax, 0x666666666666665
sub rax, rdx
cmp rax, 1
jb 0x140002990
lea rax, [rdx + 1]
mov qword [rsi + 8], rax
mov qword [rbx + 8], rcx
mov rax, qword [rcx + 8]
mov qword [rax], rcx
lea rcx, [rsp + 0x20]
call fcn.140002c1c
nop
mov rdx, qword [rbp + 0x3e0]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002951
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
je 0x1400027c6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r15d
add rsp, 0x490
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000c3ac
nop
lea rcx, str.list_T__too_long
call fcn.140101700
int3
Function at 0x140003388
Capabilities:
Start service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
xor ebx, ebx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
je 0x1400033f4
lea r8d, [rbx + 0x10]
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
je 0x1400033eb
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
lea ecx, [rbx + 1]
cmovne ebx, ecx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rsi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret