joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000c100
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18000c150
lea r11, [0x18008ba80]
nop dword [rax]
cmp r9b, 0x23
jne 0x18000c133
cmp byte [r8], r9b
jne 0x18000c133
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18000c120
mov rcx, qword [0x1800a7170]
not eax
movsxd rdx, dword [rcx + 0x3fe8]
mov r9, qword [rcx + 0x3ff0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18000c1b1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18000c1a9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000c1ac
mov rdx, r8
test rdx, rdx
jne 0x18000c180
cmp r9, r10
je 0x18000c1c0
cmp dword [r9], eax
jne 0x18000c1c0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x1800131b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, edx
mov r15, rcx
mov esi, edi
mov ebp, edi
mov r14d, edi
shr esi, 0x18
shr ebp, 0x10
shr r14d, 8
cmp dword [rcx + 0x100], 0
jg 0x1800131fa
mov r8d, 0x7a0
lea rdx, str.E:FrostyDX11_BaseHook_main___win11libsImGuiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [r15 + 0x100]
lea rdx, [0x18008ba80]
mov rax, qword [r15 + 0x108]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r14b
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, bpl
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, esi
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [r15]
not ebx
cmp dword [rcx + 0x4054], ebx
jne 0x18001326f
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.18001ff80
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180013290
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x100], 0
mov rdi, rdx
mov rbx, rcx
jg 0x1800132c3
mov r8d, 0x7a0
lea rdx, str.E:FrostyDX11_BaseHook_main___win11libsImGuiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [rbx + 0x120]
lea r10, [0x18008ba80]
movsxd rcx, dword [rbx + 0x100]
mov rax, qword [rbx + 0x108]
movss xmm2, dword [rdi]
movss xmm1, dword [rbx + 0x124]
subss xmm2, xmm0
movss xmm3, dword [rdi + 4]
mov r9d, dword [rax + rcx*4 - 4]
subss xmm3, xmm1
movss xmm4, dword [rdi + 8]
not r9d
movzx ecx, r9b
subss xmm4, xmm0
movss xmm0, dword [rdi + 0xc]
shr r9d, 8
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp + 0x20], xmm2
movzx eax, byte [rsp + 0x20]
xor rcx, rax
movss dword [rsp + 0x24], xmm3
mov eax, r8d
movss dword [rsp + 0x28], xmm4
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 0x2c], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x24]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x28]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
mov rbx, qword [rsp + 0x40]
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x2c]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x30
pop rdi
ret
Function at 0x18001ead0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x1800a7170]
xor ebp, ebp
cmp byte [rbx + 0x5f48], bpl
jne 0x18001ebcc
cmp dword [rbx + 0x5f70], ebp
je 0x18001eb17
mov r8d, 0x34fe
lea rdx, str.E:FrostyDX11_BaseHook_main___win11libsImGuiimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18001ebc5
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.180004880
mov rdi, rax
test rax, rax
je 0x18001ebc5
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x18001eb51
mov rcx, rax
call fcn.18001ed20
mov r8, qword [0x1800a7170]
test r8, r8
je 0x18001ebbc
movsx rdx, word [r8 + 0x60d0]
lea rcx, [r8 + 0x60d4]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x18001ebb1
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60d0], cx
movsx rax, cx
lea rcx, [r8 + 0x60d4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x60cc]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5f48], 1
movss xmm0, dword [rbx + 0x5f4c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18001ec69
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5f4c], xmm0
jb 0x18001ec69
mov rdi, qword [rbx + 0x20]
mov qword [rsp + 0x38], rsi
test rdi, rdi
je 0x18001ec57
mov rax, qword [0x1800a7170]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5f4c], ebp
call fcn.18001efa0
lea rdx, [0x18008b23c]
mov rcx, rdi
mov rsi, rax
call fcn.1800046d0
mov rdi, rax
test rax, rax
je 0x18001ec5e
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18001ec5e
mov byte [rbx + 0xce], 1
mov rsi, qword [rsp + 0x38]
mov dword [rbx + 0x5f4c], ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18001ec80
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1800a7170]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18001ece3
mov qword [rsp], rbx
lea rbx, [0x18008ba80]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001ecc3
cmp byte [r8], r9b
jne 0x18001ecc3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18001ecb0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f60]
not eax
mov r8, qword [r10 + 0x5f68]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18001ed0f
cmp dword [r8 + 8], eax
je 0x18001ed16
add r8, 0x48
cmp r8, rcx
jne 0x18001ed00
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x18005a950
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x1800aa34b], 0
je 0x18005aa40
mov ecx, dword [0x1800aa338]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18005aa40
xorps xmm0, xmm0
mov qword [rbp + 0x10], 8
xor ebx, ebx
mov ecx, 8
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rbx
call fcn.180064a90
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x20]
lea rcx, [rax + 8]
mov qword [rbp - 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
add rax, 8
mov rcx, qword [0x1800aa280]
mov qword [rbp - 0x18], rax
call fcn.180048d40
test rax, rax
je 0x18005aa35
xorps xmm0, xmm0
mov qword [rsp + 0x58], rdi
lea rcx, [rax + 0x10a8]
mov qword [rbp - 0x10], rbx
lea rdx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.180048d40
mov ecx, dword [0x1800aa338]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18005aa30
movss xmm1, dword [0x1800aa34c]
lea rcx, [rdi + 0xd50]
addss xmm1, dword [0x180099804]
xorps xmm0, xmm0
mov qword [rbp - 0x10], rbx
lea r8, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.180049240
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
xorps xmm0, xmm0
mov qword [rbp + 0x10], 8
xor ebx, ebx
mov ecx, 8
movdqu xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rbx
call fcn.180064a90
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x20]
lea rcx, [rax + 8]
mov qword [rbp - 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
add rax, 8
mov rcx, qword [0x1800aa280]
mov qword [rbp - 0x18], rax
call fcn.180048d40
test rax, rax
je 0x18005aa35
xorps xmm0, xmm0
mov qword [rbp - 0x10], rbx
lea rcx, [rax + 0x10a8]
lea rdx, [rbp - 0x20]
movdqu xmmword [rbp - 0x20], xmm0
call fcn.180048d40
movss xmm1, dword [0x180099804]
lea r8, [rbp - 0x20]
xorps xmm0, xmm0
mov qword [rbp - 0x10], rbx
movdqu xmmword [rbp - 0x20], xmm0
lea rcx, [rax + 0xd50]
call fcn.180049240
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x18005bea0
Capabilities:
Get graphical window text

Disassembly:
push rbx
sub rsp, 0x370
mov rax, qword [0x1800a6040]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x18], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [rbx + 0x20]
lea rdx, [rsp + 0x20]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x28]
lea rdx, [rsp + 0x30]
sub eax, dword [rsp + 0x20]
mov r8d, 0x104
mov rcx, qword [rbx + 0x20]
mov dword [rbx + 0x28], eax
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
mov dword [rbx + 0x2c], eax
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, qword [rbx + 0x20]
lea rax, [rsp + 0x30]
mov r8d, 0x104
mov qword [rbx + 0x38], rax
lea rdx, [rsp + 0x140]
call qword [sym.imp.USER32.dll_GetClassNameA]
mov rcx, qword [rbx + 0x18]
lea rax, [rsp + 0x140]
mov r9d, 0x104
mov qword [rbx + 0x40], rax
lea r8, [rsp + 0x250]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
lea rax, [rsp + 0x250]
mov qword [rbx + 0x48], rax
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.180064a70
add rsp, 0x370
pop rbx
ret

Function at 0x18005bf90
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18005bfc9
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
movsxd rcx, dword [0x1800aa364]
cmp rax, rcx
je 0x18005bfc9
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [0x1800aa364], eax
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret

Function at 0x18005c030
Capabilities:
Hide graphical window
Set console window title

Disassembly:
push rbx
sub rsp, 0x130
mov rax, qword [0x1800a6040]
xor rax, rsp
mov qword [rsp + 0x120], rax
cmp byte [0x1800a7169], 0
mov rbx, rcx
je 0x18005c068
lea rdx, str._____Console::InitializeConsole__failed_to_initialize_console_._n
call fcn.18005c110
jmp 0x18005c0e9
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov ecx, 1
mov qword [rbx + 0x10], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x180098984]
lea rdx, str.CONOUT_
lea rcx, [0x1800a7190]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
lea r8, str.DEBUG_CONSOLE
lea rdx, str._DX11Base___s
lea rcx, [rsp + 0x20]
call fcn.18005d410
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rbx + 0x10]
xor edx, edx
mov byte [0x1800a7169], 1
mov byte [rbx], 0
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180064a70
add rsp, 0x130
pop rbx
ret
Function at 0x18005d400
Capabilities:
Resume thread

Disassembly:
mov edx, 1
xor ecx, ecx
jmp fcn.180044ba0

Function at 0x18005d5d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1800a6040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [0x1800a7170]
mov r14, rdx
lea rdx, [rsp + 0x28]
movsxd rbp, r8d
mov dword [rsp + 0x20], 0x428c0000
mov dword [rsp + 0x24], 0x41980000
movups xmm0, xmmword [rbx + 0x3b24]
lea rcx, [rbx + 0x4a80]
mov dword [rsp + 0x28], 0x15
movups xmmword [rsp + 0x2c], xmm0
call fcn.180020b40
xor edi, edi
cmp dword [rbx + 0x4a7c], 0x15
je 0x18005d650
mov qword [rbx + 0x3b24], rdi
mov qword [rbx + 0x3b2c], rdi
movss xmm1, dword [0x180099804]
mov ecx, 0xd
call fcn.1800055a0
lea r15, [0x180000000]
cmp byte [rbp + r15 + 0xaa370], dil
je 0x18005d67c
lea r8, [0x180086fd0]
jmp 0x18005d687
movsxd rax, dword [r14]
mov r8, qword [r15 + rax*8 + 0x90130]
mov r9d, ebp
lea rdx, str._s_d
lea rcx, [rsp + 0x40]
call fcn.180021850
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180039a30
test al, al
je 0x18005d6d9
mov rax, rdi
cmp rax, 0x100
jae 0x18005d74c
mov byte [rax + r15 + 0xaa370], dil
inc rax
cmp rax, 0x100
jl 0x18005d6b7
mov byte [rbp + r15 + 0xaa370], 1
mov ebx, 1
mov ecx, ebx
call fcn.180005670
call fcn.1800054d0
cmp byte [rbp + r15 + 0xaa370], dil
je 0x18005d708
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18005d72f
inc ebx
cmp ebx, 0x7c
jb 0x18005d6f4
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180064a70
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
cmp ebx, 0x1b
cmovne edi, ebx
mov dword [r14], edi
cmp rbp, 0x100
jae 0x18005d74c
mov byte [rbp + r15 + 0xaa370], 0
jmp 0x18005d708
call fcn.180064f80
int3
Function at 0x180001dc0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rdi
sub rsp, 0x488
mov rax, qword [0x180035008]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbp, rdx
mov edx, ecx
mov ecx, 0x18
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180001dfc
xor al, al
jmp 0x180001f0e
mov qword [rsp + 0x4b0], rbx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x4b8], rsi
mov rcx, rdi
mov qword [rsp + 0x480], r14
mov dword [rsp + 0x30], 0x438
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x180001eeb
xor r14d, r14d
mov ecx, 0x18
call fcn.180003138
mov rbx, rax
test rax, rax
je 0x180001f32
lea rcx, [rsp + 0x60]
mov qword [rax + 8], r14
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x180001f32
cmp qword [rbx + 8], r14
jne 0x180001e7f
mov rcx, rax
call fcn.180006bc0
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
mov rdx, rbp
call fcn.18000c4fc
test eax, eax
mov eax, 0xffffffff
sete sil
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x180001ed0
mov rcx, qword [rbx]
test rcx, rcx
je 0x180001eb1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001ec3
call fcn.180003130
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.180003130
mov rcx, rdi
test sil, sil
jne 0x180001f28
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x180001e35
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rsi, qword [rsp + 0x4b8]
mov rbx, qword [rsp + 0x4b0]
mov r14, qword [rsp + 0x480]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180003110
add rsp, 0x488
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x180001ef6
mov ecx, 0x8007000e
call fcn.180006bb0
int3
Function at 0x180005aa8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x180005ad6
xor eax, eax
jmp 0x180005bbc
cmp qword [rcx + 0x68], 0
je 0x180005ae7
call fcn.180005bd8
jmp 0x180005bbc
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180005afe
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180005b00
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180005b32
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.180008480
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x180005bb6
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x180005b69
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x180005b92
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.18000ea74
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x180005bb6
cmp rsi, rbx
ja 0x180005b70
test rsi, rsi
je 0x180005bb6
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18000ea74
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180017328
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180017358
xor eax, eax
jmp 0x18001741b
mov rbp, rbx
cmp word [rax], si
je 0x18001737d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180017364
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180017360
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180017278
movsxd r14, eax
test eax, eax
jne 0x1800173bb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180017351
mov rcx, r14
call fcn.180015ad4
mov rdi, rax
test rax, rax
jne 0x1800173d4
xor ecx, ecx
call fcn.180015a98
jmp 0x1800173b0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180017278
test eax, eax
jne 0x180017405
mov rcx, rdi
call fcn.180015a98
jmp 0x18001740f
xor ecx, ecx
call fcn.180015a98
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18001940c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x18001943e
call fcn.180010310
mov dword [rax], 0x16
call fcn.18000ca14
jmp 0x18001955d
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18001955d
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x18001955d
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x18001946d
lock or dword [rcx + 0x14], 0x10
jmp 0x18001955d
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x180019481
call fcn.18001aa70
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.180018448
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.18001a1ec
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x18001954b
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x180019516
mov rcx, rsi
call fcn.180018448
cmp eax, edi
je 0x180019501
mov rcx, rsi
call fcn.180018448
cmp eax, 0xfffffffe
je 0x180019501
mov rcx, rsi
call fcn.180018448
movsxd rbx, eax
lea r14, [0x1800377e0]
mov rcx, rsi
sar rbx, 6
call fcn.180018448
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x180019508
lea rdx, [0x180035910]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180019516
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x18001953a
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x18001953a
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x18001953a
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x180019560
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x180019888
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.1800221b0
sub rsp, rax
mov rax, qword [0x180035008]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180018448
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1800198d7
mov rax, rbp
jmp 0x1800199df
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x377e0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18001a9c4
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x377e0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1800199db
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800199db
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18001a9c4
test rax, rax
js 0x1800199db
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1800199db
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1800199cd
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x1800199cd
cmp byte [rcx], 0xd
jne 0x1800199b3
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1800199c2
cmp byte [rcx + 1], 0xa
jne 0x1800199c2
inc rcx
jmp 0x1800199c2
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x35960]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180019995
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1800199df
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180003110
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret