joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180033c60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push r14
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x1800bb120]
xor rax, rsp
mov qword [rbp + 0x460], rax
mov esi, edx
mov r14, rcx
test rcx, rcx
je 0x180033ecb
test edx, edx
je 0x180033ecb
xor edx, edx
mov qword [rsp + 0x5a0], rbx
lea rcx, [rsp + 0x60]
lea r8d, [rdx + 0x64]
call fcn.18005f7c0
lea rax, [rsp + 0x48]
mov r9d, 8
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
test eax, eax
jne 0x180033e87
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x5a8], rdi
mov edi, ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180033e74
nop dword [rax + rax]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180033e38
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x54]
lea rax, [rbp + 0x250]
mov dword [rsp + 0x54], 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.ServiceName
mov dword [rsp + 0x50], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180033e2d
xor edx, edx
lea r8d, [rax + 0x64]
lea rcx, [rbp - 0x30]
call fcn.18005f7c0
mov r8d, 0x64
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x250]
call fcn.180033ed0
test eax, eax
je 0x180033e2d
cmp byte [rsp + 0x60], bl
je 0x180033de4
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x180033e2d
lea r8, [rbp - 0x30]
mov edx, 0x64
lea rcx, [rsp + 0x60]
sub r8, rcx
lea rax, [rsp + 0x60]
nop word [rax + rax]
lea rcx, [rdx + 0x7fffff9a]
test rcx, rcx
je 0x180033e20
movzx ecx, byte [r8 + rax]
test cl, cl
je 0x180033e20
mov byte [rax], cl
inc rax
sub rdx, 1
jne 0x180033e00
test rdx, rdx
lea rcx, [rax - 1]
cmovne rcx, rax
mov byte [rcx], bl
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rbx
lea r8, [rbp + 0x40]
mov qword [rsp + 0x30], rbx
inc edi
mov qword [rsp + 0x28], rbx
mov edx, edi
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x180033d30
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x5a8]
cmp byte [rsp + 0x60], bl
je 0x180033ec7
mov rdx, rsi
lea r8, [rsp + 0x60]
mov rcx, r14
call fcn.180034c90
test eax, eax
setns bl
mov eax, ebx
mov rbx, qword [rsp + 0x5a0]
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.18003ff90
add rsp, 0x570
pop r14
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x180033ea4
xor eax, eax
jmp 0x180033eac
Function at 0x180034020
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x1800bb120]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov edi, edx
mov rbx, rcx
xor edx, edx
mov dword [rsp + 0x34], 1
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], 0x400
mov r8d, 0x400
call fcn.18005f7c0
lea rax, [rsp + 0x30]
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
lea r8, [0x180093924]
mov qword [rsp + 0x20], rax
lea rdx, [0x180093928]
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x18003410f
xor r10d, r10d
lea rax, [rdi - 1]
mov edx, 0x7ffffffe
mov r9d, r10d
cmp rax, rdx
mov r8d, 0x80070057
mov ecx, edi
cmova r9d, r8d
test r9d, r9d
js 0x180034106
mov r9d, r10d
test edi, edi
je 0x1800340f7
sub rdx, rcx
lea r8, [rsp + 0x40]
sub r8, rbx
lea rax, [rdx + rcx]
test rax, rax
je 0x1800340f2
movzx eax, byte [r8 + rbx]
test al, al
je 0x1800340f2
mov byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1800340d3
jmp 0x1800340f7
test rcx, rcx
jne 0x180034100
dec rbx
mov r9d, 0x8007007a
mov byte [rbx], r10b
test r9d, r9d
sete r10b
mov eax, r10d
jmp 0x180034111
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18003ff90
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rdi
ret
Function at 0x1800349f0
Capabilities:
Get storage device properties

Disassembly:
push rbp
push r14
mov eax, 0x2d88
call fcn.1800401b0
sub rsp, rax
mov rax, qword [0x1800bb120]
xor rax, rsp
mov qword [rsp + 0x2d60], rax
mov r14d, edx
mov rbp, rcx
test rcx, rcx
je 0x180034c22
test edx, edx
je 0x180034c22
mov qword [rsp + 0x2da8], rbx
mov qword [rsp + 0x2db0], rsi
mov qword [rsp + 0x2db8], rdi
mov qword [rsp + 0x2d80], r12
mov qword [rsp + 0x2d78], r13
mov r13d, 0x80070057
mov qword [rsp + 0x2d70], r15
xor r15d, r15d
mov ebx, r15d
mov edi, r15d
lea r12d, [r15 + 1]
nop dword [rax]
mov r9d, edi
lea r8, str..PhysicalDrive_d
mov edx, 0x200
lea rcx, [rsp + 0x60]
call fcn.180034de0
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
lea rcx, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180034be3
xor eax, eax
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x650]
xor edx, edx
mov qword [rsp + 0x4c], rax
mov r8d, 0x2710
mov dword [rsp + 0x48], r15d
call fcn.18005f7c0
mov qword [rsp + 0x38], r15
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x48]
lea rax, [rsp + 0x650]
mov dword [rsp + 0x28], 0x2710
mov r9d, 0xc
mov qword [rsp + 0x20], rax
mov edx, 0x2d1400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180034bd6
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x3e8
call fcn.18005f7c0
mov edx, dword [rsp + 0x668]
lea r9, [rsp + 0x260]
mov r8d, r12d
lea rcx, [rsp + 0x650]
call fcn.1800329c0
lea rax, [r14 - 1]
mov r10d, r15d
cmp rax, 0x7ffffffe
mov rdx, r14
cmova r10d, r13d
test r10d, r10d
js 0x180034bd2
mov rax, rbp
mov r10d, r15d
test r14d, r14d
je 0x180034bc3
mov r8d, 0x7ffffffe
lea r9, [rsp + 0x260]
sub r8, rdx
sub r9, rbp
nop dword [rax + rax]
lea rcx, [r8 + rdx]
test rcx, rcx
je 0x180034bbe
movzx ecx, byte [r9 + rax]
test cl, cl
je 0x180034bbe
mov byte [rax], cl
inc rax
sub rdx, r12
jne 0x180034ba0
jmp 0x180034bc3
test rdx, rdx
jne 0x180034bcc
dec rax
mov r10d, 0x8007007a
mov byte [rax], r15b
test r10d, r10d
cmove ebx, r12d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x180034bee
inc edi
cmp edi, 0x10
jl 0x180034a70
mov r15, qword [rsp + 0x2d70]
mov eax, ebx
mov rbx, qword [rsp + 0x2da8]
mov r13, qword [rsp + 0x2d78]
mov r12, qword [rsp + 0x2d80]
mov rdi, qword [rsp + 0x2db8]
mov rsi, qword [rsp + 0x2db0]
jmp 0x180034c24
xor eax, eax
mov rcx, qword [rsp + 0x2d60]
xor rcx, rsp
call fcn.18003ff90
add rsp, 0x2d88
pop r14
pop rbp
ret

Function at 0x180034c40
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180034c50
mov dword [rsp + 0x28], eax
lea r8, [0x180093924]
mov qword [rsp + 0x20], rcx
lea rdx, [0x180093928]
mov rcx, 0xffffffff80000001
mov r9d, 1
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
add rsp, 0x38
ret
Function at 0x180035b80
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1800bb120]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rdx
mov dword [rsp + 0x20], 0x238
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180035c62
lea rdx, [rsp + 0x20]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
lea r8, [rsp + 0x4c]
mov rax, rsi
sub r8, rsi
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180035bf5
add rax, 2
test ecx, ecx
jne 0x180035be1
test edx, edx
jne 0x180035c08
test rdi, rdi
je 0x180035c04
mov eax, dword [rsp + 0x28]
mov dword [rdi], eax
mov al, 1
jmp 0x180035c64
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x180035c59
nop dword [rax]
lea r8, [rsp + 0x4c]
mov rax, rsi
sub r8, rsi
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180035c44
add rax, 2
test ecx, ecx
jne 0x180035c30
test edx, edx
je 0x180035bf9
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x180035c20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18003ff90
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180037d10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x850
mov rax, qword [0x1800bb120]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov ebx, edx
mov rdi, rcx
test rcx, rcx
je 0x180037dae
cmp ebx, 0x20
jb 0x180037dae
xor edx, edx
mov dword [rsp + 0x34], 1
mov r8d, 0x800
mov dword [rsp + 0x30], 0x800
lea rcx, [rsp + 0x40]
call fcn.18005f7c0
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
mov rcx, 0xffffffff80000001
lea r8, str.DisplayIcon
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallHYLite
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180037dae
mov edx, ebx
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.180065b6c
mov eax, 1
jmp 0x180037db0
xor eax, eax
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.18003ff90
mov rbx, qword [rsp + 0x870]
add rsp, 0x850
pop rdi
ret
Function at 0x18003a920
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x450
mov rax, qword [0x1800bb120]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov ebx, edx
mov rdi, rcx
test rcx, rcx
je 0x18003a9be
cmp ebx, 0x20
jb 0x18003a9be
xor edx, edx
mov dword [rsp + 0x34], 1
mov r8d, 0x400
mov dword [rsp + 0x30], 0x400
lea rcx, [rsp + 0x40]
call fcn.18005f7c0
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
mov rcx, 0xffffffff80000001
lea r8, [0x180093924]
lea rdx, [0x180093928]
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x18003a9be
mov edx, ebx
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.18006f290
mov eax, 1
jmp 0x18003a9c0
xor eax, eax
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18003ff90
mov rbx, qword [rsp + 0x470]
add rsp, 0x450
pop rdi
ret
Function at 0x18003c450
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x38
lea rax, [rsp + 0x40]
mov dword [rsp + 0x48], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 4
lea r8, str.startup
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallHYLite
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x18003c4ad
cmp dword [rsp + 0x50], 1
jne 0x18003c4ad
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x18003c4c0
Capabilities:
Get file version info

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x278
mov rax, qword [0x1800bb120]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r14, rdx
mov r15, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.18005f7c0
lea rdx, [rsp + 0x30]
mov rcx, r14
xor esi, esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test eax, eax
je 0x18003c653
mov qword [rsp + 0x2b0], rbp
mov ecx, ebx
mov qword [rsp + 0x270], rdi
call fcn.18004010c
mov rdi, rax
test rax, rax
je 0x18003c622
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.18005f7c0
mov edx, dword [rsp + 0x30]
mov r9, rdi
mov r8d, ebx
mov rcx, r14
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x18003c61a
lea r9, [rsp + 0x34]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, str.VarFileInfoTranslation
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x18003c61a
mov rax, qword [rsp + 0x40]
lea r8, str.StringFileInfo_08lx_s
mov edx, 0x208
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x50]
movzx r9d, word [rax]
movzx eax, word [rax + 2]
shl r9d, 0x10
or r9d, eax
call fcn.18000ecf0
lea r9, [rsp + 0x34]
mov rcx, rdi
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x18003c61a
mov rcx, qword [rsp + 0x38]
or r8, 0xffffffffffffffff
mov rax, r8
inc rax
cmp word [rcx + rax*2], si
jne 0x18003c5d2
movsxd rbx, eax
mov eax, 2
lea rcx, [rbx + 2]
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.18004010c
add rbx, rbx
xor edx, edx
mov rcx, rax
mov rsi, rax
lea r8, [rbx + 2]
call fcn.18005f7c0
mov rdx, qword [rsp + 0x38]
mov r8, rbx
mov rcx, rsi
call fcn.18005eaf0
mov rcx, rdi
call fcn.180040084
mov rbp, qword [rsp + 0x2b0]
mov rax, rsi
mov rdi, qword [rsp + 0x270]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18003ff90
add rsp, 0x278
pop r15
pop r14
pop rsi
pop rbx
ret
mov rax, rsi
jmp 0x18003c635

Function at 0x180041fcc
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180041fdf
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.180042644
lea rdx, [0x1800b8200]
lea rcx, [rsp + 0x20]
call fcn.18005ef28
int3

Function at 0x18004e2cc
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1800c0e40]
xor edx, edx
jmp fcn.180041fcc

Function at 0x18004ecbc
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1800c0e40]
jmp fcn.180041fcc
Function at 0x180076ec8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180076d68
call fcn.180065b4c
mov dword [rax], 0x16
call fcn.1800625c0
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180076d50
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180076d50
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x180076d9a
lock or dword [rax + 0x14], 0x10
jmp 0x180076d50
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180076db7
mov rcx, qword [rbp + 0x10]
call fcn.180077724
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180074ed4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.180079a9c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x180076e0e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x180076d50
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x180076e7a
mov rcx, qword [rbp + 0x10]
call fcn.180074ed4
cmp eax, 0xffffffff
je 0x180076e61
mov rcx, qword [rbp + 0x10]
call fcn.180074ed4
cmp eax, 0xfffffffe
je 0x180076e61
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180074ed4
movsxd rdi, eax
lea rsi, [0x1800c14d0]
mov rcx, rbx
sar rdi, 6
call fcn.180074ed4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x180076e68
lea rax, [0x1800bb5f0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180076e7a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x180076eb0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x180076eac
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x180076eac
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x180076d53
jmp 0x180076d20
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
cmp al, 0x29
movsd dword [rdi], dword [rsi]
push 0x479e5c97
imul byte [rbx + 0x588be5be]
lahf
test ch, 0xfa
lahf
cli
fnstenv [rcx - 1]
invalid
Function at 0x180003744
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1800cf040]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbp, rcx
mov rcx, r8
mov rax, 0xfffffffffffff000
and rcx, rax
mov rsi, r8
mov qword [rdx], rcx
mov rdx, r8
sub rdx, rcx
lea r9, [rdi + 0x10]
add rdx, 0x1004
mov r8d, 0x40
and rdx, rax
mov qword [rdi + 8], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800037ce
mov r9, qword [rdi + 8]
lea rdx, str.__unprotect_memory__p__size_llu______p__size_llu__n
mov r8, qword [rdi]
mov rcx, rbp
mov qword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call fcn.180002da0
xor eax, eax
jmp 0x18000381b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, [rsp + 0x40]
call fcn.180003450
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9, qword [rdi + 8]
lea rdx, str.Failed_to_unprotect_memory__p__size_llu______p__size_llu__error_lu__s__
mov r8, qword [rdi]
mov rcx, rbp
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], 5
mov qword [rsp + 0x20], rsi
call fcn.180002dc8
mov eax, 9
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18008b920
mov rbx, qword [rsp + 0x108]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret

Function at 0x180007f18
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180007f72
mov r11b, 0x23
lea rbx, [0x180095090]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x180007f5c
cmp rdx, 2
jb 0x180007f5c
cmp byte [r10], r11b
jne 0x180007f5c
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x180007f3a
jmp 0x180007fb3
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180007fb3
mov r11b, 0x23
lea rbx, [0x180095090]
cmp dl, r11b
jne 0x180007f97
cmp byte [r10], r11b
jne 0x180007f97
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x180007f85
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x1800080e8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x180008108
and qword [r8], 0
lea rdx, [0x1800b5888]
call fcn.180007fc4
mov rbx, rax
test rax, rax
je 0x1800081f9
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800081f0
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800081f0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800081f0
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800081f0
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x1800081f0
mov rax, qword [0x1800d2c00]
test rax, rax
je 0x18000818d
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1800081f0
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1800081dd
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1800d2c00]
test rax, rax
je 0x1800081d2
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800081f9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1800081eb
mov qword [rsi], rbp
mov rax, rdi
jmp 0x1800081fb
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18000a2c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1800cf040]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, dword [rcx + 0xf0]
mov r11d, 4
mov rax, qword [rcx + 0xf8]
mov r9, rcx
mov dword [rsp + 0x20], edx
mov r10d, r11d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x20]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x180095090]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x18000a2ff
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x1210], ebx
jne 0x18000a339
movsxd r8, edx
mov ecx, ebx
mov edx, r11d
call fcn.1800197d4
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18008b920
add rsp, 0x30
pop rbx
ret
Function at 0x1800184d4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x2f40], 0
lea rbx, [rcx + 0x2f48]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18001856d
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x180018525
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001a6f4
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.180008540
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x2f40]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x1800d2bf8]
movsxd r8, eax
mov rax, qword [rdi + 0x2f50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180018575
mov rcx, rbx
call fcn.180008540
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180018c28
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800d2c00]
mov rbx, rcx
and dword [rax + 0x2ea4], 0
test rcx, rcx
je 0x180018c91
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.180018c9c
lea rdx, [0x1800b588c]
mov rcx, rbx
mov rdi, rax
call fcn.180007fc4
mov rbx, rax
test rax, rax
je 0x180018c91
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800293a0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800293de
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
and qword [rsp + 0x28], 0
lea r8, [0x1800290a8]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800293ec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800293ec
test edx, edx
jne 0x1800293ec
test r8, r8
jne 0x1800293ec
call fcn.180029240
mov eax, 1
add rsp, 0x38
ret

Function at 0x18002bdb0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
cmp byte [rcx], 0
je 0x18002bdce
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
call fcn.18002bdb0
mov edx, eax
mov eax, edx
add rsp, 0x28
ret