joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005020
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x180015010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
xor ebx, ebx
nop
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
mov r8d, 4
movsxd rax, ebx
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, qword [rcx]
call qword [sym.imp.WS2_32.dll_recv]
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x180005075
add ebx, eax
mov dword [rdi + 8], ebx
cmp ebx, 4
jl 0x180005040
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_ntohl]
lea ecx, [rax - 0x13954]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18000f410
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800050b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
movsxd rsi, r8d
mov r14, rcx
mov rbp, rdx
xor r15d, r15d
lea rcx, [rsi + 1]
call fcn.18000f474
mov rdi, rax
mov ebx, r15d
mov byte [rsi + rax], r15b
test esi, esi
jle 0x18000511d
nop dword [rax + rax]
mov rcx, qword [r14]
mov r8d, esi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rdi
xor r9d, r9d
mov rcx, qword [rcx]
call qword [sym.imp.WS2_32.dll_recv]
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x180005178
add ebx, eax
mov dword [r14 + 8], ebx
cmp ebx, esi
jl 0x1800050f0
xorps xmm0, xmm0
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x40], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], r15b
jne 0x180005136
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180002490
lea rdx, [rsp + 0x28]
mov rcx, rbp
call fcn.180004290
mov rbx, qword [rsp + 0x70]
mov rax, rbp
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
mov rcx, rdi
call fcn.18000f46c
xorps xmm0, xmm0
lea rdx, [0x180011639]
movups xmmword [rbp], xmm0
xor r8d, r8d
mov qword [rbp + 0x10], r15
mov rcx, rbp
mov qword [rbp + 0x18], r15
call fcn.180002490
jmp 0x180005159
Function at 0x1800054c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov r14, rcx
test r8d, r8d
jle 0x180005519
nop word [rax + rax]
mov rcx, qword [r14]
mov r8d, edi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rsi
xor r9d, r9d
mov rcx, qword [rcx]
call qword [sym.imp.WS2_32.dll_send]
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x180005531
add ebx, eax
cmp ebx, edi
jl 0x1800054f0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x18000551b

Function at 0x180005540
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x180015010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov eax, 0x2d0
movzx ecx, dx
imul ecx, eax
call qword [sym.imp.WS2_32.dll_ntohs]
mov word [rsp + 0x20], ax
xor ebx, ebx
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
mov r8d, 2
movsxd rax, ebx
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, qword [rcx]
call qword [sym.imp.WS2_32.dll_send]
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x1800055b6
add ebx, eax
cmp ebx, 2
jl 0x180005580
mov al, 1
jmp 0x1800055b8
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18000f410
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1800055d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x180015010]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea eax, [rdx + rdx*2]
mov rdi, rcx
lea ecx, [rax*8 + 0x13954]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x20], eax
xor ebx, ebx
mov rcx, qword [rdi]
lea rdx, [rsp + 0x20]
mov r8d, 4
movsxd rax, ebx
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, qword [rcx]
call qword [sym.imp.WS2_32.dll_send]
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x180005638
add ebx, eax
cmp ebx, 4
jl 0x180005602
mov al, 1
jmp 0x18000563a
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18000f410
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18000a020
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180015010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x18000a06f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180016090]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18000a0ad
cmp rsi, r14
jb 0x18000a0a5
cmp rsi, r15
jae 0x18000a0a5
cmp qword [rsi + 8], 0
jne 0x18000a277
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18000a090
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18000a142
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18000a139
nop word [rax + rax]
mov r8d, gethostbyname
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000a139
cmp dword [rsp + 0x40], 0x10000
je 0x18000a1bb
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x18000a139
sub rbx, rbp
cmp rbx, r14
jae 0x18000a100
test rsi, rsi
jne 0x18000a220
cmp rdi, r15
ja 0x18000a25f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18000a25f
mov r8d, gethostbyname
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000a25f
cmp dword [rsp + 0x40], 0x10000
je 0x18000a1f1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18000a172
jmp 0x18000a25f
test rbx, rbx
je 0x18000a139
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000a220
cmp rbx, r14
jae 0x18000a0e0
jmp 0x18000a142
test rdi, rdi
je 0x18000a25f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18000a220
cmp rdi, r15
jbe 0x18000a150
jmp 0x18000a25f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18000a230
mov rax, qword [0x180016090]
mov qword [rsi], rax
mov qword [0x180016090], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18000f410
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x18000ac90
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180015010]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18000adbb
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18000adb2
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x18000ad94
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18000ad94
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18000ad94
mov rdx, qword [rbx]
test rdx, rdx
jne 0x18000ad52
mov rcx, qword [0x180015be8]
mov r8d, 0x200
mov dword [rbx + 8], pe_nt_image_headers64
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x18000adb2
jmp 0x18000ad87
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18000ad87
mov rcx, qword [0x180015be8]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18000adb2
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18000ad00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x18000ae13
cmp dword [rbx + 0xc], esi
jbe 0x18000ae13
nop word [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18000ae0c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.18000aae0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x18000add0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18000f410
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18000ae40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180015010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x180016080]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18000aeb3
mov eax, 0xa
jmp 0x18000af46
test esi, esi
je 0x18000aed5
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18000aef8
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x18000aef8
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x18000aef1
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x18000aef8
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18000f410
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18000af70
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x18001608c]
mov ebx, edi
test ecx, ecx
je 0x18000b0ab
mov rax, qword [0x180016080]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x18000afc8
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18000afa0
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x18000b0ab
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.18000ac90
mov r8d, dword [0x18001608c]
cmp ebx, r8d
jae 0x18000b038
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x180016080]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x18000b031
mov edx, esi
mov ecx, ebx
call fcn.18000ae40
mov edi, eax
test eax, eax
jne 0x18000b038
mov r8d, dword [0x18001608c]
inc ebx
cmp ebx, r8d
jb 0x18000b000
cmp qword [rsp + 0x20], 0
je 0x18000b0ab
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18000b097
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18000b088
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x18000b060
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180015be8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18000b530
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x180015be0], ebp
je 0x18000b587
cmp rbx, 0x20
jae 0x18000b570
xor ecx, ecx
jmp 0x18000b572
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180015be0], ebp
jne 0x18000b566
cmp qword [0x180015be8], r15
je 0x18000b681
test rdi, rdi
jne 0x18000b5a7
mov ecx, esi
call fcn.18000af70
mov ebp, eax
jmp 0x18000b686
mov ecx, dword [0x18001608c]
mov ebx, r15d
test ecx, ecx
je 0x18000b5cf
mov r8, qword [0x180016080]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x18000b5d9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x18000b5c0
mov ebp, 4
jmp 0x18000b686
cmp ebx, 0xffffffff
je 0x18000b5cf
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x18000b678
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18000ac90
mov edx, esi
mov ecx, ebx
call fcn.18000ae40
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x18000b686
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x18000b662
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18000b658
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x18000b630
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x180015be8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18000b686
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x18000b686
mov ebp, 2
xchg dword [0x180015be0], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180018a3b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
inc r8w
push rdi
push r14
movzx ebp, sp
cbw
sub rsp, 0x40
cdqe
xadd ah, al
mov rax, qword [0x180015010]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx ebp, r15w
jmp 0x180018a78
mov r14, rcx
lea r8, [rsp + 0x20]
movsx bp, r14b
setno bpl
mov rcx, qword [rcx + 0x10]
nop
mov rbp, rdx
movsx edx, r11w
lea rdx, [rsp + 0x28]
mov al, 0x92
mov rax, qword [rcx]
jmp 0x180018aa5
call qword [rax + 0x268]
xor ebx, ebx
clc
cmp r11w, r15w
jmp 0x180018ab7
cmp dword [rsp + 0x28], ebx
jmp 0x180018ac0
jle 0x180018b2b
mov edi, ebx
lahf
nop dword [rax + rax]
cbw
cdq
mov rax, qword [rsp + 0x20]
cwd
not edx
mov rcx, qword [r14]
mov rsi, qword [rdi + rax]
movzx eax, r8w
mov rax, qword [r14 + 0x48]
mov rdx, rsi
jmp 0x180018af4
call rax
mov rcx, rax
mov rdx, rbp
jmp 0x180018b01
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jmp 0x180018b0f
jne 0x180018b7d
inc ebx
add rdi, 8
stc
cmp ebx, dword [rsp + 0x28]
jmp 0x180018b25
jl 0x180018ad4
xor eax, eax
mov rcx, qword [rsp + 0x30]
stc
xor rcx, rsp
jmp 0x180018b3b
call fcn.18000f410
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
cmp bp, 0x4313
add rsp, 0x40
movsx rsi, cx
movsx r14w, sil
cmovae r14w, r8w
pop r14
bswap si
movzx si, r15b
cmovae esi, r9d
pop rdi
bswap si
movsxd rsi, r15d
pop rsi
jmp 0x180018b7c
ret
mov rax, rsi
jmp 0x180018b2d
Function at 0x18001db5e
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmc
test si, r8w
cmp edx, 1
jmp 0x18001db6f
jne 0x18001dbbd
xor eax, eax
ror r9d, cl
xadd r9b, r8b
btc r9d, 0xac
lea r8, [0x180008d50]
xchg r9w, r9w
sub r9, 0xffffffffacad9e07
stc
mov r9, rcx
clc
stc
mov qword [rsp + 0x28], rax
cmp dx, 0xda20
cmc
xor edx, edx
mov dword [rsp + 0x20], eax
test rbx, r12
cmp r8w, 0x232
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
cmc
cmp cx, sp
clc
add rsp, 0x38
jmp 0x18001dbd0
ret
Function at 0x62d93370
Capabilities:
Get storage device properties

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x108
lea rbx, [rsp + 0x70]
mov rdi, rdx
mov ebp, ecx
xor edx, edx
mov rcx, rdi
mov rsi, r8
call fcn.62e01f28
mov rcx, rbx
mov r8d, ebp
lea rdx, str..PhysicalDrive_d
call qword [0x62e24558]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [0x62e24270]
cmp rax, 0xffffffffffffffff
mov rbx, rax
je 0x62d9345c
lea r12, [0x62e1b240]
xor edx, edx
mov r8d, 0x2710
mov dword [rsp + 0x60], 0
lea r13, [rsp + 0x64]
mov qword [rsp + 0x64], 0
mov rcx, r12
mov dword [rsp + 0x6c], 0
call fcn.62e01f28
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x2710
mov qword [rsp + 0x20], r12
mov r9d, 0xc
mov r8, r13
mov qword [rsp + 0x30], rax
mov edx, 0x2d1400
mov rcx, rbx
call qword [0x62e24288]
test eax, eax
jne 0x62d93484
mov rcx, rbx
call qword [0x62e24268]
cmp rsi, 0x13
jbe 0x62d93630
mov rdx, rdi
mov ecx, ebp
call fcn.62d92fc0
add rsp, 0x108
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [0x62e1b258]
test eax, eax
je 0x62d93453
add rax, r12
mov r15, qword [0x62e244a8]
mov r13d, 0x64
mov qword [rsp + 0x58], rax
mov r12, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov r14, rax
test r13d, r13d
movzx edx, byte [r12]
je 0x62d93560
test dl, dl
je 0x62d93560
movsx ecx, dl
mov byte [rsp + 0x4e], dl
call r15
test eax, eax
je 0x62d93600
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x39
jg 0x62d935e0
sub edx, 0x30
movsx ecx, byte [r12 + 1]
shl edx, 4
mov byte [rsp + 0x4e], dl
mov byte [rsp + 0x4f], cl
call r15
test eax, eax
je 0x62d93600
movzx edx, byte [rsp + 0x4f]
cmp dl, 0x39
jg 0x62d935f0
sub edx, 0x30
or dl, byte [rsp + 0x4e]
add r12, 2
movzx ecx, dl
mov byte [rsp + 0x4e], dl
call qword [0x62e244a0]
test eax, eax
je 0x62d93600
movzx edx, byte [rsp + 0x4e]
cmp dl, 0x20
je 0x62d934b6
sub r13d, 1
mov byte [r14], dl
add r14, 1
test r13d, r13d
movzx edx, byte [r12]
jne 0x62d934c4
mov r8, qword [rsp + 0x50]
mov byte [r14], 0
mov edx, dword [r8]
add r8, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x62d93569
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [r8 + 2]
mov ecx, eax
cmove r8, rdx
add cl, al
sbb r8, 3
sub r8, qword [rsp + 0x50]
cmp r8d, esi
mov r12d, r8d
jae 0x62d93453
mov rdx, qword [rsp + 0x50]
add r8, 1
mov rcx, rdi
call fcn.62e01f38
mov rcx, rbx
call qword [0x62e24268]
test r12d, r12d
je 0x62d9345c
xor eax, eax
jmp 0x62d93470
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x62d934ef
and edx, 0xffffffdf
sub edx, 0x37
jmp 0x62d9351c
mov rcx, qword [rsp + 0x58]
call fcn.62e01ee0
cmp eax, esi
mov r12d, eax
jae 0x62d93453
mov rdx, qword [rsp + 0x58]
lea r8, [rax + 1]
mov rcx, rdi
call fcn.62e01f38
jmp 0x62d935c0
mov eax, 0xffffffff
jmp 0x62d93470
Function at 0x62d93710
Capabilities:
Get storage device properties

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
movsx eax, byte [rcx]
mov rbx, rdx
mov rsi, r8
cmp al, 0x2a
je 0x62d93791
cmp al, 0x2f
jne 0x62d93733
movsx eax, byte [rcx + 1]
add rcx, 1
test al, al
je 0x62d9382e
sub eax, 0x30
cmp eax, 9
jbe 0x62d9375f
jmp 0x62d93781
lea r8d, [rdx - 0x30]
cmp r8d, 9
ja 0x62d93781
lea r8d, [rax + rax*4]
lea edx, [rdx + r8*2 - 0x30]
add eax, edx
cmp eax, 0x5a
jg 0x62d93781
add rcx, 1
movsx edx, byte [rcx]
test dl, dl
jne 0x62d93745
mov r8, rsi
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.62d93370
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp r8, 5
jbe 0x62d93835
lea rdx, str.__d:
xor r8d, r8d
mov rcx, rbx
mov rbp, rbx
xor edi, edi
lea r12, str.__d:
call fcn.62e01f08
mov edx, 3
jmp 0x62d93800
mov rcx, rbp
add edi, 1
call fcn.62e01ee0
cdqe
lea rdx, [rbp + rax]
sub rsi, rax
cmp edi, 0x59
lea rbp, [rdx + 1]
mov byte [rdx], 0x2c
jg 0x62d93818
cmp rsi, 5
jbe 0x62d93818
mov rdx, r12
mov r8d, edi
mov rcx, rbp
call fcn.62e01f08
xor edx, edx
cmp edi, 9
setg dl
add edx, 3
movsxd rdx, edx
mov ecx, edi
sub rsi, rdx
add rdx, rbp
mov r8, rsi
call fcn.62d93370
cmp eax, 0xffffffff
jne 0x62d937c0
cmp rbx, rbp
jae 0x62d93835
xor eax, eax
mov byte [rbp - 1], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
xor eax, eax
jmp 0x62d9376a
lea r8, str.No_any_serial_number_of_harddisk_got
lea rcx, str..._src_platforms_windows_hdinfo.c
mov edx, 0x23e
call fcn.62d841f0
mov eax, 0xffffffff
jmp 0x62d93786
Function at 0x62d99200
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x62d9923a
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0
mov qword [rcx], 0
add rsp, 0x28
ret
lea rdx, str.src_hashes_md5.c
lea rcx, [0x62e0e2f1]
mov r8d, 0xe9
call fcn.62d9e1a0
nop
nop
nop word cs:[rax + rax]