joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180044de0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x18009b040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180044f0b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180044f02
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x180044ee4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180044ee4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180044ee4
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180044ea2
mov rcx, qword [0x1800c5470]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180044f02
jmp 0x180044ed7
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180044ed7
mov rcx, qword [0x1800c5470]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180044f02
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x180044e50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x180044f63
cmp dword [rbx + 0xc], esi
jbe 0x180044f63
nop word [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180044f5c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.180044c30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x180044f20
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18007bd10
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180044f90
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x18009b040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800c5b50]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180045003
mov eax, 0xa
jmp 0x180045096
test esi, esi
je 0x180045025
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180045048
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180045048
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180045041
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180045048
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
shl sil, 2
add cl, cl
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
and sil, 4
xor sil, cl
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18007bd10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800450c0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, ecx
mov ecx, dword [0x1800c5b5c]
mov ebx, edi
test ecx, ecx
je 0x1800451fb
mov rax, qword [0x1800c5b50]
add rax, 0x20
nop
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180045118
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800450f0
mov eax, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x1800451fb
mov r8d, edi
lea rcx, [rsp + 0x20]
test esi, esi
mov edx, 0xffffffff
setne r8b
call fcn.180044de0
mov r8d, dword [0x1800c5b5c]
cmp ebx, r8d
jae 0x180045188
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1800c5b50]
movzx edx, byte [rcx + rax + 0x20]
shr edx, 1
and edx, 1
cmp edx, esi
je 0x180045181
mov edx, esi
mov ecx, ebx
call fcn.180044f90
mov edi, eax
test eax, eax
jne 0x180045188
mov r8d, dword [0x1800c5b5c]
inc ebx
cmp ebx, r8d
jb 0x180045150
cmp qword [rsp + 0x20], 0
je 0x1800451fb
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800451e7
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax]
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800451d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800451b0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800c5470]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x48]
mov eax, edi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180045570
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x1800c5468], ebp
je 0x1800455c7
cmp rbx, 0x20
jae 0x1800455b0
xor ecx, ecx
jmp 0x1800455b2
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800c5468], ebp
jne 0x1800455a6
cmp qword [0x1800c5470], r15
je 0x1800456c1
test rdi, rdi
jne 0x1800455e7
mov ecx, esi
call fcn.1800450c0
mov ebp, eax
jmp 0x1800456c6
mov ecx, dword [0x1800c5b5c]
mov ebx, r15d
test ecx, ecx
je 0x18004560f
mov r8, qword [0x1800c5b50]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180045619
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180045600
mov ebp, 4
jmp 0x1800456c6
cmp ebx, 0xffffffff
je 0x18004560f
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x1800456b8
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180044de0
mov edx, esi
mov ecx, ebx
call fcn.180044f90
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x1800456c6
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800456a2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180045698
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180045670
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800c5470]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800456c6
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x1800456c6
mov ebp, 2
xchg dword [0x1800c5468], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x18004a720
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
cmp byte [0x1800c546c], 0
mov rbx, rdx
mov rdi, rcx
je 0x18004a791
movss xmm2, dword [0x18009b2f0]
movss xmm1, dword [0x1800c5690]
movaps xmm0, xmm2
movss xmm3, dword [rdx]
addss xmm0, xmm1
comiss xmm3, xmm0
ja 0x18004a784
subss xmm1, xmm2
comiss xmm1, xmm3
ja 0x18004a784
movss xmm1, dword [0x1800c5694]
movss xmm3, dword [rdx + 4]
movaps xmm0, xmm1
addss xmm0, xmm2
comiss xmm3, xmm0
ja 0x18004a784
subss xmm1, xmm2
comiss xmm1, xmm3
jbe 0x18004a791
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18004a915
mov rax, qword [0x1800c54d0]
test rax, rax
jne 0x18004a7ba
mov qword [0x1800c54d0], rdi
jmp 0x18004a7c3
cmp rax, rdi
jne 0x18004a920
cvttss2si eax, dword [0x18009b2e4]
movss xmm5, dword [0x1800c56e4]
xorps xmm4, xmm4
mulss xmm5, dword [0x18008f3c0]
add eax, 3
movaps xmmword [rsp + 0x50], xmm6
xorps xmm3, xmm3
movss xmm6, dword [0x1800c56e0]
xorps xmm2, xmm2
mulss xmm6, dword [0x18008f3c0]
movaps xmmword [rsp + 0x40], xmm7
movss xmm7, dword [rbx + 4]
movaps xmmword [rsp + 0x30], xmm8
movss xmm8, dword [rbx]
ucomiss xmm8, xmm4
jp 0x18004a819
je 0x18004a877
comiss xmm8, xmm6
jbe 0x18004a84f
movaps xmm3, xmm6
movd xmm0, eax
subss xmm3, xmm8
cvtdq2ps xmm0, xmm0
xorps xmm3, xmmword [0x18008f720]
divss xmm3, xmm0
movaps xmm0, xmm6
movaps xmm1, xmm3
addss xmm0, xmm6
addss xmm1, xmm6
comiss xmm1, xmm0
jbe 0x18004a84f
xorps xmm3, xmm3
comiss xmm6, xmm8
jbe 0x18004a877
movaps xmm3, xmm8
movd xmm0, eax
subss xmm3, xmm6
cvtdq2ps xmm0, xmm0
divss xmm3, xmm0
movaps xmm1, xmm3
addss xmm1, xmm6
comiss xmm4, xmm1
jbe 0x18004a877
xorps xmm3, xmm3
ucomiss xmm7, xmm4
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x50]
jp 0x18004a889
je 0x18004a8e3
comiss xmm7, xmm5
jbe 0x18004a8bd
movaps xmm2, xmm5
movd xmm0, eax
subss xmm2, xmm7
cvtdq2ps xmm0, xmm0
xorps xmm2, xmmword [0x18008f720]
divss xmm2, xmm0
movaps xmm0, xmm5
movaps xmm1, xmm2
addss xmm0, xmm5
addss xmm1, xmm5
comiss xmm1, xmm0
jbe 0x18004a8bd
xorps xmm2, xmm2
comiss xmm5, xmm7
jbe 0x18004a8e3
movaps xmm2, xmm7
movd xmm0, eax
subss xmm2, xmm5
cvtdq2ps xmm0, xmm0
divss xmm2, xmm0
movaps xmm1, xmm2
addss xmm1, xmm5
comiss xmm4, xmm1
jbe 0x18004a8e3
xorps xmm2, xmm2
xor r9d, r9d
mov qword [rsp + 0x20], 0
cvttss2si r8, xmm2
lea ecx, [r9 + 1]
cvttss2si rdx, xmm3
call qword [sym.imp.USER32.dll_mouse_event]
movaps xmm7, xmmword [rsp + 0x40]
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov qword [0x1800c54d0], 0
mov rbx, qword [rsp + 0x70]
mov al, 1
add rsp, 0x60
pop rdi
ret
Function at 0x18004e380
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18004e3b3
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x18004e350]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x180055ac0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x110
mov rax, qword [0x18009b040]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rsi, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.180054f60
mov r8, rax
test rax, rax
je 0x180055b12
mov rdx, qword [rsp + 0x20]
mov al, 3
sub r8, rbx
mov qword [rsi], rdx
mov byte [rsi + 8], al
lea rax, [r8 + 1]
jmp 0x180055c67
lea rdx, [0x18007ffe0]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strpbrk
test rax, rax
je 0x180055b35
movzx eax, byte [rax]
or eax, 0x20
cmp eax, 0x6e
je 0x180055c65
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtod
mov rax, qword [rsp + 0x20]
lea rbp, [0x180082da0]
cmp rax, rbx
je 0x180055b84
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x180055b72
nop dword [rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x180055b60
xor r8d, r8d
test cl, cl
cmove r8, rax
test r8, r8
jne 0x180055c53
mov edx, 0x2e
mov rcx, rbx
call sub.VCRUNTIME140.dll_strchr
mov rdi, rax
test rax, rax
je 0x180055c65
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x180055ba4
cmp rcx, 0xc8
ja 0x180055c65
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180055bd0
call sub.api_ms_win_crt_locale_l1_1_0.dll_localeconv
sub rdi, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rdi + 0x30], al
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtod
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x180055c65
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x180055c32
nop dword [rax + rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x180055c20
xor r8d, r8d
test cl, cl
cmove r8, rax
test r8, r8
je 0x180055c65
lea rcx, [rsp + 0x30]
mov rax, rbx
sub rax, rcx
add r8, rax
test r8, r8
je 0x180055c65
mov al, 0x13
movsd qword [rsi], xmm0
sub r8, rbx
mov byte [rsi + 8], al
lea rax, [r8 + 1]
jmp 0x180055c67
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.18007bd10
mov rbx, qword [rsp + 0x140]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005b530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x18005b63f
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x180000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x18005b59a.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x18005b59a.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x18005b59a.8
cdqe
movzx eax, byte [rdi + rax + 0x5b654]
mov ecx, dword [rdi + rax*4 + 0x5b640]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x18005b59a.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x18005b5bd
and dl, 0xc7
jmp 0x18005b5c3
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x18005b59a.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x18005b59a.8
mov rcx, rbx
call fcn.18005bc60
jmp case.0x18005b59a.8
cmp word [r10 + 0xa], 0
jne case.0x18005b59a.5
mov rdx, qword [r10 + 0x18]
test rdx, rdx
je 0x18005b5ff
test byte [rdx + 9], 0x18
je 0x18005b5ff
mov rcx, rbx
call fcn.18005bc60
and byte [r10 + 9], 0xe7
or byte [r10 + 9], 0x20
jmp case.0x18005b59a.8
mov rcx, r10
call fcn.18005aa40
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x18005b553
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x18005d0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, 1
movzx ecx, byte [rdx + 0xb]
mov rdi, rdx
shl eax, cl
mov rcx, rdx
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
call fcn.18005e900
test eax, eax
je 0x18005d158
xor r10d, r10d
mov r11d, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x18005d14e
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x18005d14e
mov rcx, rbx
call fcn.18005bc60
add r10, 0x10
sub r11, 1
jne 0x18005d130
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x18005d1af
test byte [r10 + 8], 0xf
movzx eax, byte [r10 + 9]
jne 0x18005d178
test al, 0x40
je 0x18005d1a6
mov byte [r10 + 9], 0xb
jmp 0x18005d1a6
test al, 0x40
je 0x18005d18e
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x18005d18e
mov rcx, rbx
call fcn.18005bc60
test byte [r10 + 8], 0x40
je 0x18005d1a6
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x18005d1a6
mov rcx, rbx
call fcn.18005bc60
add r10, 0x18
cmp r10, rsi
jb 0x18005d161
movzx eax, byte [rdi + 9]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x18005d1eb
mov rcx, rdi
call fcn.18005aa40
mov rcx, qword [rbx + 0x90]
mov qword [rax], rcx
mov qword [rbx + 0x90], rdi
and byte [rdi + 9], 0xc7
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x18005d1f5
xor al, 2
mov byte [rdi + 9], al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18005d6e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r10, rcx
xor eax, r8d
test rdx, rdx
je 0x18005d711
nop dword [rax]
movzx r9d, byte [r10 + rdx - 1]
mov r8d, eax
shl r8d, 5
mov ecx, eax
add r9d, r8d
shr ecx, 2
add r9d, ecx
xor eax, r9d
sub rdx, 1
jne 0x18005d6f0
ret

Function at 0x18005d980
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x18005d9a5
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.18005d410
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x18005da0d
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, 0x14
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.18005aeb0
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.1800654c0
int3
Function at 0x18006a590
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x18009b040]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov r13d, r8d
mov rbp, rdx
mov rbx, rcx
call fcn.180050510
mov rcx, rbp
mov r15d, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_clearerr
mov rcx, rbx
sub r15d, 1
jne 0x18006a60c
mov r8d, 1
mov rdx, rbp
call fcn.18006adc0
mov esi, eax
lea r14d, [r13 + 1]
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
test eax, eax
je 0x18006a795
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.180052560
jmp 0x18006a7b2
lea edx, [r15 + 0x14]
lea r8, str.too_many_arguments
call fcn.180052230
mov esi, 1
mov r14d, r13d
dec r15d
test esi, esi
je 0x18006a5ea
mov edx, r14d
mov rcx, rbx
call fcn.180051620
mov edx, r14d
mov rcx, rbx
cmp eax, 3
jne 0x18006a6d0
call fcn.180052010
mov rdi, rax
test rax, rax
jne 0x18006a683
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_getc
mov rdx, rbp
mov ecx, eax
mov edi, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ungetc
lea rdx, [0x180083490]
mov rcx, rbx
call fcn.180050b60
xor esi, esi
cmp edi, 0xffffffff
setne sil
jmp 0x18006a773
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180051f60
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180052eb0
mov r9, rbp
mov r8, rdi
mov edx, 1
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rdi, rax
call fcn.180052ec0
xor esi, esi
test rdi, rdi
setne sil
jmp 0x18006a773
xor r8d, r8d
call fcn.1800520a0
movzx ecx, byte [rax]
cmp cl, 0x2a
jne 0x18006a6e4
movzx ecx, byte [rax + 1]
cmp cl, 0x4c
je 0x18006a763
cmp cl, 0x61
je 0x18006a711
cmp cl, 0x6c
je 0x18006a709
cmp cl, 0x6e
mov rcx, rbx
jne 0x18006a784
mov rdx, rbp
call fcn.18006aee0
jmp 0x18006a771
mov r8d, 1
jmp 0x18006a766
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180051f60
nop
mov edx, 0x400
lea rcx, [rsp + 0x20]
call fcn.180052eb0
mov r9, rbp
mov edx, 1
mov r8d, 0x400
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add qword [rsp + 0x30], rax
cmp rax, 0x400
je 0x18006a720
lea rcx, [rsp + 0x20]
call fcn.180052ec0
mov esi, 1
jmp 0x18006a773
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.18006adc0
mov esi, eax
inc r14d
test r15d, r15d
jne 0x18006a624
jmp 0x18006a5ea
lea r8, str.invalid_format
mov edx, r14d
call fcn.180051e50
jmp 0x18006a7b2
test esi, esi
jne 0x18006a7ac
lea edx, [rsi - 2]
mov rcx, rbx
call fcn.180051190
mov rcx, rbx
call fcn.180050b30
sub r14d, r13d
mov eax, r14d
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18007bd10
add rsp, 0x450
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180073650
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rsi
push r15
sub rsp, 0x478
mov rax, qword [0x18009b040]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov qword [r11 - 0x18], rbx
mov r15, rdx
mov qword [r11 - 0x20], rbp
lea rdx, str._s_s
mov qword [r11 - 0x28], rdi
mov rbx, r8
mov qword [r11 - 0x30], r14
mov rsi, rcx
mov r14, r9
lea r9, str._5_4
call fcn.180050a40
mov rcx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov rdi, rax
test rax, rax
jne 0x1800736c2
mov rcx, rbx
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov rdi, rax
test rax, rax
je 0x1800737e7
lea r8, str.LUA_NOENV
mov edx, 0xfff0b9d8
mov rcx, rsi
call fcn.1800502a0
mov edx, 0xffffffff
mov rcx, rsi
call fcn.180051350
mov edx, 0xfffffffe
mov rcx, rsi
mov ebx, eax
call fcn.180051190
test ebx, ebx
jne 0x1800737e7
lea rdx, [0x180082b64]
mov rcx, rdi
call sub.VCRUNTIME140.dll_strstr
mov rbp, rax
test rax, rax
jne 0x180073719
mov rdx, rdi
jmp 0x1800737ea
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], 0
jne 0x180073720
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180051f60
cmp rdi, rbp
jae 0x18007377c
mov r8, rbp
lea rcx, [rsp + 0x20]
sub r8, rdi
mov rdx, rdi
call fcn.180051d20
mov rcx, qword [rsp + 0x30]
cmp rcx, qword [rsp + 0x28]
jb 0x18007376e
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.180052eb0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov byte [rax + rcx], 0x3b
inc qword [rsp + 0x30]
mov rdx, r14
lea rcx, [rsp + 0x20]
call fcn.180051d70
lea rax, [rdi - 2]
add rax, rbx
cmp rbp, rax
jae 0x1800737db
mov rcx, qword [rsp + 0x30]
cmp rcx, qword [rsp + 0x28]
jb 0x1800737b5
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.180052eb0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x20]
lea rdx, [rbp + 2]
sub rbx, rbp
mov byte [rax + rcx], 0x3b
lea rcx, [rsp + 0x20]
inc qword [rsp + 0x30]
lea r8, [rbx - 2]
add r8, rdi
call fcn.180051d20
lea rcx, [rsp + 0x20]
call fcn.180052ec0
jmp 0x1800737f2
mov rdx, r14
mov rcx, rsi
call fcn.180050b60
mov r8d, 0x105
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov r14, qword [rsp + 0x458]
mov rdi, qword [rsp + 0x460]
mov rbp, qword [rsp + 0x468]
mov rbx, qword [rsp + 0x470]
test eax, eax
je 0x18007388d
cmp eax, 0x105
je 0x18007388d
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x18007388d
xor r8d, r8d
mov byte [rax], 0
mov rcx, rsi
lea edx, [r8 - 1]
call fcn.180051430
mov rdx, rax
lea r9, [rsp + 0x20]
lea r8, [0x180082b28]
mov rcx, rsi
call fcn.180052710
mov edx, 0xfffffffe
mov rcx, rsi
lea r8d, [rdx + 1]
call fcn.180050e50
mov edx, 0xfffffffe
mov rcx, rsi
call fcn.180051190
jmp 0x18007389c
lea rdx, str.unable_to_get_ModuleFileName
mov rcx, rsi
call fcn.180052410
mov r8, r15
mov edx, 0xfffffffd
mov rcx, rsi
call fcn.180050f40
mov edx, 0xfffffffe
mov rcx, rsi
call fcn.180051190
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.18007bd10
add rsp, 0x478
pop r15
pop rsi
ret