joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14010d920
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jl 0x14010db0a
movsx r10, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd r10, edx
add r10, r10
lea rdx, [rax + r10]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
je 0x14010da3c
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx r8d, word [rsp + 0x18]
shr r8d, 0xf
movzx r10d, word [rsp + 0x1a]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx edx, word [rsp + 0x1c]
shr edx, 0xf
shl edx, 2
or edx, r8d
mov r8d, edx
movzx edx, word [rsp + 0x1e]
shr edx, 0xf
shl edx, 3
or edx, r8d
mov r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x14010db6d
add rax, 0x10
cmp rax, rdx
jbe 0x14010d951
mov r8d, r8d
test r8b, 7
je 0x14010db7a
movups xmm1, xmmword [rdx]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x14010db7a
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx edx, word [rsp + 2]
shr edx, 0xf
add edx, edx
or ecx, edx
movzx edx, word [rsp + 4]
shr edx, 0xf
shl edx, 2
or edx, ecx
mov ecx, edx
movzx edx, word [rsp + 6]
shr edx, 0xf
shl edx, 3
or edx, ecx
mov ecx, edx
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov edx, 0x20
test eax, eax
cmove ecx, edx
shr r10, 1
lea eax, [r10 + rcx]
jmp 0x14010db6d
xor eax, eax
cmp r8d, 4
jl 0x14010db57
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x14010db6d
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
jne 0x14010db33
inc eax
jmp 0x14010db6d
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
jne 0x14010db43
add eax, 2
jmp 0x14010db6d
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
jne 0x14010db53
add eax, 3
jmp 0x14010db6d
add rax, 4
test r8d, r8d
jle 0x14010db7a
movsx r9, dx
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
jne 0x14010db72
add rsp, 0x38
ret
inc rax
test r8d, r8d
jg 0x14010db60
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x140116400
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov esi, edx
xor edi, edi
mov ebp, dword [rbx + 8]
test ebp, ebp
jle 0x140116432
mov rcx, qword [rbx + rdi*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov ecx, esi
rol ecx, 0xd
add ecx, esi
mov esi, eax
xor esi, ecx
inc edi
cmp ebp, edi
jg 0x140116416
mov eax, esi
rol eax, 0xf
add eax, esi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
Function at 0x140655058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1406551df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140655089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065506f
add dl, dl
jne 0x140655096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406550f6
xor eax, eax
add dl, dl
jne 0x1406550a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406551ad
add dl, dl
jne 0x1406550b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406550c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406550d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406550dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406550ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14065507e
mov eax, 1
add dl, dl
jne 0x140655106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140655113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406550fb
sub eax, ebx
mov ebx, 1
jne 0x14065514c
mov ecx, 1
add dl, dl
jne 0x14065512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14065513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140655123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140655168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140655175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065515d
cmp eax, 0x7d00
jae 0x14065519b
cmp eax, 0x500
jb 0x140655196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065507e
cmp eax, 0x7f
ja 0x14065519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406551d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14065507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001124e
Capabilities:
Terminate process

Disassembly:
jmp 0x140013d40
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112e9
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015090
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400150b0
xor al, al
jmp 0x140015131
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400150c3
xor al, al
jmp 0x140015131
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400150ed
xor al, al
jmp 0x140015131
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015101
xor al, al
jmp 0x140015131
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015113
xor al, al
jmp 0x140015131
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001512f
xor al, al
jmp 0x140015131
mov al, 1
add rsp, 0x38
ret
Function at 0x140990058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409901df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140990089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14099006f
add dl, dl
jne 0x140990096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409900f6
xor eax, eax
add dl, dl
jne 0x1409900a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409901ad
add dl, dl
jne 0x1409900b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409900c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409900d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409900dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409900ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14099007e
mov eax, 1
add dl, dl
jne 0x140990106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140990113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409900fb
sub eax, ebx
mov ebx, 1
jne 0x14099014c
mov ecx, 1
add dl, dl
jne 0x14099012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14099013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140990123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14099007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140990168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140990175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14099015d
cmp eax, 0x7d00
jae 0x14099019b
cmp eax, 0x500
jb 0x140990196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14099007e
cmp eax, 0x7f
ja 0x14099019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14099007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409901d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14099007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180017ada
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x178]
mov r8, qword [rsp + 0x170]
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x160]
call fcn.180031271
jmp 0x18002f54f
loop 0x18002f553
add byte [rbx + 0x787f66f9], al
stc
jg 0x18002f5cf
je 0x18002f5c3
sub ecx, 0x60
je 0x18002f5b7
sub ecx, 1
je fcn.18002f5ab
lea rax, [0x1800b2708]
jmp 0x18005d8aa
lea rax, [0x1800b2658]
jmp 0x18005e7fd
sub ecx, 0x67
je 0x18002f61c
sub ecx, 1
je 0x18002f610
sub ecx, 1
je 0x18002f604
sub ecx, 1
je 0x18002f5f8
cmp ecx, 1
jne 0x18002fdfb
lea rax, [0x1800b2610]
jmp 0x18005e826
lea rax, str.Fu_P_f
jmp 0x18005e832
lea rax, [0x1800b2640]
jmp 0x18005e83e
invalid
lea rax, [0x1800b2628]
jmp 0x18005e84a
lea rax, [0x1800b2670]
jmp 0x18005e856
add byte [rdi], cl
mov dh, 0x44
and al, 0x22
add byte [rax - 0x7d], cl
rcl byte [rax], 0x48
mov edx, eax
push 0x5e9f0e8
add byte [rax + 0x48202444], cl
lea ecx, [rsp + 0xe8]
mov word [rax + rbp*8], fs
add byte [rax], al
add al, ch
sub edi, dword [rsi]
cld
dec dword [rdi]
mov dh, 0x44
and al, 0x20

Function at 0x180017e8b
Capabilities:
Query or enumerate registry value

Disassembly:
mov word [rax + rsi*2], fs
add dword [rax], eax
add al, ch
shl byte [rdx - 0x74b7ffff], 1
xchg esp, eax
and al, 0x78
add dword [rax], eax
add byte [rax - 0x75], cl
mov word [rax + rsi*2], fs
add dword [rax], eax
add al, ch
invalid

Function at 0x18001802d
Capabilities:
Query or enumerate registry value

Disassembly:
and al, 0xf8
add byte [rax], al
add al, ch
rcr byte [rbx], 0
movsx eax, byte [rax]
test eax, eax
jle 0x180018030
mov rax, qword [rsp + 0x58]
inc rax
mov qword [rsp + 0x58], rax
pop rax
jmp 0x180018035
mov byte [rsp + 0x41], 1
movzx eax, byte [rsp + 0x41]
test eax, eax
jne 0x180018103
cmp qword [rsp + 0x58], 0
jbe 0x180018103
mov rax, qword [rsp + 0x68]
movsx eax, byte [rax]
lea rcx, [rsp + 0xf8]
call fcn.18001dff0
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
mov ecx, dword [rsp + 0x170]
call fcn.180034785
movzx eax, al
test eax, eax
je 0x180018194
invalid
invalid
mov word [rax + rsi*2], fs

Function at 0x180018056
Capabilities:
Query or enumerate registry value

Disassembly:
cmp eax, 0x7f
jne 0x180018065
jmp 0x18002f563
mov rax, qword [rsp + 0x58]
dec rax
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x1800180a3
invalid
mov rax, qword [rsp + 0x68]
movsx eax, byte [rax]
mov dword [rsp + 0x78], eax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xf8]
add byte [rax], al
add al, ch
rcr byte [rbx], 0
movsx eax, byte [rax]
mov ecx, dword [rsp + 0x78]
and al, 0x78
cmp ecx, eax
jne 0x1800180d4
cmp qword [rsp + 0x58], 0
jne 0x1800180db
mov rax, qword [rsp + 0x68]
movsx eax, byte [rax]
mov dword [rsp + 0x7c], eax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xf8]
call fcn.18001dc89
movsx eax, byte [rax]
mov ecx, dword [rsp + 0x7c]
cmp ecx, eax
Function at 0x18002379b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
cmp qword [rsp + 0x30], 0
jl 0x1800237c1
xor byte [rax], al
jne 0x1800237a5
xor eax, eax
jmp 0x1800237af
invalid
invalid
invalid
invalid

Function at 0x18002e86e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea r12, [rcx + 0xf0]
mov esi, r8d
mov r14, r12
movaps xmmword [rax - 0x28], xmm6
sub r14, rdx
lea rbx, [rdx + 9]
dec rsi
mov rbp, rcx
shr rsi, 4
add al, 0x41
mov ebx, 4
inc rsi

Function at 0x18002f23a
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [0x1800b2d68]
jmp 0x18005d542
add byte [rax], al
add byte [rsi - 0x77], ah
mov word [rax + rdx*4], es
add byte [rax], al
add byte [rax + 2], bh

Function at 0x18003174e
Capabilities:
Link many functions at runtime

Disassembly:
add al, 0
mov rcx, rbx
mov qword [0x1800b3e70], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
invalid
invalid
invalid

Function at 0x180031c64
Capabilities:
Print debug messages

Disassembly:
add eax, 0xfffce399
jrcxz 0x180031c62
inc dword [rbx + 0x48005867]
lea ecx, [rdi + 0x28]
and dword [rdi + 0x58], 0
lea rcx, [rdi + 0x28]
and dword [rdi + 0x5c], 0
xor r8d, r8d
mov qword [rdi + 0x10], rax
xor edx, edx
mov qword [rdi + 8], rax
lea rax, [0x180078a30]
mov qword [rdi + 0x20], rax
mov dword [rdi], 0x60
mov dword [rdi + 0x18], 0xe00
call fcn.1800324bd
test eax, eax
jne 0x180031cd7
call qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x180031ca7
Capabilities:
Print debug messages

Disassembly:
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x180031cd7
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x180031cd0
lea rcx, str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x1800b53a8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800323f8
Capabilities:
Enumerate pe sections

Disassembly:
lea ecx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x180032462
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180032462
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
xor al, al

Function at 0x180035ad4
Capabilities:
Get thread local storage value

Disassembly:
sal byte [rsi + rcx + 0x48], 0x8b
enter 0xffffffffffff84e8, 0x1f
call fcn.180067a63

Function at 0x180035aed
Capabilities:
Get thread local storage value

Disassembly:
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
and byte [rdi - 0x3d], bl

Function at 0x180035af5
Capabilities:
Get thread local storage value

Disassembly:
and byte [rdi - 0x3d], bl
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x180078d18]
mov ecx, 6
lea r8, [0x180078d10]
lea eax, [0x180078d10]
lea rdx, str.FlsGetValue
call fcn.18006a7ab
mov rdi, rax
test rax, rax
je 0x180035b39
mov rcx, rax
call fcn.180067ab7
mov ecx, ebx
call rdi
jmp 0x180035b41
mov ecx, ebx
invalid
invalid
mov bh, 0xf8
Function at 0x180035b81
Capabilities:
Set thread local storage value

Disassembly:
lea edx, str.FlsSetValue
mov ecx, 7
lea r8, [0x180078d18]
call fcn.18006a807
mov rsi, rax

Function at 0x180035b98
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180035da0
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [rax], al
mov edi, esi
add rdi, rdi
add edi, edi
mov eax, dword [rbx + rdi*8 + 4]
cmp r15, rax
jb 0x180035e5e
mov eax, dword [rbx + rdi*8 + 8]
cmp r15, rax
cmp edi, eax
jae 0x180035e5e
cmp dword [rbx + rdi*8 + 0x10], 0
je 0x180035e5e
cmp dword [rbx + rdi*8 + 0xc], 1
je 0x180035dea
mov eax, dword [rbx + rdi*8 + 0xc]
lea rcx, [rsp + 0x30]
add rax, r12
mov rdx, r13
call rax
test eax, eax
js 0x180035e65
invalid
jle 0x180035e5e
cmp dword [rbp], 0xe06d7363
jne 0x180035e1b
cmp qword [0x180078b20], 0
je 0x180035e1b
lea rcx, [0x180078b20]
call 0x180087969
test eax, eax
je 0x180035e1b
mov edx, 1
mov rcx, rbp
call qword [0x180078b20]
mov ecx, dword [rbx + rdi*8 + 0x10]
mov r8d, 1
add byte [rax], al
add rcx, r12
mov rdx, r13
call fcn.18006b530
mov rax, qword [r14 + 0x40]
mov r8, rbp
mov edx, dword [rbx + rdi*8 + 0x10]
mov rcx, r13
mov r9d, dword [rbp]
add rdx, r12
mov qword [rsp + 0x28], rax
mov rax, qword [r14 + 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RtlUnwindEx]
call fcn.18006b58e
xor byte [rdi + 3], dl
invalid
inc esi
jmp 0x18006afff
xor eax, eax
jmp 0x18006b18d
movsb byte [rdi], byte [rsi]
add byte [rax], al
mov eax, 2
imul rax, rax, 2
rol byte [rdx], 0x48
mov dword [rsp + 0x38], eax
cmp qword [rsp + 0x38], 6
jae fcn.18006b01a
jmp 0x18006b01f

Function at 0x180035e23
Capabilities:
Query or enumerate registry value

Disassembly:
add byte [rax], al
mov edi, esi
add rdi, rdi
add edi, edi
mov eax, dword [rbx + rdi*8 + 4]
cmp r15, rax
jb 0x180035e5e
mov eax, dword [rbx + rdi*8 + 8]
cmp r15, rax
cmp edi, eax
jae 0x180035e5e
cmp dword [rbx + rdi*8 + 0x10], 0
je 0x180035e5e
cmp dword [rbx + rdi*8 + 0xc], 1
je 0x180035dea
mov eax, dword [rbx + rdi*8 + 0xc]
lea rcx, [rsp + 0x30]
add rax, r12
mov rdx, r13
call rax
test eax, eax
js 0x180035e65
invalid
jle 0x180035e5e
cmp dword [rbp], 0xe06d7363
jne 0x180035e1b
cmp qword [0x180078b20], 0
je 0x180035e1b
lea rcx, [0x180078b20]
call 0x180087969
test eax, eax
je 0x180035e1b
mov edx, 1
mov rcx, rbp
call qword [0x180078b20]
mov ecx, dword [rbx + rdi*8 + 0x10]
mov r8d, 1
add byte [rax], al
add rcx, r12
mov rdx, r13
call fcn.18006b530
mov rax, qword [r14 + 0x40]
mov r8, rbp
mov edx, dword [rbx + rdi*8 + 0x10]
mov rcx, r13
mov r9d, dword [rbp]
add rdx, r12
mov qword [rsp + 0x28], rax
mov rax, qword [r14 + 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_RtlUnwindEx]
call fcn.18006b58e
xor byte [rdi + 3], dl
invalid
inc esi
jmp 0x18006afff
xor eax, eax
jmp 0x18006b18d
movsb byte [rdi], byte [rsi]
add byte [rax], al
mov eax, 2
imul rax, rax, 2
rol byte [rdx], 0x48
mov dword [rsp + 0x38], eax
cmp qword [rsp + 0x38], 6
jae fcn.18006b01a
jmp 0x18006b01f
Function at 0x180035e6e
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r14
push r15
sub rsp, 0x40
mov r12, qword [r9 + 8]
mov rbp, rcx
mov r15, qword [r9]
mov rcx, r8
mov rbx, qword [r9 + 0x38]
sub r15, r12
mov r14, r9
mov rdi, r8
mov r13, rdx
call fcn.1800683c2
test byte [rbp + 4], 0x66
jne 0x180035e6c
mov esi, dword [r14 + 0x48]
mov qword [rsp + 0x30], rbp
and al, 0x30
mov qword [rsp + 0x38], rdi
cmp esi, dword [rbx]
jae 0x180035f1c
cmp dword [rdx + 1], 0
invalid
mov rsi, qword [r14 + 0x20]
mov edi, dword [r14 + 0x48]
sub rsi, r12
jmp 0x18006b18e
mov eax, 1
invalid
invalid
pop rsp
invalid

Function at 0x180048535
Capabilities:
Read file on windows

Disassembly:
push r14
push r15
sub rsp, 0x38
movsxd r13, ecx
lea r10, [0x1800b4c20]
mov rdi, r13
mov r15, r13
sar r15, 6
and edi, 0x3f
shl rdi, 6
mov r14, rdx
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
mov rcx, qword [rax + rdi + 0x28]
mov qword [rsp + 0x98], rcx
test r8, r8
je 0x1800484b8
cmp word [rdx], r9w
jne 0x1800484b8
or byte [rax + rdi + 0x38], 4
jmp 0x1800484bd
and byte [rax + rdi + 0x38], 0xfb
lea r12, [rdx + r8*2]
mov rsi, rdx
mov rbx, rdx
cmp rdx, r12
jae 0x180048672
lea rbp, [rdx + 2]
mov edx, 0xd
movzx eax, word [rsi]
cmp ax, 0x1a
clc
sbb cl, byte [rdi]
test byte [rsi + 1], ch
add byte [rax], al
cmp ax, dx
je 0x1800484ff
mov word [rbx], ax
add rbx, 2
add rsi, 2
add rbp, 2
jmp 0x18008fe98
cmp rbp, r12
jae 0x180048522
cmp word [rbp], r9w
jne 0x18004851d
add rsi, 4
mov word [rbx], r9w
add rbp, 4
add rbx, 2
jmp 0x180048599
mov word [rbx], dx
jmp 0x1800484ee
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x90]
mov r8d, 2
add byte [rax - 0x73], cl
xchg esp, eax
and al, 0x80
add byte [rax], al
add byte [rax - 0x7d], cl
mov byte [rdx], 0x48
add ebp, 2
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180048638
cmp dword [rsp + 0x90], 0
je 0x180048638
lea r10, [0x1800b4c20]
mov r9d, 0xa
mov rax, qword [r10 + r15*8]
test byte [rax + rdi + 0x38], 0x48
je 0x1800485df
movzx eax, word [rsp + 0x80]
cmp ax, r9w
jne 0x1800485a7
mov word [rbx], r9w
mov edx, 0xd
mov rcx, qword [rsp + 0x98]
cmp rsi, r12
jb 0x1800484d9
jmp 0x180090019
mov ecx, 0xd
mov word [rsp + 0x88], ax
mov word [rbx], cx
xor edx, edx
mov rcx, qword [r10 + r15*8]
mov al, byte [rsp + rdx + 0x88]
add rcx, rdi
mov byte [rcx + rdx + 0x3a], al
inc rdx
cmp rdx, 2
jl 0x1800485b9
mov rax, qword [r10 + r15*8]
mov byte [rax + rdi + 0x3c], r9b
cmp al, 0xeb
lodsd eax, dword [rsi]
cmp word [rsp + 0x80], r9w
jne 0x1800485f9
cmp rbx, r14
jne 0x1800485f9
mov word [rbx], r9w
add rbx, 2
jmp 0x18004858c
mov rdx, 0xfffffffffffffffe
mov ecx, r13d
lea r8d, [rdx + 3]
call 0x18009278c
mov r9d, 0xa
lea r10, [0x1800b4c20]
cmp word [rsp + 0x80], r9w
je 0x18004858c
lea edx, [r9 + 3]
mov word [rbx], dx
add rbx, 2
jmp 0x18008ffc9
mov edx, 0xd
lea r10, [0x1800b4c20]
mov word [rbx], dx
add rbx, 2
lea r9d, [rdx - 3]
jmp 0x18008ffe5
mov rcx, qword [r10 + r15*8]
mov al, byte [rcx + rdi + 0x38]
invalid
test al, 0x40
jne 0x180048668
or al, 2
mov byte [rcx + rdi + 0x38], al
jmp 0x180048672
movzx ecx, word [rsi]