joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3db0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x005ec2e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x005ec2c0]
test rbx, rbx
je 0x4d3e04
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4d3dfb
test r12, r12
je 0x4d3dfb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4d3de0
lea rcx, [0x005ec2e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4d4140
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0053ca20]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x4d41b9
mov rcx, r10
call fcn.004d4010
test eax, eax
je 0x4d41b9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x4d41b6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x4d41ad
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x4d41b9
add r8, 0x28
cmp r8, r9
jne 0x4d4198
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x4e6fe0
Capabilities:
Delete file
Move file

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x170
xor r12d, r12d
lea r13, [rsp + 0x28]
mov rbx, rcx
mov rbp, rdx
mov rsi, r8
mov rcx, r13
call fcn.004aeb57
mov rax, qword [rsp + 0x28]
lea rdx, [0x00536e1b]
mov qword [rsp + 0x40], 0
lea rcx, [rax + 4]
call sub.msvcrt.dll_fopen
mov qword [rsp + 0x38], rax
test rax, rax
je 0x4e720b
mov rax, qword [rsi]
lea rsi, [rsp + 0x38]
cmp dword [rax], 0
je 0x4e70d7
lea rdx, [rsp + 0x30]
mov r8d, 4
mov rcx, rsi
xor edi, edi
mov dword [rsp + 0x30], 0x4011f00d
call fcn.00518380
lea rdx, str.ERROR:_could_not_write_magic
test al, al
je 0x4e70a2
call sub.msvcrt.dll_rand
lea r12, [rsp + 0x48]
mov dword [r12 + rdi*4], eax
inc rdi
cmp rdi, 4
jne 0x4e706f
mov r8d, 0x20
mov rdx, r12
mov rcx, rsi
call fcn.00518380
test al, al
jne 0x4e70bb
lea rdx, str.ERROR:_could_not_write_nonce
mov rcx, qword [0x0053cb90]
call fcn.004d0ff9
mov rcx, rax
call fcn.004d13bf
jmp 0x4e71d0
lea rdi, [rsp + 0x68]
lea r8, [rbx + 0xa0]
mov rdx, r12
mov rcx, rdi
call fcn.00516830
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, rsi
mov dword [rsp + 0x20], 0xc01df00d
call fcn.00518380
mov r12d, eax
test al, al
jne 0x4e7119
mov rcx, qword [0x0053cb90]
lea rdx, str.ERROR:_could_not_write_magic
call fcn.004d0ff9
mov rcx, rax
call fcn.004d13bf
jmp 0x4e720b
mov rax, qword [rbx + 0x28]
lea r12, [rsp + 0x48]
add rbx, 0x20
lea r14, [rsp + 0x24]
mov qword [rsp + 0x30], rax
mov rdi, qword [rsp + 0x30]
cmp rdi, rbx
je 0x4e71d5
mov rcx, r12
call fcn.004cf836
lea rcx, [rdi + 0x20]
mov rdx, r12
call fcn.00429a4c
mov rax, qword [rsp + 0x50]
mov rdx, r14
mov rcx, rsi
sub rax, qword [rsp + 0x48]
mov r8d, 4
mov dword [rsp + 0x24], eax
call fcn.00518380
test al, al
jne 0x4e717e
lea rdx, str.ERROR:_could_not_write_size
jmp 0x4e719b
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x48]
mov rcx, rsi
call fcn.00518380
test al, al
jne 0x4e71b9
lea rdx, str.ERROR:_could_not_write_msg
mov rcx, qword [0x0053cb90]
call fcn.004d0ff9
mov rcx, rax
call fcn.004d13bf
mov rcx, r12
call fcn.004cf846
jmp 0x4e71d0
mov rcx, r12
call fcn.004cf846
lea rcx, [rsp + 0x30]
call fcn.004cfd0a
jmp 0x4e7130
xor r12d, r12d
jmp 0x4e720b
mov rcx, qword [rsp + 0x38]
call sub.msvcrt.dll_fclose
mov rdx, qword [rbp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], 0
mov r8d, 3
add rdx, 4
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
setne r12b
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x4e721a
call sub.msvcrt.dll_fclose
mov rcx, r13
call fcn.004cea4a
mov eax, r12d
add rsp, 0x170
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x4f5fa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x40
mov rbx, qword [0x0053cc00]
lea r8, [0x005383c6]
mov edx, 0x66
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, qword [rbx]
mov r12, rax
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdx, r12
mov rcx, qword [rbx]
mov r13, rax
lea r12, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, r13
lea r13, [rsp + 0x38]
mov dword [rsp + 0x2c], eax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r8d, dword [rsp + 0x2c]
mov rcx, r12
mov rdx, rax
call fcn.004cec42
lea rdx, str.RouterOS_Credits
mov rcx, r13
call fcn.004cec4e
mov rdx, r12
mov rcx, r13
call sym.winbox.exe_createBigMessageBox_string_const__string_const_
mov rbx, rax
test rax, rax
je 0x4f6039
mov rax, qword [rax]
mov rdx, qword [rax - 0x18]
add rdx, rbx
inc dword [rdx + 8]
mov rcx, r13
call fcn.004cea4a
mov rcx, r12
call fcn.004cea4a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
mov rax, qword [rbx]
add rbx, qword [rax - 0x18]
mov rcx, rbx
call fcn.00515350
nop
add rsp, 0x40
pop rbx
pop r12
pop r13
ret

Function at 0x4f6260
Capabilities:
Move file

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r12, rcx
lea r13, [rsp + 0x60]
lea rdi, [rsp + 0x50]
mov rsi, rdx
mov rcx, r13
lea rbp, [r12 + 0x1c8]
lea r14, [rsp + 0x58]
call fcn.004cf720
mov rdx, r13
mov rcx, rbp
call fcn.004aea23
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
cmp rbx, qword [rsp + 0x28]
je 0x4f6390
lea rdx, str..viw
mov rcx, rbx
call fcn.004b7301
test al, al
je 0x4f6387
lea rdx, str.settings.cfg.viw
mov rcx, rbx
call fcn.004b66ce
test al, al
jne 0x4f6387
lea r8, [0x00538100]
mov rdx, rsi
lea r15, [rsp + 0x40]
mov rcx, rdi
call fcn.004b65fc
mov r8, rbx
mov rdx, rdi
mov rcx, r14
call fcn.004b66e1
mov rax, qword [rsp + 0x58]
mov rdx, rbp
mov rcx, r15
lea r8, [0x00538100]
lea r10, [rax + 4]
mov qword [rsp + 0x38], r10
call fcn.004b65fc
lea r11, [rsp + 0x48]
mov r8, rbx
mov rdx, r15
mov rcx, r11
mov qword [rsp + 0x30], r11
call fcn.004b66e1
mov r10, qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov r8d, 3
mov rdx, r10
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
mov r11, qword [rsp + 0x30]
mov rcx, r11
call fcn.004cea4a
mov rcx, r15
call fcn.004cea4a
mov rcx, r14
call fcn.004cea4a
mov rcx, rdi
call fcn.004cea4a
add rbx, 8
jmp 0x4f62af
lea r15, [rsp + 0x58]
mov rcx, r15
call fcn.004b7609
mov rax, qword [rsp + 0x58]
lea rdx, [0x005384e0]
lea rcx, [rax + 4]
call sub.msvcrt.dll_fopen
mov rcx, r15
mov r14, rax
call fcn.004cea4a
test r14, r14
je 0x4f63e4
mov rdx, rsi
mov rcx, r12
call fcn.004f7e00
mov rcx, qword [rsi]
mov rdx, r14
add rcx, 4
call sub.msvcrt.dll_fputs
mov rcx, r14
call sub.msvcrt.dll_fclose
mov rcx, r13
call fcn.004b7af2
nop
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4f9410
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x78
lea r12, [rsp + 0x68]
lea r15, [rcx + 0x198]
mov r13, rcx
lea r14, [rsp + 0x48]
mov rcx, r12
lea rbx, [rsp + 0x50]
call fcn.004cebac
mov r9, r12
mov rdx, r15
mov rcx, r14
mov r8d, 0x200003f0
call fcn.00428e30
mov rcx, r12
call fcn.004cea4a
mov rcx, r12
call fcn.004cebac
mov r9, r12
mov rdx, r15
mov rcx, rbx
mov r8d, 0x200003ef
call fcn.00428e30
mov rcx, r12
call fcn.004cea4a
mov rax, qword [rsp + 0x50]
cmp dword [rax], 0
je 0x4f949c
mov r8, r14
mov rdx, rbx
mov rcx, r13
call fcn.004f8a80
jmp 0x4f959c
mov rcx, r12
lea r15, [rsp + 0x58]
call fcn.004b75cb
mov rdx, r12
mov rcx, r15
call fcn.004b6ac6
mov rcx, r12
call fcn.004cea4a
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0
jne 0x4f9500
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.004ae909
lea r8, str.Addresses.cdb
mov rdx, rsi
mov rcx, r12
call fcn.004b65fc
mov rdx, r12
mov rcx, r15
call fcn.004cef0e
mov rcx, r12
call fcn.004cea4a
mov rcx, rsi
call fcn.004cea4a
mov r8, r14
mov rdx, r15
mov rcx, r13
call fcn.004f8a80
mov rax, qword [rsp + 0x58]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x30], 0
mov r8d, 1
lea rcx, [rax + 4]
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x4f958e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4f9594
lea r13, [rsp + 0x60]
mov rcx, r13
call fcn.004ae909
lea r8, str.winbox.cfg
mov rdx, r13
mov rcx, r12
call fcn.004b65fc
mov rcx, r12
call fcn.004b6a14
mov rcx, r12
call fcn.004cea4a
mov rcx, r13
call fcn.004cea4a
jmp 0x4f9594
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r15
call fcn.004cea4a
mov rcx, rbx
call fcn.004cea4a
mov rcx, r14
call fcn.004cea4a
nop
add rsp, 0x78
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x5176c0
Capabilities:
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea r12, [rsp + 0x40]
mov r15, rcx
mov rcx, r12
call fcn.004cf8f2
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
sub rbx, rcx
call fcn.004d20e2
cmp eax, ebx
jne 0x517712
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rsp + 0x40]
mov eax, 1
mov rcx, r12
add edx, edx
cmove edx, eax
call fcn.004cf960
mov rax, qword [rsp + 0x48]
lea rbx, [rsp + 0x50]
mov rcx, rbx
lea rdx, [rax + 1]
mov qword [rsp + 0x48], rdx
mov rdx, r15
mov byte [rax], 0
mov r9d, dword [rsp + 0x40]
mov rax, qword [r15]
mov r8, qword [rsp + 0x40]
not r9d
add r9d, dword [rsp + 0x48]
call qword [rax + 0x18]
lea rcx, [r15 + 0x60]
mov rdx, rbx
call fcn.004cef0e
mov rcx, rbx
call fcn.004cea4a
mov rax, qword [r15 + 0x60]
cmp dword [rax], 0
je 0x517781
mov rcx, qword [r15 + 0x30]
or r13d, 0xffffffff
test rcx, rcx
je 0x51787d
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x10]
jmp 0x51787d
mov rax, qword [r15 + 0x18]
mov rdi, qword [r15 + 0x10]
lea r13, [rsp + 0x3c]
mov dword [r15 + 0x38], 0
mov dword [r15 + 0x58], 0
lea rbp, [0x00538154]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], rdi
je 0x517871
mov r8, rdi
mov rdx, r15
mov rcx, rbx
mov r14d, dword [rdi + 0x14]
call fcn.005175e0
mov rax, qword [rsp + 0x50]
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
mov esi, eax
call fcn.004cea4a
inc esi
je 0x51785d
mov r8, rdi
mov rdx, r15
mov rcx, rbx
call fcn.005173e0
mov rax, qword [rsp + 0x50]
mov rdx, rbp
lea rcx, [rax + 4]
call sub.msvcrt.dll_fopen
mov rcx, rbx
mov rsi, rax
call fcn.004cea4a
test rsi, rsi
je 0x51785d
mov edx, 0x10
mov r8, rsi
mov rcx, rbx
call sub.msvcrt.dll_fgets
mov rcx, rsi
mov qword [rsp + 0x28], rax
call sub.msvcrt.dll_fclose
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x51785d
mov r8, r13
lea rdx, [0x005384c7]
mov rcx, rbx
call sub.msvcrt.dll_sscanf
dec eax
jne 0x51785d
cmp r14d, dword [rsp + 0x3c]
jne 0x51785d
mov byte [rdi + 0x18], 1
jmp 0x517868
mov byte [rdi + 0x18], 0
mov eax, dword [rdi + 0x10]
add dword [r15 + 0x58], eax
add rdi, 0x20
jmp 0x5177aa
mov rcx, r15
call fcn.005178a0
mov r13d, dword [r15 + 0x58]
mov rcx, r12
call fcn.004cf846
mov eax, r13d
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x518260
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x28
xor r13d, r13d
mov r9, qword [rcx]
mov r12, rdx
mov rsi, rcx
mov edx, r8d
mov r8d, 1
mov rcx, r12
mov rbx, rdx
call sub.msvcrt.dll_fread
dec rax
jne 0x5182a9
mov rcx, qword [rsi + 8]
mov r13b, 1
test rcx, rcx
je 0x5182a9
mov r9d, ebx
mov r8, r12
mov rdx, r12
call fcn.004bfea6
mov eax, r13d
add rsp, 0x28
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x51cbc0
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x278
lea r14, [rcx + 0x78]
mov rbx, rcx
lea r13, [rsp + 0x66]
lea r12, [rsp + 0x16b]
mov rcx, r14
call fcn.004a7cb0
mov rdx, r13
mov ecx, 0x105
mov byte [rbx + 0x112c], 0
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
xor r8d, r8d
mov r9, r12
mov rcx, r13
lea rdx, [0x0053704a]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea rcx, [rbx + 0x1110]
mov rdx, r12
call fcn.004ceeca
xor r8d, r8d
xor r9d, r9d
mov edx, 0x1201bf
mov qword [rsp + 0x30], 0
mov rcx, r12
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileA]
xor r8d, r8d
mov qword [rbx + 0x1120], rax
inc rax
je 0x51cd0b
mov dword [rbx + 0x1100], 2
lea r12, [rsp + 0x58]
lea rdx, str.Downloading...
mov dword [rbx + 0x1128], 0
mov rcx, r12
lea r13, [rsp + 0x50]
call fcn.004cec4e
mov rdx, r12
mov rcx, rbx
call fcn.0051ca40
mov rcx, r12
call fcn.004cea4a
mov r8, qword [rbx + 0x1120]
lea rdx, str.http:__upgrade.mikrotik.com_routeros_winbox_
mov rcx, r13
mov qword [rsp + 0x48], r8
call fcn.004cec4e
lea rdx, [rbx + 0x1108]
mov rcx, r13
call fcn.004cedc2
mov rdx, r13
mov rcx, r12
call fcn.004cebf6
lea rdx, str._winbox64.exe
mov rcx, r12
call fcn.004cedda
mov r8, qword [rsp + 0x48]
mov rdx, r12
mov rcx, r14
call fcn.004a8082
mov rcx, r12
call fcn.004cea4a
mov rcx, r13
call fcn.004cea4a
mov r8b, 1
mov eax, r8d
add rsp, 0x278
pop rbx
pop r12
pop r13
pop r14
ret
Function at 0x14001c760
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400263a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14001c780
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14001c788
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14001c780
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x14001c7d5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14001c7cc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14001c780
add rax, 0x28
cmp rax, r9
jne 0x14001c7b8
xor eax, eax
ret

Function at 0x14001c7e0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400263a0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14001c800
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14001c808
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x14001c800
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x14001c890
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400263a0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x14001c8b0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x14001c8b8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140ed80e4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140ed80ee
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140ed8117
pop rbp
sub rbp, 0x33
sub rbp, 0xed80e4
sub rsp, 0x20
jmp 0x140ed8136
mov rax, 0xed80e4
add rax, rbp
add rax, 0x84
mov rcx, 0x60e
mov rdx, 0x37eaf86d
xor byte [rax], dl
inc rax
dec rcx
jne 0x140ed8155
jmp 0x140ed816c
and eax, 0xe4e684e4
push rcx
insd dword [rdi], dx
insd dword [rdi], dx
insd dword [rdi], dx
and eax, 0x6c65acec
insd dword [rdi], dx
insd dword [rdi], dx
and eax, 0xaa25846c
lodsd eax, dword [rsi]
outsb dx, byte [rsi]
insd dword [rdi], dx
insd dword [rdi], dx
insd dword [rdi], dx
and eax, 0x6d45afaa
insd dword [rdi], dx
insd dword [rdi], dx
and eax, 0x6c258f9a
lodsb al, byte [rsi]
out 0xec, al
invalid
Function at 0x180002d40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x90]
sub eax, 0xd5c
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x1020
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x26d3
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x159e
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x70]
xor eax, 0x26d3
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x90]
sub eax, 0x28d2
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x8e1
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x88]
xor eax, 0x3a15
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x80]
sub eax, 0x26d3
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x159e
cmp dword [rsp + 0x28], eax
jg 0x180002e34
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x9c]
sub eax, 0x962ff
mov rcx, qword [rsp + 0x78]
mov ecx, dword [rcx + 0x28]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x78]
mov dword [rcx + 0x28], eax
mov eax, dword [rsp + 0x24]
add eax, 0xb5d
mov dword [rsp + 0x24], eax
jmp 0x180002ed3
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x90]
mov dword [rsp + 0x20], eax
jmp 0x180002e50
mov eax, dword [rsp + 0x20]
add eax, 3
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
cmp dword [rsp + 0x20], eax
jge 0x180002ed3
mov eax, dword [rsp + 0x38]
sub eax, 0x19b1
sub eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0x3c]
mov ecx, dword [rcx + 0x38]
sub ecx, eax
mov eax, ecx
mov ecx, 4
imul rcx, rcx, 3
mov rdx, qword [rsp + 0x78]
and eax, dword [rdx + rcx + 0xa4]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x48]
sub eax, 0x21d2
mov dword [rsp + 0x3c], eax
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x180002e45
mov eax, dword [rsp + 0x2c]
add eax, 0x2ddb
add rsp, 0x68
ret
Function at 0x180004670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x68
mov eax, dword [rsp + 0x98]
sub eax, 0x8ea
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0xa0]
sub eax, 0x297d
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x70]
sub eax, 0x121f
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x70]
sub eax, 0xf21
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x80]
xor eax, 0x15b2
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xa0]
xor eax, 0x297d
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x98]
sub eax, 0x63c
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x13cb
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x98]
xor eax, 0x229b
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x24]
add eax, 0x13cb
cmp dword [rsp + 0x2c], eax
je 0x180004805
mov eax, dword [rsp + 0x24]
sub eax, 0x14
cmp dword [rsp + 0x2c], eax
jle 0x180004753
mov rax, qword [rsp + 0x78]
lea rcx, [0x1800b00e0]
mov qword [rax + 0x70], rcx
mov eax, dword [rsp + 0x20]
sub eax, 0x3ff
mov dword [rsp + 0x20], eax
jmp 0x180004805
mov eax, dword [rsp + 0x30]
or eax, 0x2ddb
mov rcx, qword [rsp + 0x78]
sub eax, dword [rcx + 0x2c]
cmp dword [rsp + 0x20], eax
jb 0x180004805
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x28], eax
jmp 0x180004783
mov eax, dword [rsp + 0x28]
add eax, 4
mov dword [rsp + 0x28], eax
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx + rax + 0xa4]
add eax, dword [rsp + 0x34]
and eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jbe 0x180004805
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x78]
mov eax, dword [rdx + rax + 0xa4]
mov ecx, dword [rcx + 0x98]
xor ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x98]
mov ecx, dword [rsp + 0x38]
or ecx, eax
mov eax, ecx
sub eax, 0x2ddb
mov eax, eax
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x180004778
mov eax, dword [rsp + 0x3c]
add eax, 0x19a5
add rsp, 0x68
ret
Function at 0x180008240
Capabilities:
Get file attributes
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov eax, dword [rsp + 0x68]
sub eax, 0x64c
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x78]
xor eax, 0x26d3
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x80]
sub eax, 0xc20
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x88]
sub eax, 0x21d2
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x68]
sub eax, 0xd5c
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x68]
sub eax, 0x28d2
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x78]
add eax, 0x708
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x2c]
xor eax, 0x297d
cmp dword [rsp + 0x20], eax
jg 0x1800082dd
mov eax, dword [rsp + 0x20]
xor eax, 0x19a5
mov dword [rsp + 0x20], eax
jmp 0x180008330
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x24], eax
jmp 0x1800082f2
mov eax, dword [rsp + 0x24]
add eax, 4
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x34]
and eax, 0x26d3
mov rcx, qword [rsp + 0x70]
or eax, dword [rcx + 0x90]
cmp dword [rsp + 0x24], eax
jb 0x180008330
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x2c]
mov ecx, dword [rsp + 0x28]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1800082e7
mov eax, dword [rsp + 0x28]
sub eax, 0xd5c
add rsp, 0x58
ret