joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004aae0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800cb040]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, r8d
mov rsi, rdx
xor r9d, r9d
cmp ecx, 0x7b
ja 0x18004ab21
movsxd rax, ecx
lea r9, str.keybind
mov r9, qword [r9 + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
test r9, r9
jne 0x18004ab67
mov qword [rbp - 0x18], 0xa
movsd xmm0, qword [str.Select_Key]
movsd qword [rbp - 0x28], xmm0
movzx eax, word [0x1800b7220]
mov word [rbp - 0x20], ax
mov byte [rbp - 0x1e], r9b
jmp 0x18004aba2
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [r9 + rbx], 0
jne 0x18004ab70
lea rcx, [rbp - 0x28]
cmp rbx, 0xf
ja 0x18004ab9a
mov qword [rbp - 0x18], rbx
mov r8, rbx
mov rdx, r9
call fcn.1800a05a0
mov byte [rbp + rbx - 0x28], 0
jmp 0x18004aba2
mov rdx, rbx
call fcn.180069e40
cmp edi, 1
jne 0x18004abf4
mov rax, qword [rbp - 0x10]
cmp rax, 0xd
jb 0x18004abdf
lea rbx, [rbp - 0x28]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], 0xd
lea r8d, [rdi + 0xc]
lea rdx, str.Press_the_Key
mov rcx, rbx
call fcn.1800a05a0
mov byte [rbx + 0xd], 0
jmp 0x18004abf4
lea r9, str.Press_the_Key
mov edx, 0xd
lea rcx, [rbp - 0x28]
call fcn.180069e40
mov dword [rbp - 0x30], 0x42a00000
mov dword [rbp - 0x2c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.180035b30
test al, al
je 0x18004ac3f
test edi, edi
jne 0x18004ac3f
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x18004ac76
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004ac71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ac98
call fcn.18006e22c
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18006e1d0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.18007902c
int3
Function at 0x18004cbd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x440
mov rax, qword [0x1800cb040]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rax, qword [0x1800f3bd0]
mov rdi, rcx
mov qword [rsp + 0x28], rcx
add rax, 0x1198bd10
mov ecx, edx
mov ebx, edx
sar ecx, 0x10
xor r12d, r12d
shl ecx, 3
add rcx, rax
call fcn.180068f50
mov rcx, rax
movzx eax, bx
lea r15, [rcx + rax*2]
mov rcx, r15
call fcn.1800693c0
movzx r14d, ax
lea rcx, [rsp + 0x30]
xor edx, edx
shr r14d, 6
mov r8d, 0x400
call fcn.1800a0c40
lea rbx, [rsp + 0x30]
mov esi, r12d
lea ebp, [r12 + 0x18]
test r14d, r14d
je 0x18004ccd1
lea r8d, [r14 + r14]
lea rcx, [r15 + 2]
lea rdx, [rsp + 0x30]
call fcn.1800023d0
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov ecx, esi
not al
or ecx, 0xb000
inc esi
add ecx, ebp
xor al, cl
mov ebp, ecx
shr ebp, 2
mov byte [rbx - 1], al
cmp esi, r14d
jl 0x18004cc75
cmp r14d, 0x400
jae 0x18004cd20
xorps xmm0, xmm0
mov byte [rsp + r14 + 0x30], r12b
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r12
lea rax, [rsp + 0x30]
mov qword [rdi + 0x18], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x18004ccc1
lea rdx, [rsp + 0x30]
jmp 0x18004cce9
xorps xmm0, xmm0
lea rdx, [0x1800b0a2d]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r12
xor r8d, r8d
mov qword [rdi + 0x18], r12
mov rcx, rdi
call fcn.180004a40
mov rax, rdi
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.18006e1d0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.18006e368
int3
Function at 0x18004fae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x18004fb03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x18004faf0
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x18004fb10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x18004fb33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x18004fb20
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x18004fb40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x18004fb63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x18004fb50
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x18005adf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x18005ae13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x18005ae00
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x18005ae20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x18005ae43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x18005ae30
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x18005ae50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x18005ae73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x18005ae60
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x18005ae80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x18005aea3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x18005ae90
mov byte [rcx + 9], 0
mov rax, rcx
ret
Function at 0x18005b040
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1800cb040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x50], rbx
xor r14d, r14d
mov r8, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x18005b090
mov r8, qword [rdx]
mov dword [rsp + 0x30], 0xb0b7afb7
mov word [rsp + 0x34], 0x100
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 7]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 4
jb 0x18005b0b0
mov byte [rsp + 0x35], 0
mov rdx, rbx
cmp qword [r9 + 0x18], 0xf
jbe 0x18005b0d2
mov rdx, qword [r9]
mov rcx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18005b0df
mov rcx, qword [rdi]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x18], r14
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18005b120
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.180004a40
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x18005b172
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x18005b16d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18005b238
mov rcx, r8
call fcn.18006e22c
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x18005b1b7
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18005b1b2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18005b22c
mov rcx, r8
call fcn.18006e22c
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18005b1fc
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18005b1f7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18005b232
mov rcx, r8
call fcn.18006e22c
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rbp
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.18006e1d0
add rsp, 0xe0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18007902c
nop
call fcn.18007902c
nop
call fcn.18007902c
int3
Function at 0x180060620
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x180060643
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x180060630
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x180060650
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x180060673
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x180060660
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x180060680
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x1800606a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x180060690
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x1800606b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x1800606d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x1800606c0
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x1800606e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x180060703
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1800606f0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x180060710
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180060733
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x180060720
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x180060740
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x180060763
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x180060750
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x180060770
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x180060793
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x180060780
mov byte [rcx + 0x10], 0
mov rax, rcx
ret
Function at 0x180060f20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x180060f43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x180060f30
mov byte [rcx + 0x2a], 0
mov rax, rcx
ret
Function at 0x180067280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1800672a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x180067290
mov byte [rcx + 0x10], 0
ret

Function at 0x1800672b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x1800672d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x1800672c0
mov byte [rcx + 0xf], 0
ret

Function at 0x1800672e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180067303
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x1800672f0
mov byte [rcx + 6], 0
ret

Function at 0x180067310
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x180067333
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x180067320
mov byte [rcx + 8], 0
ret

Function at 0x180067340
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x180067363
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x180067350
mov byte [rcx + 0xa], 0
ret

Function at 0x180067370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x180067393
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x180067380
mov byte [rcx + 0xb], 0
ret

Function at 0x1800673a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x1800673c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x1800673b0
mov byte [rcx + 7], 0
ret

Function at 0x1800673d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x1800673f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x1800673e0
mov byte [rcx + 0xe], 0
ret

Function at 0x180067d00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x180067d23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x180067d10
mov byte [rcx + 9], 0
ret

Function at 0x180067d30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x180067d53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x180067d40
mov byte [rcx + 4], 0
ret

Function at 0x180067d60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x180067d83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x180067d70
mov byte [rcx + 5], 0
ret

Function at 0x1800681f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x180068213
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x180068200
mov byte [rcx + 0x11], 0
ret
Function at 0x180068220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x180068243
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x180068230
mov byte [rcx + 0xc], 0
ret

Function at 0x180068250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x180068273
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 7]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x180068260
mov byte [rcx + 0xd], 0
ret

Function at 0x18006b640
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18006b6a1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18006b660
mov ecx, dword [r9]
jmp 0x18006b788
cmp ecx, 0x4e0
jb 0x18006b788
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18006b6c0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18006b710
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x18006cd70
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x18006cd9e
xor eax, eax
jmp 0x18006ce84
cmp qword [rcx + 0x68], 0
je 0x18006cdaf
call fcn.180067ba0
jmp 0x18006ce84
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18006cdc6
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18006cdc8
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18006cdfa
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1800a05a0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x18006ce7e
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x18006ce31
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18006ce5a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.18007af80
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x18006ce7e
cmp rsi, rbx
ja 0x18006ce38
test rsi, rsi
je 0x18006ce7e
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18007af80
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18007944c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.18006ee20
sub rsp, rax
mov rax, qword [0x1800cb040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1800864b0
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x18007949b
mov rax, rbp
jmp 0x1800795a3
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xf32d0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.1800895bc
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0xf32d0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x18007959f
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x18007959f
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.1800895bc
test rax, rax
js 0x18007959f
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x18007959f
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180079591
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180079591
cmp byte [rcx], 0xd
jne 0x180079577
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x180079586
cmp byte [rcx + 1], 0xa
jne 0x180079586
inc rcx
jmp 0x180079586
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0xcb470]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180079559
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1800795a3
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.18006e1d0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180081404
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1800812b7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800812b7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800812b7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800812b7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800812b7
cmp dword [rcx + 0x84], 0xe
jbe 0x1800812b7
cmp dword [rcx + 0xf8], 0
je 0x1800812b7
mov ecx, ebx
call fcn.180081368
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.180081144
nop
cmp dword [rbp + 0x20], 0
je 0x180081305
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180081310
int3
xor r8d, r8d
xor edx, edx
jmp 0x180081248
Function at 0x1800815f8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x18008162f
call fcn.180081928
mov dword [rax], 0x16
call fcn.18007900c
xor eax, eax
jmp 0x1800816bd
mov rdx, r9
mov rcx, r8
call fcn.180081594
mov rbx, rax
test rax, rax
je 0x1800816ba
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x1800814c0]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x1800816a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18008189c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18008168e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18008169d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.180085174
jmp 0x1800816ba
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1800816b7
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180089668
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1800f32d0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1800896bf
cmp word [rdx], r13w
jne 0x1800896bf
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1800896c4
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1800897e9
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x18008980a
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1800896fd
mov rdx, r9
mov word [rbx], cx
jmp 0x180089724
cmp r9, r8
jae 0x180089734
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1800896de
jmp 0x1800897e9
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800897de
cmp dword [rsp + 0x80], esi
je 0x1800897de
lea r8, [0x1800f32d0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1800897b6
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x180089786
mov word [rbx], r13w
jmp 0x1800897e6
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x180089793
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1800897e6
cmp word [rsp + 0x70], r13w
jne 0x1800897c3
cmp rbx, r14
je 0x180089780
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1800895c4
cmp word [rsp + 0x70], r13w
je 0x1800897e9
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1800f32d0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1800897e3
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1800897e9