joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401540
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x30]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x10]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
movaps xmm9, xmmword [rdx]
movaps xmm10, xmmword [rdx + 0xa0]
movaps xmmword [rcx], xmm9
movdqa xmmword [rcx + 0x10], xmm2
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm0
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movaps xmmword [rcx + 0xa0], xmm10
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x407b60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm0, xmmword [rdx]
movdqa xmmword [rcx], xmm0
aeskeygenassist xmm1, xmm0, 1
pshufd xmm1, xmm1, 0xff
movdqa xmm2, xmm0
pslldq xmm2, 4
movdqa xmm3, xmm0
pslldq xmm3, 8
movdqa xmm4, xmm0
pslldq xmm4, 0xc
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
pxor xmm4, xmm1
movdqa xmmword [rcx + 0x10], xmm4
aeskeygenassist xmm0, xmm4, 2
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0x20], xmm3
aeskeygenassist xmm0, xmm3, 4
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm2, xmm3
pslldq xmm2, 8
movdqa xmm4, xmm3
pslldq xmm4, 0xc
pxor xmm4, xmm1
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
movdqa xmmword [rcx + 0x30], xmm4
aeskeygenassist xmm0, xmm4, 8
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0x40], xmm3
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm2, xmm3
pslldq xmm2, 8
movdqa xmm4, xmm3
pslldq xmm4, 0xc
pxor xmm4, xmm1
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
movdqa xmmword [rcx + 0x50], xmm4
aeskeygenassist xmm0, xmm4, 0x20
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0x60], xmm3
aeskeygenassist xmm0, xmm3, 0x40
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm2, xmm3
pslldq xmm2, 8
movdqa xmm4, xmm3
pslldq xmm4, 0xc
pxor xmm4, xmm1
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
movdqa xmmword [rcx + 0x70], xmm4
aeskeygenassist xmm0, xmm4, 0x80
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0x80], xmm3
aeskeygenassist xmm0, xmm3, 0x1b
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm2, xmm3
pslldq xmm2, 8
movdqa xmm4, xmm3
pslldq xmm4, 0xc
pxor xmm4, xmm1
pxor xmm4, xmm2
pxor xmm4, xmm3
pxor xmm4, xmm0
movdqa xmmword [rcx + 0x90], xmm4
aeskeygenassist xmm0, xmm4, 0x36
pshufd xmm0, xmm0, 0xff
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm2, xmm4
pslldq xmm2, 8
movdqa xmm3, xmm4
pslldq xmm3, 0xc
pxor xmm3, xmm1
pxor xmm3, xmm2
pxor xmm3, xmm4
pxor xmm3, xmm0
movdqa xmmword [rcx + 0xa0], xmm3
ret
Function at 0x40fdb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x40fe40
cmp r10, r11
jb 0x40feb6
cmp r10, rdx
ja 0x40feca
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x40fe42
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x40fe20
jmp 0x40fea4
ja 0x40fe4a
mov r11, r10
cmp rax, r8
jne 0x40fde4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x40fe80
mov rdi, r8
sub ecx, edx
jns 0x40fe9b
jmp 0x40fea6
cmp r8, rsi
je 0x40fedb
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x40fea6
xor al, 1
cmp rdi, rsi
jne 0x40fe60
jmp 0x40fea6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, [0x00baa0e8]
mov rcx, r11
mov rdx, r10
call fcn.004105f0
ud2
lea r8, [0x00baa0e8]
mov rcx, r10
call fcn.00410030
ud2
lea rcx, [0x00baf010]
lea r8, [0x00baa100]
mov edx, 0x2b
call fcn.0040f180
ud2
Function at 0x4260e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rdx
movzx ebp, byte [rdx + 0x38]
xor ebx, ebx
cmp bpl, 1
setne dl
mov eax, 0
sbb eax, eax
mov rsi, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x426110
test ecx, ecx
jne 0x426160
movzx ebx, byte [rdi + 0x3a]
cmp al, 0xff
je 0x42611c
test ecx, ecx
jne 0x426160
mov rcx, rdi
call fcn.00425fc0
movzx eax, al
test bpl, bpl
jne 0x426167
lea rdx, [rdi + 0x10]
xor ecx, ecx
cmp byte [rdi + 0x10], 6
cmove rdx, rcx
je case.0x426153.2
movzx r8d, byte [rdx]
mov ecx, 6
lea r9, [0x004262d8]
movsxd r8, dword [r9 + r8*4]
add r8, r9
jmp r8
mov rcx, qword [rdx + 0x10]
add rcx, 4
jmp case.0x426153.2
xor eax, eax
test bpl, bpl
je 0x42612c
xor ecx, ecx
add rax, rcx
movzx r10d, bl
lea rcx, [rax + r10]
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x4262b9
mov r11, qword [rdi]
lea r8, [r11 + rcx]
cmp rdx, rcx
jne 0x42619a
movzx r9d, byte [rdi + 0x10]
xor r10d, r10d
jmp 0x426219
movzx r9d, byte [rdi + 0x10]
add rax, r10
sub rax, rdx
inc rax
lea rdi, [rdx + r11]
dec rdi
xor r10d, r10d
cmp r9b, 3
jae 0x4261e0
nop dword [rax + rax]
cmp byte [rdi], 0x5c
je 0x4261fb
inc rax
dec rdi
cmp rax, 1
jne 0x4261c0
jmp 0x426219
movzx ebx, byte [rdi]
cmp ebx, 0x2f
je 0x4261fb
cmp ebx, 0x5c
je 0x4261fb
inc rax
dec rdi
cmp rax, 1
jne 0x4261e0
jmp 0x426219
neg rax
add rcx, rax
inc rcx
cmp rdx, rcx
jb 0x4262c7
add r11, rcx
mov r10d, 1
mov r8, r11
sub rdx, rcx
je 0x426243
mov al, 9
cmp rdx, 2
je 0x426247
cmp rdx, 1
jne 0x426257
cmp byte [r8], 0x2e
jne 0x426257
xor eax, eax
cmp r9b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x426257
mov al, 0xa
jmp 0x426257
cmp byte [r8], 0x2e
jne 0x426257
cmp byte [r8 + 1], 0x2e
sete al
xor al, 9
add r10, rdx
mov qword [rsi], r10
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], rdx
mov byte [rsi + 0x18], al
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 8
jmp case.0x426153.2
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
lea r8, [rdx + 1]
test rdx, rdx
cmove r8, rdx
add rcx, r8
add rcx, 2
jmp case.0x426153.2
mov ecx, 2
jmp case.0x426153.2
lea r8, [0x00bac268]
call fcn.004100c0
ud2
lea r8, [0x00bac280]
call fcn.004100c0
ud2
Function at 0x452b00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00baf680]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x452b20
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x452b28
ret
cmp word [r8 + 0x18], 0x20b
jne 0x452b20
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x452b75
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x452b6c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x452b20
add rax, 0x28
cmp rax, r9
jne 0x452b58
xor eax, eax
ret

Function at 0x452b80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00baf680]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x452ba0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x452ba8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x452ba0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x452c30
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00baf680]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x452c50
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x452c58
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x1800052c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
cmp edx, 1
jne 0x18000534d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
add eax, 0xffffff80
test eax, 0xffffff7f
je 0x1800052fc
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword [0x1801c7508]
mov rcx, rdi
mov qword [rax], rdi
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
lea rdx, [0x180002040]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
xor eax, eax
lea r8, [0x1800032b0]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
test edx, edx
jne 0x18000537e
call fcn.18006b5b0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeConsole]
test rbx, rbx
je 0x18000537e
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov rcx, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x180006ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [r8 + 0x18], 0xf
mov r10, r8
mov rbx, qword [r8 + 0x10]
mov rdi, rdx
mov r11, r8
jbe 0x180006af1
mov r11, qword [r8]
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rbx, rbx
je 0x180006b24
movabs rdx, 0x100000001b3
nop dword [rax]
movzx eax, byte [r11 + r9]
inc r9
xor r8, rax
imul r8, rdx
cmp r9, rbx
jb 0x180006b10
mov rdx, r10
call fcn.180008160
mov rbx, qword [rsp + 0x30]
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x18000c9c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov esi, edx
mov rdi, rcx
lea rbp, vtable.el::base::threading::internal::NoScopedLock_class_el::base::threading::internal::NoMutex_.0
test r8, r8
jne 0x18000ca30
mov rbx, qword [rcx + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov qword [rsp + 0x20], rbp
lea r8, [rbx + 0x58]
mov edx, esi
call fcn.180019120
nop
test al, al
je 0x18000cb0c
mov rbx, qword [rdi + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
mov qword [rsp + 0x20], rbp
lea r8, [rbx + 0x1d8]
mov edx, esi
call fcn.180017a50
nop
mov r8, qword [rax]
test r8, r8
je 0x18000cb0c
lea rcx, [r8 + 0x10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
mov eax, esi
shr eax, 8
movzx edx, al
movzx eax, sil
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r8, 0x100000001b3
imul rax, r8
xor rdx, rax
imul rdx, r8
mov eax, esi
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rsi
shr rax, 0x18
xor rdx, rax
imul rdx, r8
mov rcx, qword [rdi + 0x1e0]
and rcx, rdx
shl rcx, 4
add rcx, qword [rdi + 0x1c8]
mov rax, qword [rcx + 8]
mov rdx, qword [rdi + 0x1b8]
cmp rax, rdx
je 0x18000cac2
mov rcx, qword [rcx]
cmp esi, dword [rax + 0x10]
je 0x18000cac4
cmp rax, rcx
je 0x18000cac2
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x18000cab2
jmp 0x18000cac4
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x18000cad7
mov dword [rax + 0x14], 0
mov rbx, qword [0x1801c72b0]
test rbx, rbx
je 0x18000cb0c
test rdi, rdi
je 0x18000cb0c
mov rdi, qword [rdi + 0x38]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov qword [rsp + 0x20], rbp
lea r8, [rbx + 0xa8]
mov edx, esi
mov rcx, rdi
call fcn.180011340
nop
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000cbe0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801bf040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
cmp qword [rcx + 0x10], 0
jne 0x18000cc11
xor al, al
jmp 0x18000cdc3
cmp qword [rcx + 0x18], 0xf
jbe 0x18000cc1b
mov rcx, qword [rcx]
test rcx, rcx
je 0x18000cc39
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x18000cc39
shr eax, 4
test al, 1
je 0x18000cc39
mov al, 1
jmp 0x18000cdc3
mov edi, 0xffffffff
cmp qword [rbx + 0x18], 0xf
jbe 0x18000cc48
mov rbx, qword [rbx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], al
mov qword [rbp - 0x38], rax
lea r8, [rbp - 0x38]
lea rdx, [0x18010e9f0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
mov rcx, rax
test rax, rax
je 0x18000cd7c
nop dword [rax]
nop dword [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x18000cc97
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
mov rax, r8
sub rax, rdx
cmp rbx, rax
ja 0x18000ccdf
lea rax, [rbx + rdx]
mov qword [rbp - 0x20], rax
lea rdi, [rbp - 0x30]
cmp r8, 0xf
cmova rdi, qword [rbp - 0x30]
add rdi, rdx
mov r8, rbx
mov rdx, rcx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x18000ccf3
mov qword [rsp + 0x20], rbx
mov r9, rcx
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.1800186d0
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
mov rax, r8
sub rax, rdx
lea rcx, [rbp - 0x30]
cmp rax, 1
jb 0x18000cd2d
lea rax, [rdx + 1]
mov qword [rbp - 0x20], rax
cmp r8, 0xf
cmova rcx, qword [rbp - 0x30]
movzx eax, word [0x18010e9f0]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
jmp 0x18000cd47
mov qword [rsp + 0x20], 1
lea r9, [0x18010e9f0]
mov edx, 1
call fcn.1800186d0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov edi, eax
lea r8, [rbp - 0x38]
lea rdx, [0x18010e9f0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
mov rcx, rax
test rax, rax
jne 0x18000cc90
cmp edi, 0xffffffff
setne bl
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x18000cdc0
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cdbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000cdbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180083050
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180083030
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000d420
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x1801c7518]
mov rdx, rdi
lea rcx, str.USERNAME
mov r8d, 0x32
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
cmove rdi, rsi
test rdi, rdi
je 0x18000d484
cmp byte [rdi], sil
je 0x18000d484
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
inc r8
cmp byte [rdi + r8], sil
jne 0x18000d476
mov rdx, rdi
jmp 0x18000d49f
xorps xmm0, xmm0
lea rdx, str.unknown_user
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov r8d, 0xc
mov qword [rbx + 0x18], rsi
mov rcx, rbx
call fcn.1800071c0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18000d4c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdi, [0x1801c7518]
mov rdx, rdi
lea rcx, str.COMPUTERNAME
mov r8d, 0x32
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
cmove rdi, rsi
test rdi, rdi
je 0x18000d524
cmp byte [rdi], sil
je 0x18000d524
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
inc r8
cmp byte [rdi + r8], sil
jne 0x18000d516
mov rdx, rdi
jmp 0x18000d53f
xorps xmm0, xmm0
lea rdx, str.unknown_host
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov r8d, 0xc
mov qword [rbx + 0x18], rsi
mov rcx, rbx
call fcn.1800071c0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180014b60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180014b88
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x180014bae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180014bb0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180014c09
test ecx, ecx
jle 0x180014be9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180014c09
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180014c09
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180014c30
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180014c52
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180014c68
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180014c84
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180014c86
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180014cc2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180014d5e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180014cfd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180014d3e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180014d5e
cmp rbx, rax
ja 0x180014d10
test rbx, rbx
je 0x180014d5e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1800151c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1801bf040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1800151ed
xor eax, eax
jmp 0x180015359
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180015227
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180015227
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180015359
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18001534c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18001526a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180015295
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180015351
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180015304
sub eax, 1
je 0x180015304
cmp eax, 2
jne 0x18001534c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180015351
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180015332
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18001534c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180015351
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180083030
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret