joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800cd83c
Capabilities:
Print debug messages

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x890
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x50], 0xfffffffffffffffe
mov qword [rbp + 0x888], rbx
mov qword [rbp + 0x890], rsi
mov rdi, rcx
xor r12d, r12d
cmp dword [rcx + 8], r12d
je 0x1800cd9df
cmp dword [rcx + 0x10], r12d
je 0x1800cd9df
mov r8d, edx
lea rdx, [rbp + 0x28]
call fcn.1800cdc6c
nop
lea rbx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0x10
cmovae rbx, qword [rbp + 0x30]
cmp rbx, r12
jne 0x1800cd8a2
mov r8, r12
jmp 0x1800cd91c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9d, [rax + 1]
cmp r9d, 0x3fffffff
jle 0x1800cd8bd
mov r8, r12
jmp 0x1800cd91c
movsxd rax, r9d
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1800cd8d6
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800f12f0
sub rsp, rcx
lea rsi, [rsp + 0x30]
cmp rsi, r12
je 0x1800cd919
mov word [rsi], r12w
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rsi
or r9d, 0xffffffff
mov r8, rbx
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb r8, r8
and r8, rsi
jmp 0x1800cd91c
mov r8, r12
mov r9, qword [rbp + 0x8a0]
lea rdx, str.SBWATCHMAN__s_:__s_r_n
lea rcx, [rbp + 0x60]
call fcn.1800d20e8
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x18], r12
mov byte [rbp + 8], r12b
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x880]
call fcn.1800041c0
nop
lea r8, [rbp]
mov rdx, rax
mov rcx, qword [rdi + 0x18]
call fcn.1800cedc4
nop
mov rcx, qword [rbp + 0x880]
add rcx, 0xfffffffffffffff4
lea rax, [0x18015f758]
cmp rcx, rax
je 0x1800cd99a
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x1800cd99a
mov rcx, qword [rbp + 0x880]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
lea rcx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
cmp qword [rbp + 0x20], 0x10
jb 0x1800cd9bf
mov rcx, qword [rbp + 8]
call fcn.1800d1290
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x18], r12
mov byte [rbp + 8], r12b
cmp qword [rbp + 0x48], 0x10
jb 0x1800cd9df
mov rcx, qword [rbp + 0x30]
call fcn.1800d1290
mov rbx, qword [rbp + 0x888]
mov rsi, qword [rbp + 0x890]
lea rsp, [rbp + 0x860]
pop r12
pop rdi
pop rbp
ret
Function at 0x1800cdf70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rdx
mov rax, qword [0x18015f768]
mov qword [r11 + 8], rax
mov qword [r11 + 0x20], rax
mov rax, qword [rdx]
cmp dword [rax - 8], 0
jle 0x1800cdfaf
mov rcx, rdx
call fcn.1800cde54
mov rcx, qword [rdi]
or esi, 0xffffffff
cmp dword [rcx - 8], 0
jg 0x1800cdfbf
mov ebx, esi
jmp 0x1800cdfdb
mov edx, 0x5c
call fcn.1800d4ba0
mov rbx, rax
test rax, rax
jne 0x1800cdfd5
mov ebx, esi
jmp 0x1800cdfdb
sub rbx, qword [rdi]
sar rbx, 1
lea rbp, [0x18015f758]
cmp ebx, esi
je 0x1800ce0f3
mov r8d, ebx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180007f08
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.180003500
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x1800ce031
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1800ce031
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff4
call fcn.1800d1434
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800ce052
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1800ce08b
lea eax, [rbx + 1]
mov rcx, qword [rdi]
test eax, eax
js 0x1800ce080
cmp eax, dword [rcx - 8]
jge 0x1800ce080
cdqe
lea rcx, [rcx + rax*2]
mov edx, 0x5c
call fcn.1800d4ba0
test rax, rax
je 0x1800ce0f3
sub rax, qword [rdi]
sar rax, 1
mov ebx, eax
jmp 0x1800ce082
mov ebx, esi
cmp ebx, esi
je 0x1800ce0f3
jmp 0x1800cdfea
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x1800ce0ab
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1800ce0ab
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x1800ce0cb
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1800ce0cb
call fcn.1800d1434
nop
mov rcx, qword [rdi]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x1800ce0ef
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1800ce0ef
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x1800ce15c
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x1800ce113
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1800ce113
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x60]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x1800ce133
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1800ce133
call fcn.1800d1434
nop
mov rcx, qword [rdi]
add rcx, 0xfffffffffffffff4
cmp rcx, rbp
je 0x1800ce157
mov eax, esi
lock xadd dword [rcx], eax
add eax, esi
test eax, eax
jg 0x1800ce157
mov rcx, qword [rdi]
sub rcx, 0xc
call fcn.1800d1434
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800ce414
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x140
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
mov ebx, 9
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1800ce4be
cmp dword [rsp + 0x30], 2
jne 0x1800ce496
mov eax, dword [rsp + 0x24]
cmp eax, 4
ja 0x1800ce454
mov ebx, 2
jmp 0x1800ce4be
cmp eax, 5
jne 0x1800ce47a
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x1800ce466
lea ebx, [rax + 3]
jmp 0x1800ce4be
cmp eax, 1
jne 0x1800ce470
lea ebx, [rax + 4]
jmp 0x1800ce4be
cmp eax, 2
jne 0x1800ce4be
lea ebx, [rax + 6]
jmp 0x1800ce4be
cmp eax, 6
jne 0x1800ce4be
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x1800ce48c
lea ebx, [rax + 6]
jmp 0x1800ce4be
cmp eax, 1
jne 0x1800ce4be
lea ebx, [rax + 6]
jmp 0x1800ce4be
cmp dword [rsp + 0x30], 1
jne 0x1800ce4be
cmp dword [rsp + 0x24], 4
ja 0x1800ce4b1
jne 0x1800ce4ad
cmp dword [rsp + 0x28], 0xa
jae 0x1800ce4b1
xor ebx, ebx
jmp 0x1800ce4be
cmp dword [rsp + 0x28], 0x5a
sbb ebx, ebx
and ebx, 0xfffffffd
add ebx, 4
mov eax, ebx
add rsp, 0x140
pop rbx
ret
Function at 0x1800ce5d0
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rbp, r9
mov r12, r8
mov rbx, rdx
lea rdx, [rax - 0x34]
mov rcx, qword [rbx]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test eax, eax
jne 0x1800ce63e
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
lea rax, [0x18015f758]
cmp rcx, rax
je 0x1800ce637
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1800ce637
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x1800ce7d1
mov rcx, rsi
call fcn.1800d04fc
mov rdi, rax
test rax, rax
jne 0x1800ce681
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
lea rax, [0x18015f758]
cmp rcx, rax
je 0x1800ce67a
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1800ce67a
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x1800ce7d1
mov r9, rax
mov r8d, esi
xor edx, edx
mov rcx, qword [rbx]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1800ce6c8
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
lea rax, [0x18015f758]
cmp rcx, rax
je 0x1800ce6c1
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1800ce6c1
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x1800ce7d1
and qword [rsp + 0x28], 0
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x18010d37c]
mov rcx, rdi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1800ce727
mov rcx, rdi
call fcn.1800d1290
nop
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
lea rax, [0x18015f758]
cmp rcx, rax
je 0x1800ce720
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1800ce720
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x1800ce7d1
cmp dword [rsp + 0x20], 0
jne 0x1800ce767
mov rcx, rdi
call fcn.1800d1290
nop
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
lea rax, [0x18015f758]
cmp rcx, rax
je 0x1800ce763
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1800ce763
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1800d1434
xor eax, eax
jmp 0x1800ce7d1
mov rdx, qword [rsp + 0x28]
movzx eax, word [rdx + 0xa]
mov dword [r12], eax
movzx eax, word [rdx + 8]
mov dword [rbp], eax
movzx ecx, word [rdx + 0xe]
mov rax, qword [rsp + 0x80]
mov dword [rax], ecx
movzx ecx, word [rdx + 0xc]
mov rax, qword [rsp + 0x88]
mov dword [rax], ecx
mov rcx, rdi
call fcn.1800d1290
nop
mov rcx, qword [rbx]
add rcx, 0xfffffffffffffff4
lea rax, [0x18015f758]
cmp rcx, rax
je 0x1800ce7cc
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x1800ce7cc
mov rcx, qword [rbx]
sub rcx, 0xc
call fcn.1800d1434
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r12
pop rdi
pop rsi
ret
Function at 0x1800cec80
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov ecx, 0x10
mov rbx, r9
mov esi, r8d
mov rbp, rdx
call fcn.1800d04fc
lea rcx, [rsp + 0x38]
mov qword [rbx], rax
xor ebx, ebx
xor r8d, r8d
lea r9d, [rbx + 1]
xor edx, edx
mov rdi, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, ebx
jne 0x1800cece8
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800cedad
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, ebx
jne 0x1800ced24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1800cedad
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
cmp eax, ebx
jne 0x1800ced5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x1800cedad
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rdi
mov edx, 2
mov dword [rsp + 0x68], socket
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp eax, ebx
je 0x1800ced88
mov edi, ebx
jmp 0x1800ced90
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp edi, ebx
sete bl
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800cf560
Capabilities:
Get disk information

Disassembly:
push rdi
mov eax, 0x3080
call fcn.1800f12f0
sub rsp, rax
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x3090], rbx
mov rdi, rdx
lea rdx, [0x180129478]
lea rcx, [rsp + 0x48]
call fcn.1800041c0
nop
mov r8d, 0x104
mov dword [rsp + 0x38], r8d
lea rax, [rsp + 0x270]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30a0]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x1800cf5f9
lea rcx, str.0000000000_0000_0000_0000_00000000
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r8, str.0000000000_0000_0000_0000_00000000
mov edx, eax
mov rcx, rdi
call fcn.180003e28
jmp 0x1800cf610
mov r8d, dword [rsp + 0x30a0]
lea rdx, [0x1801294c8]
mov rcx, rdi
call fcn.180008f64
mov dword [rsp + 0x30a8], 0x2c00
lea rdx, [rsp + 0x30a8]
lea rcx, [rsp + 0x480]
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov r11, qword [0x18015f768]
mov qword [rsp + 0x40], r11
movzx eax, byte [rsp + 0x61d]
movzx ecx, byte [rsp + 0x61c]
movzx edx, byte [rsp + 0x61b]
movzx r10d, byte [rsp + 0x61a]
movzx r9d, byte [rsp + 0x619]
movzx r8d, byte [rsp + 0x618]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._02X_02X_02X_02X_02X_02X
lea rcx, [rsp + 0x40]
call fcn.180008f64
mov rbx, qword [rsp + 0x40]
mov r8, rbx
mov edx, dword [rbx - 8]
mov rcx, rdi
call fcn.180008324
nop
lea rcx, [rbx - 0xc]
lea rdi, [0x18015f758]
or ebx, 0xffffffff
cmp rcx, rdi
je 0x1800cf6ca
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x1800cf6ca
call fcn.1800d1434
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x1800cf6e9
mov eax, ebx
lock xadd dword [rcx], eax
add eax, ebx
test eax, eax
jg 0x1800cf6e9
call fcn.1800d1434
mov rbx, qword [rsp + 0x3090]
add rsp, 0x3080
pop rdi
ret
Function at 0x1800d03dc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x180160d40]
test rcx, rcx
jne 0x1800d0333
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 0x60]
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x1800d032c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1800d035e
and qword [rax], 0
and qword [rax + 8], 0
xor eax, eax
lock cmpxchg qword [rbx + 0x40], rdi
je 0x1800d0328
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbx + 0x40]
mov qword [0x180160d40], rcx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
test rax, rax
jne 0x1800d03d1
mov edx, 0x1000
lea r9d, [rax + 0x40]
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800d0381
xor edx, edx
lea r9, [rsp + 0x30]
mov ecx, 0xc0000017
lea r8d, [rdx + 1]
mov qword [rsp + 0x30], 0x20
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [rax]
mov rcx, qword [0x180160d40]
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov rdi, rax
test rax, rax
je 0x1800d03ae
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rdi
jmp 0x1800d03d1
lea rdi, [rbx + 0xfe0]
mov rcx, qword [0x180160d40]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add rbx, 0x20
cmp rbx, rdi
jb 0x1800d03b5
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
jmp 0x1800d02b8
Function at 0x1800dba23
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1801563c0]
jne 0x1800d12ca
rol rcx, 0x10
test cx, 0xffff
jne 0x1800d12c6
repz ret
ror rcx, 0x10
jmp 0x1800db97c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1801613b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x1801614a8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800dba01
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1801613b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800dba23
mov rax, qword [rsp + 0x88]
mov qword [0x1801614a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180161448], rax
mov rax, qword [0x1801614a8]
mov qword [0x180161320], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180161430], rax
mov dword [0x180161310], 0xc0000409
mov dword [0x180161314], 1
mov rax, qword [0x1801563c0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1801563c8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1801613a8], eax
mov ecx, 1
call fcn.1800dc278
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18010abf0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1801613a8], 0
jne 0x1800dbaaa
mov ecx, 1
call fcn.1800dc278
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1800dc1f4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1800dc068
Function at 0x1800eaaf8
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.1800dbad0
xor ebx, ebx
mov rdi, rax
cmp qword [0x180162088], rbx
jne 0x1800eabfe
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800eacd3
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800eacd3
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x18010c920]
mov rcx, rsi
mov qword [0x180162088], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180162090], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180162098], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x1801620a8], rax
test rax, rax
je 0x1800eabf5
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x1801620a0], rax
jmp 0x1800eac05
mov rax, qword [0x1801620a0]
jmp 0x1800eac0c
mov rax, qword [0x1801620a0]
mov r11, qword [0x1801620a8]
cmp rax, rdi
je 0x1800eac74
cmp r11, rdi
je 0x1800eac74
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x1801620a8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x1800eac74
test rax, rax
je 0x1800eac74
call rsi
test rax, rax
je 0x1800eac6e
lea rcx, [rsp + 0x88]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800eac6e
test byte [rsp + 0x38], 1
jne 0x1800eac74
bts ebp, 0x15
jmp 0x1800eacb2
mov rcx, qword [0x180162090]
cmp rcx, rdi
je 0x1800eacb2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800eacb2
call rax
mov rbx, rax
test rax, rax
je 0x1800eacb2
mov rcx, qword [0x180162098]
cmp rcx, rdi
je 0x1800eacb2
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800eacb2
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180162088]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x1800eacd3
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x1800eacd5
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180006c80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180006cdd
lea rbx, [0x180128580]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180006cc4
cmp r10, 2
jb 0x180006cc4
cmp byte [r9], r8b
jne 0x180006cc4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180006ca0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180006d1f
lea rbx, [0x180128580]
cmp r8b, 0x23
jne 0x180006d03
cmp byte [r9], r8b
jne 0x180006d03
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180006cf0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180006e70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180006e8a
mov qword [r8], 0
lea rdx, [0x180127e48]
call fcn.180006d30
mov rbx, rax
test rax, rax
jne 0x180006eaa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1800dff78
mov esi, eax
cmp eax, 0xffffffff
je 0x180006f92
xor edx, edx
mov r8d, 2
mov rcx, rbx
call fcn.1800e09d4
test eax, eax
jne 0x180006f92
mov rcx, rbx
call fcn.1800dff78
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180006f92
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1800e09d4
test eax, eax
jne 0x180006f92
cmp rdi, 0xffffffffffffffff
je 0x180006f92
mov rax, qword [0x18017d4a8]
test rax, rax
je 0x180006f24
inc dword [rax + 0xf0]
mov rdx, qword [0x18017d4d8]
mov rcx, rdi
call qword [0x18017bec8]
mov rsi, rax
test rax, rax
je 0x180006f92
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1800e1808
mov rcx, rbx
cmp rax, rdi
je 0x180006f80
call fcn.1800e06cc
mov rax, qword [0x18017d4a8]
test rax, rax
je 0x180006f6e
dec dword [rax + 0xf0]
mov rdx, qword [0x18017d4d8]
mov rcx, rsi
call qword [0x18017bed0]
jmp 0x180006f9a
call fcn.1800e06cc
test r14, r14
je 0x180006f8d
mov qword [r14], rdi
mov rax, rsi
jmp 0x180006f9c
mov rcx, rbx
call fcn.1800e06cc
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18000ae60
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x110]
lea r10, [0x180128580]
mov rax, qword [rcx + 0xf8]
movss xmm1, dword [rcx + 0x114]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xf0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret