joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180076908
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x18021b070]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor r12d, r12d
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x180076a80
movsxd rax, dword [rcx + 0x3c]
mov r9d, dword [rax + rcx + 0x88]
mov r11d, dword [rax + rcx + 0x8c]
lea r8, [rcx + r9]
test r11d, r11d
je 0x180076a80
lea r13d, [r12 + 1]
cmp rdx, 0xffff
ja 0x180076a2f
mov ecx, dword [r8 + 0x1c]
movzx eax, bp
sub ax, word [r8 + 0x10]
add rcx, rbx
add ax, r13w
movzx edx, ax
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x180076a2f
lea eax, [r9 + r11]
cmp edi, eax
jae 0x180076a2f
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180116fa0
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x1800769be
test r8, r8
je 0x180076a80
lea rcx, [rsp + 0x20]
call fcn.1801168f0
mov edx, 0x2e
lea rcx, [rsp + 0x20]
call fcn.18011683c
lea rdi, [rax + r13]
mov byte [rax], r12b
cmp byte [rdi], 0x23
jne 0x180076a01
lea rcx, [rdi + 1]
call fcn.180120ce8
movzx edi, ax
lea rcx, [rsp + 0x20]
call fcn.1800767b0
mov rsi, rax
cmp rax, rbx
jne 0x180076a22
mov rdx, rbp
mov rcx, rdi
call fcn.180120bec
test eax, eax
je 0x180076a80
mov rdx, rdi
mov rcx, rsi
call fcn.180076908
jmp 0x180076a82
mov ecx, dword [r8 + 0x18]
mov edi, r12d
mov r15d, dword [r8 + 0x20]
sub ecx, r13d
lea r10d, [rdi + rcx]
mov rsi, rbp
shr r10d, 1
lea rax, [r15 + r10*4]
mov edx, dword [rax + rbx]
add rdx, rbx
sub rsi, rdx
mov al, byte [rdx]
cmp al, byte [rdx + rsi]
jne 0x180076a67
add rdx, r13
test al, al
jne 0x180076a54
mov eax, r12d
jmp 0x180076a6c
sbb eax, eax
or eax, r13d
test eax, eax
jns 0x180076a76
lea edi, [r10 + 1]
jmp 0x180076a7c
jle 0x180076aad
lea ecx, [r10 - 1]
cmp edi, ecx
jbe 0x180076a3d
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180113f60
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r8 + 0x24]
add rcx, rbx
cmp word [rcx + r10*2], r12w
je 0x180076a80
movzx edx, word [rcx + r10*2]
mov ecx, dword [r8 + 0x1c]
add rcx, rbx
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x180076aff
lea eax, [r9 + r11]
cmp edi, eax
jae 0x180076aff
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.180116fa0
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x180076af1
jmp 0x1800769c7
lea rax, [rbx + rdi]
jmp 0x180076a82
Function at 0x1800793e8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18021b070]
xor rax, rsp
mov qword [rbp - 8], rax
mov rcx, qword [0x18024ce10]
lea rdx, [rbp - 0x28]
mov rdi, qword [0x18024c7b0]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp - 0x20]
lea rcx, [rbp - 0x10]
sub eax, dword [rbp - 0x28]
movd xmm1, eax
mov eax, dword [rbp - 0x1c]
sub eax, dword [rbp - 0x24]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp - 0x10]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x18024ce18]
cvtsi2ss xmm0, qword [0x18024ce20]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x18024ce18], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov bl, 1
and al, bl
mov ecx, 0x10
mov byte [rdi + 0x148], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, bl
mov byte [rdi + 0x149], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
mov byte [rdi + 0x14b], 0
mov rbx, qword [0x18024c7b0]
mov byte [rdi + 0x14a], al
cmp byte [rbx + 0x3a3], 0
je 0x18007950e
cvttss2si eax, dword [rbx + 0x130]
mov rcx, qword [0x18024ce10]
lea rdx, [rbp - 0x18]
mov dword [rbp - 0x18], eax
cvttss2si eax, dword [rbx + 0x134]
mov dword [rbp - 0x14], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp - 0x14]
mov ecx, dword [rbp - 0x18]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov eax, 0xff7fffff
mov dword [rbx + 0x130], eax
mov dword [rbx + 0x134], eax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x180079586
mov rdx, qword [0x18024ce10]
cmp rax, rdx
je 0x180079543
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x180079586
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x180079586
mov rcx, qword [0x18024ce10]
lea rdx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x180079586
movd xmm0, dword [rbp - 0x30]
movd xmm1, dword [rbp - 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x130], xmm0
movss dword [rbx + 0x134], xmm1
cmp byte [rdi + 0xc8], 0
je 0x180079594
or eax, 0xffffffff
jmp 0x1800795a1
mov rax, qword [0x18024c7b0]
mov eax, dword [rax + 0x1f98]
cmp dword [0x180246798], eax
je 0x1800795b4
mov dword [0x180246798], eax
call fcn.18007938c
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180113f60
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x18007ac20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18007ac7a
mov r11b, 0x23
lea rdi, [0x180155b60]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x18007ac64
cmp rdx, 2
jb 0x18007ac64
cmp byte [r10], r11b
jne 0x18007ac64
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x18007ac42
jmp 0x18007acbb
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18007acbb
mov r11b, 0x23
lea rdi, [0x180155b60]
cmp dl, r11b
jne 0x18007ac9f
cmp byte [r10], r11b
jne 0x18007ac9f
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x18007ac8d
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x18007add8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18007adf9
and qword [r8], 0
lea rdx, [0x1801559a4]
call fcn.18007accc
mov rbx, rax
test rax, rax
je 0x18007aece
mov rcx, rax
call fcn.18012126c
mov esi, eax
cmp eax, 0xffffffff
je 0x18007aec6
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18011fe84
test eax, eax
jne 0x18007aec6
mov rcx, rbx
call fcn.18012126c
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18007aec6
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.18011fe84
test eax, eax
jne 0x18007aec6
cmp rdi, 0xffffffffffffffff
je 0x18007aec6
mov rax, qword [0x18024c7b0]
test rax, rax
je 0x18007ae73
inc dword [rax + 0x3bc]
mov rdx, qword [0x18024c7a8]
mov rcx, rdi
call fcn.18007a520
mov rsi, rax
test rax, rax
je 0x18007aec6
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18012040c
mov rcx, rbx
cmp rax, rdi
je 0x18007aeb4
call fcn.180120b38
mov rcx, rsi
call fcn.18007d34c
jmp 0x18007aece
call fcn.180120b38
test r14, r14
je 0x18007aec1
mov qword [r14], rdi
mov rax, rsi
jmp 0x18007aed0
mov rcx, rbx
call fcn.180120b38
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x18007ccb8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
movsxd rdx, dword [rcx + 0xc0]
mov r9d, 4
mov rax, qword [rcx + 0xc8]
mov r8d, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x38]
not r8d
movzx eax, byte [rdx]
inc rdx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x180155b60]
xor r8d, dword [rax + rcx*4]
sub r9, 1
jne 0x18007cce1
not r8d
mov ecx, r8d
call fcn.18007cf8c
mov eax, r8d
add rsp, 0x28
ret
Function at 0x18007cd18
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18021b070]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm0, dword [rdx]
mov r8, rcx
subss xmm0, dword [rcx + 0x10]
movss xmm1, dword [rdx + 8]
mov r9d, 0x10
subss xmm1, dword [rcx + 0x10]
cvttss2si eax, xmm0
movss xmm0, dword [rdx + 4]
subss xmm0, dword [rcx + 0x14]
mov dword [rsp + 0x20], eax
cvttss2si eax, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm0, dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0xc0]
mov dword [rsp + 0x24], eax
cvttss2si eax, xmm1
mov dword [rsp + 0x28], eax
cvttss2si eax, xmm0
mov dword [rsp + 0x2c], eax
mov rax, qword [r8 + 0xc8]
lea r8, [rsp + 0x20]
mov edx, dword [rax + rcx*4 - 4]
not edx
movzx eax, byte [r8]
inc r8
movzx ecx, dl
xor rcx, rax
shr edx, 8
lea rax, [0x180155b60]
xor edx, dword [rax + rcx*4]
sub r9, 1
jne 0x18007cd94
not edx
mov ecx, edx
call fcn.18007cf8c
mov eax, edx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180113f60
add rsp, 0x48
ret
Function at 0x180084c60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18024c7b0]
mov r10d, 8
mov qword [rsp + 0x30], rcx
mov r9, qword [rax + 0x1a80]
movsxd rcx, dword [r9 + 0xc0]
mov rax, qword [r9 + 0xc8]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x30]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x180155b60]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x180084c98
not r8d
lea rdx, [rsp + 0x30]
lea rcx, [r9 + 0xc0]
mov dword [rsp + 0x30], r8d
call fcn.18008aa9c
add rsp, 0x28
ret

Function at 0x180084cd8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18024c7b0]
mov r10d, 4
mov dword [rsp + 0x30], ecx
mov r9, qword [rax + 0x1a80]
movsxd rcx, dword [r9 + 0xc0]
mov rax, qword [r9 + 0xc8]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x30]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x180155b60]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x180084d0f
not r8d
lea rdx, [rsp + 0x30]
lea rcx, [r9 + 0xc0]
mov dword [rsp + 0x30], r8d
call fcn.18008aa9c
add rsp, 0x28
ret

Function at 0x180089b4c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x18024c7b0]
cmp byte [rbx + 0x3048], 0
je 0x180089c0c
cmp qword [rbx + 0x3050], 0
lea rbp, [rax + 0x10]
lea rdi, [rbx + 0x3058]
je 0x180089bfe
mov r9d, dword [rdi + 4]
test r9d, r9d
jns 0x180089bb7
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18008b410
mov rcx, qword [rsp + 0x40]
and dword [rdi], 0
mov rdx, rcx
mov rcx, rdi
mov r8, rbp
call fcn.18007b74c
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3050]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x18024c7a4]
movsxd r8, eax
mov rax, qword [rbx + 0x3060]
test rax, rax
cmovne rcx, rax
call fcn.180120128
jmp 0x180089c0c
mov rdx, rcx
mov r8, rbp
mov rcx, rdi
call fcn.18007b74c
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x18008a220
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x18024c7b0]
mov rbx, rcx
and dword [rax + 0x3014], 0
test rcx, rcx
je 0x18008a287
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.18008a294
lea rdx, [0x1801559a8]
mov rcx, rbx
mov rdi, rax
call fcn.18007accc
mov rbx, rax
test rax, rax
je 0x18008a287
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call fcn.180120128
mov rcx, rbx
call fcn.180120b38
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18010d178
Capabilities:
Set console window title

Disassembly:
sub rsp, 0xb8
mov rax, qword [0x18021b070]
xor rax, rsp
mov qword [rsp + 0xa0], rax
cmp byte [0x18024fbed], 0
je 0x18010d1a1
xor al, al
jmp 0x18010d3ab
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x18024c918], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x18024c928], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x18024c908], rax
call qword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
je 0x18010d1ef
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x18024c930], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x18024c910], rax
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [0x18024c920], rax
mov edx, 3
mov rcx, qword [0x18024c930]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov edx, 0xe1
mov rcx, qword [0x18024c920]
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
movabs rax, 0x5dfc50aa49194476
mov qword [rsp + 0x20], rax
movabs rax, 0xf4171737a3642de4
mov qword [rsp + 0x28], rax
movabs rax, 0x963a755575fca0ac
mov qword [rsp + 0x30], rax
movabs rax, 0xa0f0dd0e6693d2e5
mov qword [rsp + 0x38], rax
movabs rax, 0xc63ef4deb48949d2
mov qword [rsp + 0x40], rax
movabs rax, 0x90eadfd9db8bab53
mov qword [rsp + 0x48], rax
movabs rax, 0xec31631335a702af
mov qword [rsp + 0x50], rax
movabs rax, 0x8b138fbc3ea45ed4
mov qword [rsp + 0x58], rax
movabs rax, 0x329522cf396c372d
mov qword [rsp + 0x60], rax
movabs rax, 0x8145376ada104496
mov qword [rsp + 0x68], rax
movabs rax, 0xb61a557555dcd4df
mov qword [rsp + 0x70], rax
movabs rax, 0x8084fa6009f7f2c8
mov qword [rsp + 0x78], rax
movabs rax, 0xae4ad4bbc7e625b1
mov qword [rsp + 0x80], rax
movabs rax, 0xff99b1b6b8abd83a
mov qword [rsp + 0x88], rax
movabs rax, 0xcc5c0c61538767c3
mov qword [rsp + 0x90], rax
movabs rax, 0x8b138fbc3ea45e8c
mov qword [rsp + 0x98], rax
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [rsp + 0x30]
pxor xmm1, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [rsp + 0x40]
pxor xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rsp + 0x50]
pxor xmm1, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x50], xmm1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov byte [0x18024fbed], 1
mov al, 1
jmp 0x18010d3ab
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180113f60
add rsp, 0xb8
ret
Function at 0x18010e820
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18010ea40
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18010e927
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18010e884
mov rax, qword [0x18021b008]
cmp qword [rsp + 0x20], rax
ja 0x18010e884
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18010e846
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180116fa0
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18010e8b3
jmp 0x18010e927
cmp dword [rsp + 0x50], 0x10000
jne 0x18010e90a
cmp qword [rsp + 0x48], 0x10000
jb 0x18010e90a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18010e8f8
mov rax, qword [rsp + 0x28]
jmp 0x18010e929
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18010e922
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18010ea40
mov qword [rsp + 0x20], rax
jmp 0x18010e846
xor eax, eax
add rsp, 0x68
ret

Function at 0x18010e930
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18010ea80
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18010ea33
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18010e98b
mov rax, qword [0x18021b008]
cmp qword [rsp + 0x20], rax
ja 0x18010e98b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18010e94d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180116fa0
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18010e9ba
jmp 0x18010ea33
cmp dword [rsp + 0x50], 0x10000
jne 0x18010ea11
cmp qword [rsp + 0x48], 0x10000
jb 0x18010ea11
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18010e9ff
mov rax, qword [rsp + 0x28]
jmp 0x18010ea35
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18010ea2e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18010ea80
mov qword [rsp + 0x20], rax
jmp 0x18010e94d
xor eax, eax
add rsp, 0x68
ret
Function at 0x18010ead0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18010f060
mov qword [rsp + 0x28], 0
cmp qword [0x18024aec8], 0
jne 0x18010eb18
cmp qword [0x18024aec0], 0
je 0x18010eb18
mov rax, qword [0x18024aec0]
mov qword [0x18024aec8], rax
cmp qword [0x18024aec8], 0
je 0x18010ebbe
mov rax, qword [0x18024aec8]
cmp qword [rax + 0x10], 0
je 0x18010ebbe
mov rax, qword [0x18024aec8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18010ebbe
mov rax, qword [0x18024aec8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18010ebbe
mov rax, qword [0x18024aec8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18010eb84
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18010eb8b
xor eax, eax
jmp 0x18010ed39
mov rax, qword [0x18024aec8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.180116fa0
mov rax, qword [rsp + 0x28]
jmp 0x18010ed39
mov rax, qword [0x18024aec0]
mov qword [0x18024aec8], rax
jmp 0x18010ebe0
mov rax, qword [0x18024aec8]
mov rax, qword [rax + 8]
mov qword [0x18024aec8], rax
cmp qword [0x18024aec8], 0
je 0x18010ec2d
cmp qword [0x18024aec8], 0
je 0x18010ec2b
mov rax, qword [0x18024aec8]
cmp qword [rax + 0x10], 0
je 0x18010ec2b
mov rax, qword [0x18024aec8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18010ec2b
mov rax, qword [0x18024aec8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18010ec2b
jmp 0x18010eb5c
jmp 0x18010ebce
mov rcx, qword [rsp + 0x60]
call fcn.180110ee0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18010ed40
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18010ed37
mov rax, qword [rsp + 0x48]
mov qword [0x18024aec8], rax
mov rax, qword [0x18024aec8]
mov dword [rax], 0x52727464
mov rax, qword [0x18024aec8]
mov qword [rax + 0x10], 0
mov rax, qword [0x18024aec8]
mov rcx, qword [0x18024aec0]
mov qword [rax + 8], rcx
mov rax, qword [0x18024aec8]
mov qword [0x18024aec0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18024aec8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18010ece8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18010ed22
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18010ecde
mov rax, qword [0x18024aec8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18010eb5c
xor eax, eax
add rsp, 0x58
ret
Function at 0x180130688
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1801306a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18011f290
or eax, 0xffffffff
jmp 0x1801306aa
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400029c0
Capabilities:
Query environment variable

Disassembly:
push rdi
mov eax, 0x20
call fcn.1400035e0
sub rsp, rax
call qword [sym.imp.cdsCommon64.dll_cdsGetInstallRoot]
mov rdi, rax
test rax, rax
je 0x140002ab9
mov qword [rsp + 0x30], rbx
lea rcx, str.CHDL_LIB_INST_DIR
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
call qword [sym.imp.MSVCR110.dll_getenv]
lea rcx, str.CONCEPT_INST_DIR
mov rbx, rax
call qword [sym.imp.MSVCR110.dll_getenv]
lea rcx, str.CDSROOT
mov rsi, rax
call qword [sym.imp.MSVCR110.dll_getenv]
test rbx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, rax
jne 0x140002a4e
lea rdx, str.CHDL_LIB_INST_DIR_s
lea rcx, [0x1401cce60]
mov r8, rdi
call qword [sym.imp.MSVCR110.dll_sprintf]
lea rcx, [0x1401cce60]
call qword [sym.imp.MSVCR110.dll__putenv]
test rsi, rsi
mov rsi, qword [rsp + 0x40]
jne 0x140002a7c
lea rdx, str.CONCEPT_INST_DIR_s
lea rcx, [0x1401cce60]
mov r8, rdi
call qword [sym.imp.MSVCR110.dll_sprintf]
lea rcx, [0x1401cce60]
call qword [sym.imp.MSVCR110.dll__putenv]
test rbp, rbp
mov rbp, qword [rsp + 0x38]
jne 0x140002aaa
lea rdx, str.CDSROOT_s
lea rcx, [0x1401cce60]
mov r8, rdi
call qword [sym.imp.MSVCR110.dll_sprintf]
lea rcx, [0x1401cce60]
call qword [sym.imp.MSVCR110.dll__putenv]
mov rcx, rdi
add rsp, 0x20
pop rdi
jmp qword [sym.imp.MSVCR110.dll_free]
add rsp, 0x20
pop rdi
ret
Function at 0x140002ac0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov eax, 0x1170
call fcn.1400035e0
sub rsp, rax
mov rbx, rcx
lea rcx, [rsp + reloc.mfc110.dll_Ordinal_305]
xor edx, edx
mov r8d, 0x103f
mov byte [rsp + 0x130], 0
call sub.MSVCR110.dll_memset
lea rcx, str.PATH
call qword [sym.imp.MSVCR110.dll_getenv]
lea rdx, [0x1401860e0]
lea rcx, [rsp + 0x20]
mov r8, rbx
mov r14, rax
call qword [sym.imp.MSVCR110.dll_sprintf]
or rdi, 0xffffffffffffffff
lea rax, [rsp + 0x20]
mov rcx, rdi
inc rcx
cmp byte [rax + rcx], 0
jne 0x140002b34
xor ebx, ebx
movsxd rsi, ecx
test ecx, ecx
jle 0x140002b67
nop word [rax + rax]
movsx ecx, byte [rsp + rbx + 0x20]
call qword [sym.imp.MSVCR110.dll_tolower]
inc rbx
mov byte [rsp + rbx + 0x1f], al
cmp rbx, rsi
jl 0x140002b50
mov rbx, rdi
nop word [rax + rax]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140002b70
lea eax, [rbx + 1]
movsxd rcx, eax
call qword [sym.imp.MSVCR110.dll_malloc]
mov rdx, r14
mov r8, rax
mov rbp, rax
sub r8, r14
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
mov byte [r8 + rdx - 1], cl
test cl, cl
jne 0x140002ba0
movsxd rsi, ebx
mov byte [rsi + rax], cl
test ebx, ebx
jle 0x140002bd5
mov rbx, rax
nop dword [rax]
movsx ecx, byte [rbx]
call qword [sym.imp.MSVCR110.dll_tolower]
lea rbx, [rbx + 1]
mov byte [rbx - 1], al
dec rsi
jne 0x140002bc0
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.MSVCR110.dll_strstr]
test rax, rax
jne 0x140002c68
lea rax, [rsp + 0x20]
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002bf4
movsxd rax, ebx
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov byte [rsp + rax + 0x1f], 0
dec ebx
call qword [sym.imp.MSVCR110.dll_strstr]
mov rdx, rax
test rax, rax
je 0x140002c36
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140002c20
cmp edi, ebx
je 0x140002c68
movsxd rax, ebx
cmp byte [rax + rdx], 0x3b
je 0x140002c68
lea r8, [rsp + 0x20]
lea rdx, [0x1401860e4]
lea rcx, [rsp + 0x130]
mov r9, r14
call qword [sym.imp.MSVCR110.dll_sprintf]
lea rdx, [rsp + 0x130]
lea rcx, str.PATH
call qword [sym.imp.MSVCR110.dll__putenv_s]
lea r11, [rsp + 0x1170]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret