joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014356c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1401435a6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1401435ab
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1401435f4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140152c10]
cmp byte [rcx + rax], 0
je 0x1401435f4
dec r8
sub rdx, 1
jne 0x1401435da
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140144d00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140144d4a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140144d4a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140144d4a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140144d4a
cmp dword [rcx + 0x84], 0xe
jbe 0x140144d4a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140144d4c
xor al, al
add rsp, 0x28
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
xor dword [rdi + rdi*4 + 0x1bd8b1f8], esp
test al, 0xa8
sbb edi, ebx
push rbp
outsd dx, dword [rsi]
popfq
push rdx
sbb esi, esi
test byte [rsi + 0x3f3816f4], cl
invalid
ror byte [rdx + 0x3e], 0x46
ror dword [rax], cl
js 0x14002321f
fisub dword [rcx]
imul eax, esp, 0x730acbe5
xchg ebp, eax
fsubr dword [rax + 0x67ea328c]
out 0x8c, eax
fdivp st(2)
mov ecx, dword [rcx + rax*2]
cmp al, 0xb2
lea esi, [rsi]
fdivp st(2)
xchg r11, rax
sar ch, cl
jno 0x14002332c
stosb byte [rdi], al
xchg ebp, eax
ffreep st(7)
call 0x1382471dd
ja 0x1400232e5
rcl dword [rax], 0xb4
add ecx, dword [rbp + 0x1b]
or edx, dword [rcx]
invalid
or al, 0xba
xchg ebx, eax
xchg dword [rcx + rdx*4 - 0x1d85e2c5], esp
adc byte [rax], bh
pop rdi
invalid
invalid
Function at 0x180003390
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1800033b6
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.180003390
movzx edx, word [rdi + rbx*2]
mov ecx, eax
mov rbx, qword [rsp + 0x30]
xor rdx, rcx
movzx ecx, dl
lea rdx, [0x180035990]
shr eax, 8
xor eax, dword [rdx + rcx*4]
add rsp, 0x20
pop rdi
ret

Function at 0x180003410
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180003436
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
dec rcx
mov qword [rsp + 0x38], rdi
call fcn.180003410
movsx ebx, byte [rbx + rsi]
mov edi, eax
call fcn.1800033f0
mov byte [rsp + 0x30], al
movzx edx, bl
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x40], 0x302bb97b
mov r8d, dword [rsp + 0x40]
movzx ecx, byte [rsp + 0x30]
xor r8d, 0x333
movsx eax, byte [rsp + 0x30]
sub dl, cl
xor r8b, 0x52
cmp dl, r8b
mov edx, ebx
mov rbx, qword [rsp + 0x48]
sbb ecx, ecx
add eax, 0xbe
and ecx, 0x20
or edx, ecx
lea rcx, [0x180035990]
xor edx, edi
shr edi, 8
and rax, rdx
xor edi, dword [rcx + rax*4]
mov eax, edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret

Function at 0x1800034c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1800034e6
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
dec rcx
mov qword [rsp + 0x38], rdi
call fcn.1800034c0
movzx ebx, word [rsi + rbx*2]
mov edi, eax
call fcn.1800033f0
mov byte [rsp + 0x30], al
movzx ecx, bx
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x40], 0x25e1c6d7
mov r8d, dword [rsp + 0x40]
movsx edx, byte [rsp + 0x30]
xor r8d, 0x333
sub cx, dx
xor r8b, 0xfe
movsx edx, byte [rsp + 0x30]
movzx eax, r8b
cmp cx, ax
sbb ax, ax
add edx, 0xbe
and ax, 0x20
or bx, ax
lea rax, [0x180035990]
movzx ecx, bx
mov rbx, qword [rsp + 0x48]
xor rcx, rdi
shr edi, 8
and rdx, rcx
xor edi, dword [rax + rdx*4]
mov eax, edi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
Function at 0x180005810
Capabilities:
Parse pe header

Disassembly:
mov r11, rsp
push r15
sub rsp, 0x80
mov rax, qword [0x18003c040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov qword [r11 - 0x48], 8
mov qword [r11 - 0x58], rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x48], eax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x30]
mov r15, qword [rcx + 0x60]
test r15, r15
je 0x1800059ef
mov qword [r11 - 0x20], r13
mov eax, 0x5a4d
mov r13, qword [r15 + 0x10]
cmp word [r13], ax
jne 0x1800059ea
movsxd rax, dword [r13 + 0x3c]
cmp dword [rax + r13], 0x4550
jne 0x1800059ea
mov qword [r11 - 0x28], r14
mov r14d, dword [rax + r13 + 0x90]
add r14, r13
cmp dword [r14], 0
je 0x1800059e5
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov ecx, dword [r14 + 0xc]
add rcx, r13
call fcn.18000aa90
mov r12, rax
test rax, rax
je 0x1800059c3
mov esi, dword [r14]
add rsi, qword [r15 + 0x10]
mov ebx, dword [r14 + 0x10]
add rbx, qword [r15 + 0x10]
mov rcx, qword [rsi]
test rcx, rcx
js 0x1800059b5
je 0x1800059b5
mov rdx, qword [r15 + 0x10]
add rdx, 2
mov qword [rsp + 0x30], rbx
mov rbp, qword [rbx]
add rdx, rcx
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x180005905
dec rcx
call fcn.180003410
not eax
mov rcx, r12
mov edx, eax
call fcn.18000aba0
mov rdi, rax
test rbp, rbp
je 0x180005998
test rax, rax
je 0x180005998
cmp rbp, rax
je 0x180005998
lea rax, [rsp + 0x38]
mov qword [rsp + 0x40], 8
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov rcx, 0xffffffffffffffff
lea rdx, [rsp + 0x30]
call fcn.18000f7f8
test eax, eax
js 0x180005998
mov qword [rbx], rdi
lea rax, [rsp + 0x48]
mov r9d, dword [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x40], 8
call fcn.18000f7f8
add rsi, 8
mov qword [rsp + 0x30], 0
add rbx, 8
mov rcx, qword [rsi]
test rcx, rcx
jns 0x1800058e5
add r14, 0x14
cmp dword [r14], 0
jne 0x1800058b2
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18000f9f0
add rsp, 0x80
pop r15
ret
Function at 0x18000a680
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], 0
jne 0x18000a690
dec r8
cmp r8, 0xffffffffffffffff
jne 0x18000a6ab
mov eax, 0xffffffff
jmp 0x18000a6d1
lea rcx, [r8 - 1]
mov rdx, rbx
call fcn.180003390
movzx edx, word [rbx + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
lea rdx, [0x180035990]
xor eax, dword [rdx + rcx*4]
not eax
xor edx, edx
mov ecx, eax
call fcn.18000a860
test rax, rax
jne 0x18000a6ee
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18000a420
add rsp, 0x20
pop rbx
ret
Function at 0x18000aeb0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
xor edx, edx
call fcn.18000a860
mov edx, ebx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.18000aba0

Function at 0x18000aed0
Capabilities:
Hash data with crc32
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rcx + r8*2], 0
jne 0x18000aef0
dec r8
cmp r8, 0xffffffffffffffff
jne 0x18000af0b
mov eax, 0xffffffff
jmp 0x18000af31
lea rcx, [r8 - 1]
mov rdx, rbx
call fcn.180003390
movzx edx, word [rbx + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
lea rdx, [0x180035990]
xor eax, dword [rdx + rcx*4]
not eax
xor edx, edx
mov ecx, eax
call fcn.18000a860
test rax, rax
jne 0x18000af49
mov rcx, rbx
call fcn.18000a420
mov edx, edi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18000aba0

Function at 0x18000b2f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbp, rcx
test rcx, rcx
je 0x18000b37f
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000b37f
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
cmp dword [rsi], 0x4550
jne 0x18000b37f
xor edi, edi
cmp di, word [rsi + 6]
jae 0x18000b37f
nop word [rax + rax]
movzx ecx, word [rsi + 0x14]
lea rdx, [rdi + rdi*4]
add rcx, rsi
lea rbx, [rcx + rdx*8]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx + 0x18], 0
jne 0x18000b356
dec rcx
lea rdx, [rbx + 0x18]
call fcn.180003410
not eax
cmp eax, 0xa21c1ea3
je 0x18000b39c
movzx eax, word [rsi + 6]
inc edi
cmp edi, eax
jb 0x18000b340
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [r14], rbp
mov eax, dword [rbx + 0x24]
add rax, rbp
mov qword [r14 + 8], rax
mov eax, dword [rbx + 0x28]
mov dword [r14 + 0x10], eax
mov eax, dword [rbx + 0x24]
sub eax, dword [rbx + 0x2c]
mov dword [r14 + 0x14], eax
mov eax, 1
jmp 0x18000b381

Function at 0x18000f6d5
Capabilities:
Check os version
Execute syscall

Disassembly:
xor al, 0x5a
mov r10, qword gs:[0x60]
cmp word [r10 + 0x118], 0xa
je 0x18000f727
cmp word [r10 + 0x118], 6
je 0x18000f6f8
jmp 0x18000f74e
cmp word [r10 + 0x11c], 3
je 0x18000f729
cmp word [r10 + 0x11c], 2
je 0x18000f72b
cmp word [r10 + 0x11c], 1
jne 0x18000f74e
cmp word [r10 + 0x120], 0x1db1
je 0x18000f72d
jmp 0x18000f74e
inc eax
inc eax
inc eax
cmp qword [0x18003dd88], 0
jne 0x18000f743
cmp eax, 0xc390050f
pop r10
mov r10, rcx
jne 0x18000f738
syscall
nop
ret
pop r10
mov r10, rcx
jmp qword [0x18003dd88]
ret
Function at 0x180020884
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800208b4
xor eax, eax
jmp 0x180020977
mov rbp, rbx
cmp word [rax], si
je 0x1800208d9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800208c0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800208bc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800207d4
movsxd r14, eax
test eax, eax
jne 0x180020917
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800208ad
mov rcx, r14
call fcn.18001e578
mov rdi, rax
test rax, rax
jne 0x180020930
xor ecx, ecx
call fcn.18001e53c
jmp 0x18002090c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800207d4
test eax, eax
jne 0x180020961
mov rcx, rdi
call fcn.18001e53c
jmp 0x18002096b
xor ecx, ecx
call fcn.18001e53c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x180024fd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180024ff8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180024ff8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001120
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001148
xor eax, eax
lea r8, [0x180001080]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x18000cd78
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18000cda8
xor eax, eax
jmp 0x18000ce6b
mov rbp, rbx
cmp word [rax], si
je 0x18000cdcd
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18000cdb4
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18000cdb0
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18000cc98
movsxd r14, eax
test eax, eax
jne 0x18000ce0b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000cda1
mov rcx, r14
call fcn.1800092f8
mov rdi, rax
test rax, rax
jne 0x18000ce24
xor ecx, ecx
call fcn.18000876c
jmp 0x18000ce00
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18000cc98
test eax, eax
jne 0x18000ce55
mov rcx, rdi
call fcn.18000876c
jmp 0x18000ce5f
xor ecx, ecx
call fcn.18000876c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18001083c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180010852
mov al, 1
jmp 0x1800108b2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x180010863
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800108b0
mov ecx, dword [rcx + 0x18]
nop
call fcn.18000e680
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800108b0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800108b0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800108b0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800108b2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1800062c0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r15
sub rsp, 0x78
mov rax, qword [0x180045068]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor ebp, ebp
mov r15, r9
mov dword [rsp + 0x40], ebp
mov rbx, rdx
call fcn.180007990
test al, al
je 0x1800064e9
cmp qword [rbx + 0x18], 0x10
jb 0x1800062fc
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov rcx, rbx
mov dword [rsp + 0x20], 4
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800064e9
xor edx, edx
mov qword [rsp + 0xa0], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18000635a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1800063b7
mov qword [rsp + 0x70], r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rdx, rax
mov r8d, edi
mov rcx, rsi
mov r14, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1800063d6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800110b0
add rsp, 0x78
pop r15
pop rsi
pop rbp
pop rbx
ret
mov ebx, dword [rsp + 0x40]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x60], 0xf
cmp rbx, 0xf
ja 0x18000640a
mov r8d, ebx
mov qword [rsp + 0x58], rbx
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.1800129f0
mov byte [rsp + rbx + 0x48], bpl
jmp 0x18000647f
mov eax, 0x16
mov rbp, rbx
or rbp, 0xf
cmp rbp, rax
cmovb rbp, rax
lea rcx, [rbp + 1]
cmp rcx, 0x1000
jb 0x180006456
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800064f6
mov rcx, rax
call fcn.1800108dc
test rax, rax
je 0x1800064f0
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18000645e
call fcn.1800108dc
mov rdi, rax
mov r8, rbx
mov qword [rsp + 0x58], rbx
mov rdx, r14
mov qword [rsp + 0x60], rbp
mov rcx, rdi
call fcn.1800129f0
mov byte [rdi + rbx], 0
mov qword [rsp + 0x48], rdi
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.180003e40
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800064c5
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800064c0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800064f0
call fcn.180010918
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1800063b2
xor al, al
jmp 0x1800063bf
call fcn.180016e8c
int3
call fcn.180009250
int3
Function at 0x180008300
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0xfe40
call fcn.180011050
sub rsp, rax
mov rax, qword [0x180045068]
xor rax, rsp
mov qword [rsp + 0xfe30], rax
mov rsi, r8
lea rcx, [rsp + 0x40]
mov rbp, rdx
mov r8d, 0xfde8
xor edx, edx
call fcn.1800130a0
xor r8d, r8d
lea rdx, [0x1800305af]
mov rcx, rsi
call fcn.1800094c0
xor r14d, r14d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], r14
lea r9, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rbp
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18000846d
cmp dword [rsp + 0x30], r14d
jbe 0x18000846d
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov r8d, 0xfde7
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180008442
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180008442
cmp rax, 0xfde8
jae 0x180008497
mov byte [rsp + rax + 0x40], r14b
mov rbx, 0xffffffffffffffff
lea rax, [rsp + 0x40]
nop
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1800083e0
mov rdx, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x10]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x18000842a
lea rax, [rcx + rbx]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x180008410
mov rax, qword [rsi]
lea rdi, [rax + rcx]
mov r8, rbx
mov rcx, rdi
lea rdx, [rsp + 0x40]
call fcn.1800129f0
mov byte [rdi + rbx], r14b
jmp 0x180008442
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call fcn.180001db0
xor edx, edx
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x34]
mov rcx, rbp
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x180008385
mov al, 1
mov rcx, qword [rsp + 0xfe30]
xor rcx, rsp
call fcn.1800110b0
lea r11, [rsp + 0xfe40]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.180010da8
int3
Function at 0x180008910
Capabilities:
Check os version
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x190
mov rax, qword [0x180045068]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rbx, rcx
call fcn.180004b00
mov dword [rsp + 0x60], 0x114
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x18000896a
mov eax, dword [rsp + 0x64]
cmp eax, 5
je 0x180008963
cmp eax, 6
jne 0x18000896a
cmp dword [rsp + 0x68], 2
jae 0x18000896a
mov byte [rbx + 0x2b1], 1
mov ecx, 0x10
call fcn.1800108dc
xor edi, edi
test rax, rax
je 0x18000898b
mov qword [rax], rbx
lea rcx, [0x180004d70]
mov qword [rax + 8], rcx
jmp 0x18000898e
mov rax, rdi
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x180001c10]
xor edx, edx
xor ecx, ecx
call fcn.18001929c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180008a80
mov ecx, 0x10
call fcn.1800108dc
test rax, rax
je 0x1800089e1
mov qword [rax], rbx
lea rcx, [0x180008ac0]
mov qword [rax + 8], rcx
jmp 0x1800089e4
mov rax, rdi
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x180001c10]
xor edx, edx
xor ecx, ecx
call fcn.18001929c
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180008a71
cmp dword [rsp + 0x38], 0
je 0x180008a8f
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x38], eax
je 0x180008a9a
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.18000ef24
test eax, eax
jne 0x180008aa5
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
cmp dword [rsp + 0x58], eax
jne 0x180008ab0
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1800110b0
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rdi
ret
mov dword [rsp + 0x58], edi
mov ecx, 6
call fcn.18000f51c
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call fcn.18000f51c
nop
mov ecx, 1
call fcn.18000f51c
int3
mov ecx, 5
call fcn.18000f51c
int3
mov ecx, 2
call fcn.18000f51c
nop
call fcn.180019150
int3