joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180045d20
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rsp + 0x100], rax
imul eax, edx, 0x294
mov rbp, r9
mov r12, r8
mov dword [rsp + 0x30], edx
mov ebx, edx
mov r14, rcx
mov r15d, edx
mov dword [rsp + 0x20], eax
cmp edx, eax
ja 0x180045ed5
mov rsi, qword [rsp + 0x28]
xor r13d, r13d
mov rdi, qword [rsp + 0x28]
nop word [rax + rax]
mov eax, r15d
sub eax, 0x8e
je 0x180045e98
sub eax, 0x23
je 0x180045e6d
sub eax, 0x4915
je 0x180045e5d
sub eax, 0x122f
je 0x180045dc3
cmp eax, 0x5b44
jne 0x180045ec1
cmp rsi, qword [r14]
sete r13b
mov eax, r13d
jmp 0x180045ed9
mov rsi, r13
cmp qword [rbp + 0x30], r13
jbe 0x180045e27
mov ebx, 0x2a
mov eax, ebx
sub eax, 0x2a
je 0x180045e11
sub eax, 1
je 0x180045de7
cmp eax, 1
jne 0x180045e1c
add rsi, rdi
jmp 0x180045e1c
lea rdx, [rbp + 0x14]
mov r8, rdi
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
lea r9, [rsp + 0x28]
mov qword [rsp + 0x28], rdi
mov r8, rbp
xor edx, edx
mov ecx, SHSetFolderPathA
call fcn.180045010
jmp 0x180045e1c
mov rdi, qword [rbp + 0x30]
cmp qword [r14], rdi
cmovb rdi, qword [r14]
inc ebx
cmp ebx, 0x2d
jb 0x180045dd1
mov ebx, dword [rsp + 0x30]
mov rax, qword [r14]
cmp rsi, rax
jae 0x180045ec1
sub rax, rsi
lea rdx, [r12 + rsi]
mov r9d, 0xd5
mov qword [rsp + 0x28], rax
mov r8, rbp
lea rcx, [rsp + 0x28]
call fcn.18000eae0
test eax, eax
jle 0x180045ec1
mov eax, eax
add rsi, rax
jmp 0x180045ec1
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
jmp 0x180045ec1
mov eax, dword [rbp + 0x10]
test eax, eax
jne 0x180045e91
xor r8d, r8d
mov edx, 0xd4
mov rcx, rbp
call fcn.180068330
test eax, eax
je 0x180045f04
mov dword [rbp + 0x10], 1
jmp 0x180045ec1
cmp eax, 2
je 0x180045f0b
jmp 0x180045ec1
mov r8, r12
lea rcx, [rsp + 0x40]
mov rdx, rbp
call fcn.1800a0e90
lea r8, [rsp + 0x40]
lea rdx, str.sim_core_signal___internal_error___bad_switch
lea rcx, [rsp + 0x80]
call fcn.1800a0e90
imul eax, ebx, 0x84
add r15d, eax
cmp r15d, dword [rsp + 0x20]
jbe 0x180045d80
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0x158]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rbp + 0x10], 2
mov eax, r13d
jmp 0x180045ed9
Function at 0x180048610
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebx, dword [rsp + 0x70]
lea r15d, [rcx + 9]
mov r13, r8
mov r12, rdx
mov esi, ecx
cmp ecx, r15d
jae case.0x18004866d.35
mov rbp, qword [rsp + 0x88]
lea rdi, str._lhd_
mov r14, qword [rsp + 0x88]
lea eax, [rsi - 0x1c]
lea rdx, [0x180000000]
cmp eax, 9
ja case.0x18004866d.36
mov ecx, dword [rdx + rax*4 + 0x48814]
add rcx, rdx
jmp rcx
mov rdx, rbp
mov ecx, 0x1c
call fcn.180028580
jmp case.0x18004866d.36
mov rdx, qword [r12 + 8]
xor r8d, r8d
lea ecx, [r8 + 0x22]
call fcn.180045920
mov r14, rax
jmp case.0x18004866d.36
xor ebx, ebx
jmp case.0x18004866d.36
mov edi, 0x51
nop dword [rax]
mov eax, edi
sub eax, 0x51
je 0x1800486d8
sub eax, 0x4c
je 0x1800486f3
cmp eax, 0xb0a
jne 0x1800486f3
lea rdi, str._lhd_
inc esi
cmp esi, r15d
jb 0x180048654
mov eax, ebx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [r14]
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x1800486ea
mov rcx, qword [r14 + 8]
call rdx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add edi, 0x5b2
cmp edi, 0x1116
jbe 0x1800486a0
jmp 0x1800486b3
mov rax, qword [r13]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x180048716
lea rcx, [r13 + 0x48]
call rdx
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp case.0x18004866d.36
cmp dword [r13], 2
jl 0x1800487cc
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
xor r8d, r8d
mov edx, 0xc4
mov r9, rax
xor ecx, ecx
call fcn.18006f750
jmp case.0x18004866d.36
test r14, r14
je 0x1800487e8
mov r9, r14
xor edx, edx
xor ecx, ecx
mov r8d, 0xe9
call fcn.18004c0d0
mov rbp, rax
xor esi, esi
nop
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov edx, 0xfc
mov rcx, rbp
call fcn.180047a70
test rax, rax
je case.0x18004866d.31
lea rdx, [rax + 0x28]
mov rax, rsi
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [rdi + rax - 1]
jne 0x1800487b5
cmp rax, 6
jne 0x1800487a0
jmp 0x180048770
xor edx, edx
mov r8, rbp
lea ecx, [rdx + 0x2d]
call fcn.180009d70
mov esi, 0x1f
jmp case.0x18004866d.36
mov rdx, qword [r12]
lea rcx, str.PCS_Pulkovo_Gauss_10N
call fcn.1800a0e30
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [r12 + 8]
lea rdx, str.VFNMSUBPDZ128v213rmb
mov rcx, rax
call fcn.1800a0de0
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1800566a0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x290
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rsp + 0x230], rax
imul r15d, edx, 0x32c
mov rsi, r8
mov r14d, edx
mov rbp, rcx
mov edi, edx
cmp edx, r15d
ja 0x1800567fc
movsd xmm10, qword [0x1800b8620]
xorps xmm9, xmm9
movsd xmm7, qword [0x1800b8580]
movsd xmm8, qword [0x1800b8568]
movsd xmm6, qword [rsp + 0x28]
mov ebx, dword [rsp + 0x20]
cmp edi, 0xbe2
ja 0x1800567a0
je 0x1800567fc
mov eax, edi
sub eax, 0x1a
je 0x180056768
sub eax, 0x58
je 0x180056850
cmp eax, 0x7a
jne 0x1800567ed
movsd xmm6, qword [rsi]
xor ebx, ebx
comisd xmm9, xmm6
jbe 0x1800567ed
xorps xmm6, xmm10
jmp 0x1800567ed
test rsi, rsi
je 0x180056795
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x180056795
xor ecx, ecx
test rdx, rdx
je 0x180056795
mov rax, qword [rsi]
cmp qword [rax], rbp
je 0x1800568ab
inc rcx
add rax, 8
cmp rcx, rdx
jb 0x180056780
mov qword [rsp + 0x20], 0xffffffffffffffff
jmp 0x1800567ed
cmp edi, 0x341a
je 0x1800568b3
cmp edi, 0x6bdc
je 0x1800567d5
cmp edi, 0xd6cc
jne 0x1800567ed
movsd xmm2, qword [rsi]
lea rcx, str._.f
movq r8, xmm2
mov edx, ebx
call fcn.1800a0e30
jmp 0x1800567ed
comisd xmm7, xmm6
jbe 0x1800567ed
nop dword [rax + rax]
mulsd xmm6, xmm8
inc ebx
comisd xmm7, xmm6
ja 0x1800567e0
imul eax, r14d, 0x74
add edi, eax
cmp edi, r15d
jbe 0x180056727
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1800a1820
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov r9, rsi
mov qword [rsp + 0x28], 0x200
lea r8, [rsp + 0x30]
mov ecx, 0x60
lea rdx, [rsp + 0x28]
call fcn.18001b9c0
mov rbx, rax
test rax, rax
je 0x1800568f0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
lea rcx, [rsp + 0x30]
mov r9, rax
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rbx
jae 0x180056850
mov dword [rsp + 0x20], 0
jmp 0x1800567fc
mov rax, rcx
jmp 0x180056801
mov eax, reloc.SHELL32.dll_ILClone
cmp eax, 0x1f8
jae 0x1800567fc
cmp eax, 0x12
je 0x1800568f0
cmp eax, 0xb4
je 0x1800568e1
cmp eax, 0x156
je 0x1800567fc
add eax, 0xa2
jmp 0x1800568b8
mov dword [rsp + 0x20], 1
add eax, 0xa2
jmp 0x1800568b8
mov eax, reloc.SHELL32.dll_ILClone
add eax, 0xa2
jmp 0x1800568b8
Function at 0x180065670
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x38
mov rbx, rcx
lea r9, [r11 - 0x28]
lea rcx, [r11 + 0x18]
mov rax, rdx
mov qword [r11 - 0x20], rcx
lea rdx, [r11 - 0x20]
mov rcx, rax
mov r8d, 0x118
call fcn.180008050
mov r8, qword [rsp + 0x20]
mov edi, eax
test r8, r8
jne 0x1800656c0
lea ecx, [r8 - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdx, rbx
mov ecx, 0xa1
call fcn.1800656f0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, edi
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x1800657b0
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rdi
sub rsp, 0x38
lea rax, [r11 + 0x10]
mov r8d, 0x118
lea r9, [r11 - 0x28]
mov qword [r11 - 0x20], rax
lea rdx, [r11 - 0x20]
call fcn.180008050
mov rbx, qword [rsp + 0x20]
mov edi, eax
test rbx, rbx
jne 0x1800657fa
lea ecx, [rbx - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, rbx
mov ecx, 0xa1
mov rdx, rax
call fcn.1800656f0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, edi
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x180065d80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rsp + 0x68], rax
lea edi, [r8 + 8]
mov ebp, r8d
mov dword [rsp + 0x30], edi
mov rsi, rdx
mov r14, rcx
cmp r8d, edi
jae case.0x180065df2.12
mov r13, qword [rsp + 0x40]
lea r15d, [r8 - 0xd]
mov edi, dword [rsp + 0x30]
lea r8, [0x180000000]
mov eax, dword [rsp + 0x30]
xor r12d, r12d
mov edx, 0x20
cmp r15d, 0x10
ja case.default.0x180065df2
mov ecx, dword [r8 + r15*4 + 0x65f68]
add rcx, r8
jmp rcx
movups xmm0, xmmword [0x1800a4468]
xor edx, edx
mov qword [rsp + 0x20], r12
mov r9, r13
xor ecx, ecx
movups xmmword [r13 + 0xd8], xmm0
lea r8d, [rdx + 0x76]
call fcn.18001ca90
jmp 0x180065f08
lea r8, [0x1800a4468]
mov qword [rsp + 0x40], reloc.SHELL32.dll_SHSetFolderPathW
lea rdx, [rsp + 0x40]
mov ecx, 0xa5
call fcn.180042400
movups xmm0, xmmword [0x1800a4458]
mov r13, rax
movups xmmword [rax + 0xc8], xmm0
jmp 0x180065f08
lea r8, [r13 + 8]
xor edx, edx
mov ecx, 0xd8
call fcn.18002fad0
mov eax, dword [r14]
test al, 2
je 0x180065e82
lea rcx, [r13 + 0xd8]
mov r8d, 0xaf
lea rdx, [r13 + 8]
call fcn.180090230
mov eax, dword [r14]
test al, 1
je 0x180065f08
lea rdx, [r13 + 0xd8]
mov r8d, 0x68
mov rcx, r13
call fcn.180069d20
jmp 0x180065f08
mov qword [rsp + 0x38], r13
jmp case.0x180065df2.2
cmp qword [rsi], r12
jbe case.0x180065df2.2
nop dword [rax]
mov ebx, 0xac
cmp ebx, 0xac
je 0x180065ecc
cmp ebx, 0x47e4
jne 0x180065ef5
mov eax, edi
sub qword [rsi], rax
jmp 0x180065ef5
mov rdi, qword [rsi]
lea rcx, [rsp + 0x48]
cmp rdi, 0x20
mov r9, r14
cmova edi, edx
mov edx, 1
mov r8d, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp eax, edi
jne 0x180065f2d
mov edx, 0x20
add ebx, 0x4738
cmp ebx, 0x8e70
jbe 0x180065eb5
cmp qword [rsi], r12
ja 0x180065eb0
lea r8, [0x180000000]
mov eax, dword [rsp + 0x30]
inc ebp
inc r15d
cmp ebp, eax
jae case.0x180065df2.12
jmp 0x180065dd8
mov eax, dword [r14]
dec eax
cmp eax, 0xb
setbe r12b
mov dword [rsp + 0x38], r12d
jmp case.0x180065df2.12
mov dword [rsp + 0x38], 1
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180072a70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
imul r13d, r8d, 0x1bd
mov r12, r9
mov r15d, r8d
mov rsi, rdx
mov rdi, rcx
mov r14d, r8d
cmp r8d, r13d
ja 0x180072bf9
mov ebp, dword [rsp + 0x20]
nop dword [rax]
mov eax, r14d
sub eax, 0x48
je 0x180072bbb
sub eax, 0x12
je 0x180072c26
sub eax, 0x6d
je 0x180072b5f
sub eax, 0x1889
je 0x180072af7
cmp eax, 0x1908
jne 0x180072be9
mov al, 1
jmp 0x180072bfe
mov eax, dword [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov r8d, 0xb9
mov rdx, rsi
call fcn.180026240
test al, al
je 0x180072c2f
mov eax, ebp
lea r8, [rsp + 0x28]
mov edx, ILAppendID
mov qword [rsp + 0x28], rax
mov rcx, rsi
call fcn.180030aa0
test al, al
je 0x180072c2f
mov eax, dword [rsp + 0x20]
mov rcx, qword [r12]
cmp rax, rcx
jae 0x180072b55
mov byte [rax + rdi], 0
jmp 0x180072be9
mov byte [rcx + rdi - 1], 0
jmp 0x180072be9
mov ebx, 0x62
cmp ebx, 0x62
je 0x180072b96
cmp ebx, 0x16f8
jne 0x180072bab
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rdi], xmm0
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rdi + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm1
jmp 0x180072bab
mov r9d, 0x85
lea r8, [rsp + 0x30]
mov rdx, rsi
xor ecx, ecx
call fcn.1800714d0
add ebx, 0x1696
cmp ebx, 0x2d2c
jbe 0x180072b64
jmp 0x180072be9
mov r8d, 0xe0
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.180044a30
test al, al
je 0x180072c2f
mov rcx, qword [r12]
xor ebp, ebp
mov edx, dword [rsp + 0x20]
cmp rdx, rcx
jbe 0x180072be9
mov ebp, edx
mov dword [rsp + 0x20], ecx
sub ebp, ecx
imul eax, r15d, 0x59
add r14d, eax
cmp r14d, r13d
jbe 0x180072ac0
movzx eax, byte [rsp + 0x24]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor al, al
jmp 0x180072bfe
Function at 0x1800a0b90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1800c37a8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea ebp, [r8 + 0x480]
mov r15, r9
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
cmp r8d, ebp
jae 0x1800a0c9b
mov rdi, qword [rsp + 0x28]
nop word [rax + rax]
cmp ebx, 0xfe
ja 0x1800a0cc6
je 0x1800a0d00
mov eax, ebx
sub eax, 0x36
je 0x1800a0c75
sub eax, 0x17
je 0x1800a0c55
sub eax, 0x69
je 0x1800a0c2c
cmp eax, 0x17
jne 0x1800a0cef
mov r8d, dword [r15]
lea edx, [rax - 0x16]
mov r9, rdi
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1800a0cef
mov rcx, qword [rsi + 8]
mov rdx, r15
add rcx, qword [rsi]
mov r8, qword [r14]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [r14]
add qword [rsi + 8], rax
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov byte [rcx + rax], 0
jmp 0x1800a0cef
lea rdx, [0x1800a7788]
lea rcx, str.SF_MUST_DEST
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
jne 0x1800a0cef
xor eax, eax
jmp 0x1800a0c9f
mov rax, qword [rsi + 8]
lea r8, [rsp + 0x28]
add rax, qword [r14]
mov edx, 0xee
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.18004fad0
test al, al
jne 0x1800a0cef
mov byte [rsp + 0x20], al
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800a1820
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
sub eax, 0x136
je 0x1800a0cea
sub eax, 0x17
je 0x1800a0ce0
sub eax, 0x69
je 0x1800a0c9b
cmp eax, 0x17
je 0x1800a0c9b
jmp 0x1800a0cef
mov dword [rsp + 0x20], 1
jmp 0x1800a0cef
mov byte [rsp + 0x20], 1
sub ebx, 0xffffff80
cmp ebx, ebp
jb 0x1800a0be0
jmp 0x1800a0c9b
mov ebx, 0x112
cmp ebx, 0x112
jne 0x1800a0d6e
mov rdx, rsi
lea rcx, str.h_sat_128B
call fcn.1800a0e30
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov edx, 0x7f
lea rcx, [rsp + 0x30]
mov r8, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgets]
test rax, rax
je 0x1800a0d62
movzx eax, byte [rsp + 0x30]
cmp al, 0x4e
je 0x1800a0c71
cmp al, 0x59
je 0x1800a0d7b
cmp al, 0x6e
je 0x1800a0c71
cmp al, 0x79
je 0x1800a0d7b
lea rcx, str.com_yourkit_Constants.classPK
jmp 0x1800a0d69
lea rcx, str.Z3_get_smtlib_num_formulas
call fcn.1800a0e30
add ebx, 0x61
cmp ebx, 0x173
jb 0x1800a0d05
jmp 0x1800a0d00
mov eax, 1
jmp 0x1800a0c9f
Function at 0x1400154d0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140020690], rbx
je 0x14001551c
cmp rax, rbx
jne 0x14001550f
mov ebx, 1
mov esi, ebx
jmp 0x140015521
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400154f4
mov ebx, 1
mov eax, dword [0x140020698]
cmp eax, ebx
jne 0x140015537
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14001559c
mov eax, dword [0x140020698]
test eax, eax
jne 0x140015596
mov dword [0x140020698], ebx
lea r15, [0x140017850]
lea rdi, [0x140017838]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140015588
test eax, eax
jne 0x14001558c
cmp qword [rdi], 0
je 0x14001557d
mov rax, qword [rdi]
mov rcx, qword [vtable.H_MA8HI.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14001555e
test eax, eax
je 0x14001559c
mov eax, 0xff
jmp 0x140015678
mov dword [0x1400200a4], ebx
mov eax, dword [0x140020698]
cmp eax, ebx
jne 0x1400155c3
lea rdx, [0x140017830]
lea rcx, [0x140017820]
call sub.msvcrt.dll__initterm
mov dword [0x140020698], 2
test esi, esi
jne 0x1400155d0
xor eax, eax
xchg qword [0x140020690], rax
cmp qword [0x1400206a0], 0
je 0x140015604
lea rcx, [0x1400206a0]
call fcn.140015d50
test eax, eax
je 0x140015604
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400206a0]
mov r9, qword [vtable.H_MA8HI.0]
call r9
mov r8, qword [0x1400200b8]
mov rdx, qword [0x1400200b0]
mov ecx, dword [0x1400200a8]
call fcn.140001724
mov dword [0x1400200a0], eax
cmp dword [0x1400200c0], 0
jne 0x140015634
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400200a4], 0
jne 0x140015649
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400200a0]
jmp 0x140015678
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call 0x140151000
add rsp, 0x28
jmp 0x1400154d0

Function at 0x140015c3c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140015c88
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140015c80
cmp dword [rcx + 0x3c], edx
jl 0x140015c80
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140015c80
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140015c88
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400012d0
Capabilities:
Accept command line arguments
Create tcp socket
Initialize winsock library
Terminate process

Disassembly:
sub rsp, 0x1f8
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [0x140003010], rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [rsp + 0x28]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x28], 2
jne 0x14000138c
lea rdx, [rsp + 0x40]
mov cx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14000138c
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
je 0x14000138c
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax]
call fcn.140001980
movzx edx, ax
mov rcx, qword [rsp + 0x20]
call fcn.140001a20
movzx eax, al
test eax, eax
je 0x140001381
mov rcx, qword [rsp + 0x20]
call fcn.1400013c0
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1400013c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
cmp eax, 1
je 0x1400014b2
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
mov r8d, 0x18
mov edx, 8
mov rcx, qword [0x140003010]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400014ad
mov rax, qword [rsp + 0x38]
add rax, 8
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_accept]
mov rcx, qword [rsp + 0x38]
mov qword [rcx], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0xffffffffffffffff
je 0x140001499
mov edx, 0x2710
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140001af0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x38]
lea r8, [0x1400014c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x14000148c
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x140001499
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400014ad
mov r8, qword [rsp + 0x38]
xor edx, edx
mov rcx, qword [0x140003010]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400013c9
add rsp, 0x58
ret
Function at 0x1400018e0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
xor eax, eax
cmp eax, 1
je 0x140001973
xor r9d, r9d
mov r8d, dword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x14000194b
xor r9d, r9d
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jge 0x140001949
xor al, al
jmp 0x140001973
jmp 0x140001971
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x140001962
mov dword [rsp + 0x24], 1
jmp 0x14000196a
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
jmp 0x140001973
jmp 0x1400018f8
add rsp, 0x38
ret

Function at 0x140001af0
Capabilities:
Set socket configuration

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov r8d, 0x1006
mov edx, 0xffff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov r8d, 0x1005
mov edx, 0xffff
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x140002120
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 0x1384], 0xffffffff
lea r9, [rcx + 8]
mov dword [rcx + 4], edx
mov r8d, 1
nop word [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8
mov dword [r9 - 4], edx
cmp r8, 0x270
jb 0x140002140
mov dword [rcx], 0x270
mov rax, rcx
ret