joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b110
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14006b010]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rcx, vtable.CVolObject.0
mov qword [rdi], rcx
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
lea rax, vtable.CWString.0
mov qword [rdi], rax
lea rbx, [rdi + 0x20]
mov qword [rsp + 0x38], rbx
mov qword [rbx], rcx
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
lea rbp, vtable.CVolMem.0
mov qword [rbx], rbp
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x30], 0x40
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x50], 0xfe
mov dword [rsp + 0x20], 1
mov word [rsp + 0x40], si
xor r9d, r9d
lea r8d, [rsi + 0x1a]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14000b240
mov rax, qword [rdi + 0x18]
test rax, rax
jne 0x14000b1e8
cmp qword [rdi + 0x48], rax
je 0x14000b1f2
cmp qword [rbx + 0x28], rax
je 0x14000b1f2
mov rax, qword [rbx + 0x18]
lea rcx, [rsp + 0x40]
cmp rcx, rax
je 0x14000b238
mov qword [rdi + 0x18], rsi
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14000b217
mov rax, qword [rbx]
mov r8, qword [rax + 0x18]
cmp rax, rbp
jne 0x14000b26c
lea rcx, [0x14006de88]
call fcn.140013fe0
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x20], rsi
cmp word [rsp + 0x40], 0
je 0x14000b238
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140013830
mov rcx, rdi
call fcn.14000b380
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140034140
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rcx, rbx
call r8
jmp 0x14000b217
Function at 0x140012800
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rbp - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rbx, rcx
test rcx, rcx
je 0x1400129c5
cmp word [rcx], 0
je 0x1400129c5
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp - 0x50]
call fcn.1400360e0
mov dword [rbp - 0x50], 0x68
or dword [rbp - 0x14], 1
xor edi, edi
mov word [rbp - 0x10], di
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea r14, vtable.CVolObject.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea rsi, vtable.CVolMem.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
cmp word [rbx], di
jne 0x1400128df
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
sub rax, rbx
cmp rax, 2
jl 0x1400128cb
mov rax, qword [rsp + 0x68]
mov word [rax + rbx], di
add qword [rsp + 0x78], 2
jmp 0x140012911
lea rdx, [rbx + 2]
lea rcx, [rsp + 0x50]
call fcn.140013570
mov word [rax + rbx], di
jmp 0x140012911
mov r8, 0xffffffffffffffff
nop word [rax + rax]
lea r8, [r8 + 1]
cmp word [rbx + r8*2], 0
jne 0x1400128f0
lea r8, [r8*2 + 2]
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400138d0
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], 0
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14001295b
mov rbx, rdi
jmp 0x140012983
mov edx, 0x1f4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], rsi
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x1400129ac
mov rax, qword [rsp + 0x50]
mov r8, qword [rax + 0x18]
cmp rax, rsi
jne 0x1400129e4
lea rcx, [0x14006de88]
call fcn.140013fe0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], r14
mov rax, rbx
jmp 0x1400129c7
xor eax, eax
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rcx, [rsp + 0x50]
call r8
jmp 0x1400129ac
Function at 0x1400276a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
movdqa xmm4, xmmword [0x14005a800]
xor ebx, ebx
movdqa xmm5, xmmword [0x14005a7d0]
xor edi, edi
movaps xmmword [rsp], xmm6
mov r10, r8
movdqa xmm6, xmmword [0x14005a7a0]
mov r9, rdx
xorps xmm3, xmm3
cmp r8, 4
jb 0x140027767
nop dword [rax]
movdqu xmm1, xmmword [r9 + rbx*4]
add rbx, 4
mov edx, 8
movdqa xmm0, xmm1
movdqa xmm2, xmm1
pand xmm0, xmm5
pand xmm1, xmm6
pcmpeqd xmm0, xmm3
pcmpeqd xmm1, xmm3
pxor xmm1, xmm0
pand xmm2, xmm4
pmovmskb eax, xmm1
pcmpeqd xmm2, xmm3
pxor xmm0, xmm2
movzx ecx, ax
popcnt r8, rcx
pmovmskb eax, xmm0
shr r8, 2
movzx ecx, ax
popcnt rax, rcx
shr rax, 2
sub rdx, rax
pmovmskb eax, xmm2
add rdx, rdx
movzx ecx, ax
popcnt rax, rcx
shr rax, 2
lea rax, [rax + rax*2]
sub rdx, rax
lea rax, [rbx + 4]
sub rdx, r8
add rdi, rdx
cmp rax, r10
jbe 0x1400276e0
lea r11, [r9 + rbx*4]
xor r9d, r9d
mov eax, r9d
sub r10, rbx
je 0x1400277b8
nop word [rax + rax]
mov edx, dword [r11 + rax*4]
xor r8d, r8d
cmp edx, 0x7ff
seta r8b
xor ecx, ecx
cmp edx, 0x7f
seta cl
add r8, rcx
xor ecx, ecx
cmp edx, 0xffff
seta cl
inc rax
inc rcx
add r9, rcx
add r9, r8
cmp rax, r10
jb 0x140027780
mov rbx, qword [rsp + 0x20]
lea rax, [r9 + rdi]
movaps xmm6, xmmword [rsp]
add rsp, 0x10
pop rdi
ret

Function at 0x1400386cc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14003855f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003855f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003855f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003855f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003855f
cmp dword [rcx + 0x84], 0xe
jbe 0x14003855f
cmp dword [rcx + 0xf8], 0
je 0x14003855f
mov ecx, ebx
call fcn.140038600
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400383f0
cmp dword [rbp + 0x20], 0
je 0x1400385ac
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400385b4
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400384f8
Function at 0x180002270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rsi
push rdi
sub rsp, 0x78
mov byte [rsp + 2], 0x58
lea rax, [rsp + 0x40]
lea rcx, str.UdxbtIDTYRCPVlpmiWkZvjgsnFNcSMoKuAwhBLQeGraOyXJ
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x10], 0
mov eax, 7
mov word [rsp + 4], ax
mov eax, 6
mov word [rsp + 8], ax
mov qword [rsp + 0x18], 8
mov byte [rsp + 1], 0
jmp 0x1800022da
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x180002393
mov byte [rsp], 0
jmp 0x1800022f7
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x18000238e
movzx eax, byte [rsp + 1]
mov rcx, qword [rsp + 0x98]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 0x90]
shl edx, 2
movzx edi, byte [rsp + 1]
shl edi, 2
lea edx, [rdi + rdx*4]
movzx edi, byte [rsp]
add edx, edi
movsxd rdx, edx
mov rdi, qword [rsp + 0xa0]
movzx edx, byte [rdi + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rsp]
movzx edx, byte [rsp + 1]
mov rdi, qword [rsp + 0x98]
lea rdx, [rdi + rdx*4]
mov byte [rdx + rcx], al
mov byte [rsp + 3], 0x72
lea rax, [rsp + 0x28]
lea rcx, str.RqGUNFBIdXWfrLtksACn
mov rdi, rax
mov rsi, rcx
mov ecx, 0x15
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x20], 3
jmp 0x1800022ee
jmp 0x1800022cf
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x1800023a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov eax, 9
mov word [rsp + 4], ax
mov eax, 6
mov word [rsp + 8], ax
mov byte [rsp + 1], 0
jmp 0x1800023d1
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x18000248a
mov byte [rsp], 0
jmp 0x1800023ee
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x180002485
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, [0x180013e30]
movzx edx, byte [rsp]
mov r8, qword [rsp + 0x80]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
mov eax, 4
mov word [rsp + 0xc], ax
mov qword [rsp + 0x18], 0
lea rax, [rsp + 0x28]
lea rcx, str.gHfxGkCDBNRMWjVasZuLXoSEhrvQKInztUlJFTOpec
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2b
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 2], 0x7a
mov dword [rsp + 0x10], 3
mov qword [rsp + 0x20], 7
mov byte [rsp + 3], 1
jmp 0x1800023e5
jmp 0x1800023c6
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x1800030b0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x180018040]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov eax, 8
mov word [rsp + 0x58], ax
mov eax, 7
mov word [rsp + 0x5c], ax
lea rax, [rsp + 0x118]
lea rcx, str.OWBKTvEYtZSsGdfigIcwCbrjANkJPHVxFMDlQXLoyqznea
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2f
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x68], 2
mov eax, 7
mov word [rsp + 0x34], ax
mov byte [rsp + 0x28], 1
lea rax, [rsp + 0xb8]
lea rcx, str.DcZECielGmOTAU
mov rdi, rax
mov rsi, rcx
mov ecx, 0xf
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x70], 0
mov eax, 3
mov word [rsp + 0x38], ax
mov byte [rsp + 0x29], 0x54
mov qword [rsp + 0x78], 0
mov eax, 3
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x20], 0x10
jmp 0x18000318f
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x190]
cmp dword [rsp + 0x24], eax
jae 0x1800033b3
lea rax, [rsp + 0x148]
mov rcx, qword [rsp + 0x180]
mov rdi, rax
lea rsi, [rcx + 0xb0]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x180]
mov rdx, rax
lea rcx, [rsp + 0x148]
call fcn.180002f30
mov byte [rsp + 0x2a], 0x70
lea rax, [rsp + 0xd8]
lea rcx, str.JUcjExzmaNLQRVdhKpOPCH
mov rdi, rax
mov rsi, rcx
mov ecx, 0x17
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 1
mov byte [rsp + 0x2b], 1
xor eax, eax
mov word [rsp + 0x40], ax
mov dword [rsp + 0x20], 0xf
jmp 0x18000323a
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jl 0x18000332b
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x180]
movzx eax, byte [rcx + rax + 0xb0]
cmp eax, 0xff
jne 0x1800032d1
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x180]
mov byte [rcx + rax + 0xb0], 0
mov byte [rsp + 0x2c], 1
lea rax, [rsp + 0xc8]
lea rcx, str.zkIBbmJvAcCnaYX
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 0x2d], 0x54
jmp 0x180003230
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x180]
movzx eax, byte [rcx + rax + 0xb0]
inc eax
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x180]
mov byte [rdx + rcx + 0xb0], al
jmp 0x18000332b
mov dword [rsp + 0x20], 0
mov qword [rsp + 0xa8], 0
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x188]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 0x20]
movzx ecx, byte [rsp + rcx + 0x148]
xor eax, ecx
mov ecx, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x188]
mov byte [rdx + rcx], al
mov qword [rsp + 0xb0], 0
mov eax, 5
mov word [rsp + 0x50], ax
mov byte [rsp + 0x32], 0x41
mov eax, 6
mov word [rsp + 0x54], ax
lea rax, [rsp + 0xf0]
lea rcx, str.YlZyQUdoFzSwtCMVHcLOWfmnvIkbgJBuqxErKeP
mov rdi, rax
mov rsi, rcx
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
jmp 0x18000317b
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.18000f440
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x180003900
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x180018040]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180003951
xor eax, eax
jmp 0x180003aaf
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4550
je 0x180003984
mov rax, qword [rsp + 0x30]
jmp 0x180003aaf
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x18]
mov ecx, 0xf0
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 0
cmp dword [rsp + rax + 0xd0], 0
jne 0x1800039b9
mov rax, qword [rsp + 0x30]
jmp 0x180003aaf
mov eax, 8
imul rax, rax, 0
mov eax, dword [rsp + rax + 0xd0]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x180003a41
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x180003aaa
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x188]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x180003aa8
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x180003aaa
jmp 0x180003a37
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18000f440
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x180007630
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x60], 8
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800076a2
xor eax, eax
jmp 0x180007892
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x100]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x10]
cmp dword [rax], 0x4550
je 0x18000770d
xor eax, eax
jmp 0x180007892
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x88], 5
mov dword [rsp + 0x58], 9
mov dword [rsp], 0
jmp 0x18000774a
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 6]
cmp dword [rsp], eax
jge 0x18000783e
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x110]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x18000778d
inc rcx
test dl, dl
jne 0x18000777a
xor eax, eax
jmp 0x180007792
sbb eax, eax
or eax, 1
test eax, eax
jne 0x180007839
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x38]
mov eax, dword [rdx + rax + 8]
mov dword [rcx], eax
mov byte [rsp + 8], 1
mov eax, 6
mov word [rsp + 0x24], ax
mov byte [rsp + 9], 0x74
mov qword [rsp + 0x90], 1
mov qword [rsp + 0x98], 0
mov eax, 8
mov word [rsp + 0x28], ax
mov dword [rsp + 0x48], 3
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x100]
add rcx, rax
mov rax, rcx
jmp 0x180007892
jmp 0x180007742
xor eax, eax
jmp 0x180007892
add rsp, 0xe8
pop rdi
pop rsi
ret
Function at 0x180008f50
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x78
xor eax, eax
mov word [rsp], ax
mov qword [rsp + 8], 0
lea rax, [rsp + 0x48]
lea rcx, str.RCvumYawiFkQf
mov rdi, rax
mov rsi, rcx
mov ecx, 0xe
rep movsb byte [rdi], byte [rsi]
mov byte [rsp + 4], 1
mov dword [rsp + 0x24], 4
mov byte [rsp + 5], 0x41
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x30], 3
mov byte [rsp + 6], 0x66
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x98]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x98]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x10], rax
mov byte [rsp + 7], 0x4e
mov eax, 2
mov word [rsp + 0x18], ax
mov dword [rsp + 0x28], 7
lea rax, [rsp + 0x58]
lea rcx, str.PFRfiqVuMkYgoWsLKhAJcTv
mov rdi, rax
mov rsi, rcx
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x10]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x10]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
mov eax, 6
mov word [rsp + 0x1c], ax
mov eax, 3
mov word [rsp + 0x20], ax
mov eax, 0x28
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax + 0x14]
cmp dword [rsp + 0x90], eax
jae 0x180009064
mov eax, dword [rsp + 0x90]
jmp 0x180009103
xor eax, eax
mov word [rsp], ax
jmp 0x180009077
movzx eax, word [rsp]
inc ax
mov word [rsp], ax
movzx eax, word [rsp]
mov rcx, qword [rsp + 0x10]
movzx ecx, word [rcx + 6]
cmp eax, ecx
jge 0x180009101
movzx eax, word [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax + 0xc]
cmp dword [rsp + 0x90], eax
jb 0x1800090fc
movzx eax, word [rsp]
imul rax, rax, 0x28
movzx ecx, word [rsp]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 8]
mov eax, dword [rdx + rax + 0xc]
mov rdx, qword [rsp + 8]
add eax, dword [rdx + rcx + 0x10]
cmp dword [rsp + 0x90], eax
jae 0x1800090fc
movzx eax, word [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax + 0xc]
mov ecx, dword [rsp + 0x90]
sub ecx, eax
mov eax, ecx
movzx ecx, word [rsp]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 8]
add eax, dword [rdx + rcx + 0x14]
jmp 0x180009103
jmp 0x18000906c
xor eax, eax
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x18000a280
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x18000a2b9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x18000a3a7
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x18000a34f
cmp qword [rsp + 0x20], 0
jle 0x18000a34f
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x18000a2f9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.18000c8d0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x18000a397
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x18000a397
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret