joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c300
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140068080]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword gs:[0x58]
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14006e5b0], eax
jg 0x14001c3a5
cmp qword [0x140068db0], 0
jne 0x14001c376
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1400456b0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rdx, qword [rsp + 0x20]
lea rcx, [0x140068da0]
call fcn.14000b708
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
and qword [rbx + 0x10], 0
lea rdx, [0x140068da0]
and qword [rbx + 0x18], 0
mov rcx, rbx
call fcn.1400168e8
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001e0a0
add rsp, 0x30
pop rbx
ret
lea rcx, [0x14006e5b0]
call fcn.14001e95c
cmp dword [0x14006e5b0], 0xffffffff
jne 0x14001c339
lea rcx, [0x140044c00]
call fcn.14001e728
lea rcx, [0x14006e5b0]
call fcn.14001e8fc
jmp 0x14001c339

Function at 0x14002ec34
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002ea60
Function at 0x180061d20
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rcx
mov qword [rbp - 0x39], rcx
xor ebx, ebx
mov dword [rbp - 0x55], ebx
lea rcx, [rbp - 0x29]
call fcn.180061fe0
nop
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.180060540
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x180061da6
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180061da1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061e9b
call fcn.180132438
movdqa xmm0, xmmword [0x18020aed0]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov dword [rbp - 0x59], ebx
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 7
cmova rcx, qword [rbp - 9]
lea rdx, [rbp - 0x59]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r14d, eax
test eax, eax
je 0x180061ea1
mov qword [rsi], rbx
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rbx
mov edx, r14d
mov rcx, rsi
call fcn.1800616b0
mov rcx, qword [rsi]
lea rbx, [rcx + r14]
mov r8d, r14d
xor edx, edx
call fcn.1801f3510
mov qword [rsi + 8], rbx
mov dword [rbp - 0x55], 1
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 7
cmova rcx, qword [rbp - 9]
mov r9, qword [rsi]
mov r8d, r14d
mov edx, dword [rbp - 0x59]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x180061edf
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x180061e6e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180061e69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061e95
call fcn.180132438
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180132af0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.18017ecd8
nop
call fcn.18017ecd8
int3
lea rcx, [rbp + 0x17]
call fcn.180061f20
nop
lea rcx, str.Failed_to_GetFileVersionInfoSize._Error:_
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], 0x2b
mov r8, rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x51]
call fcn.18005ec70
lea rdx, [0x1802d7918]
lea rcx, [rbp - 0x51]
call fcn.18016f7e4
nop
lea rcx, [rbp + 0x17]
call fcn.180061f20
nop
lea rcx, str.Failed_to_GetFileVersionInfo._Error:_
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], 0x27
mov r8, rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x51]
call fcn.18005ec70
lea rdx, [0x1802d7918]
lea rcx, [rbp - 0x51]
call fcn.18016f7e4
int3
Function at 0x1800990e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x180099122
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x38
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1800992c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x230]
mov r14, qword [rcx + r8*8 + 0x1e8]
add rbx, rax
mov rax, qword [rcx + 0x410]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x1800993cc
lea rax, [0x180099170]
cmp qword [rcx + r8*8 + 0x210], rax
jne 0x1800993cc
cmp qword [rbx], 0
je 0x180099351
test rdi, rdi
je 0x1800993cc
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.1800af550
cmp eax, 0xffffffff
je 0x1800993cc
test al, 1
je 0x1800993cc
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1800993ab
mov eax, dword [rbp + 0x734]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [fcn.1801ade94]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x180099406
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1800993cc
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x180099445
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x180099415
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x180099445
mov dword [rsi], 0x1b
mov rax, 0xffffffffffffffff
jmp 0x180099448
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.1800a31d0
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.180098e50
mov dword [rbp + 0xde4], edi
mov dword [rsi], 0x37
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180132af0
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180099c40
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
mov rax, rdx
mov rbx, r8
mov rsi, rcx
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rdi, r9
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x180099cf3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.1800a31d0
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.180098e50
jmp 0x180099dbb
movzx ecx, word [rsp + 0x30]
mov edx, ecx
sub edx, 1
je 0x180099d90
sub edx, 1
je 0x180099d3a
cmp edx, 0x15
jne 0x180099d41
lea rdx, [rsp + 0x38]
mov r8, rbx
mov r9d, 0x2e
call fcn.1800b5320
test rax, rax
je 0x180099d41
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rdi], eax
jmp 0x180099dbb
lea rdx, [rsp + 0x34]
jmp 0x180099d12
mov byte [rbx], 0
mov dword [rdi], 0
call fcn.18017eea8
mov dword [rax], 0x273f
call fcn.18017eea8
mov ebx, dword [rax]
call fcn.18017eea8
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.1800a31d0
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.180098e50
jmp 0x180099dbb
cmp dword [rsp + 0x20], 2
jle 0x180099db2
lea r9, [rsp + 0x32]
mov edx, 0x2e
lea r8, [0x18020ffc0]
mov rcx, rbx
call fcn.18009c590
jmp 0x180099db5
mov byte [rbx], 0
mov dword [rdi], 0
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.180132af0
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800acd40
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rdi
push r13
push r14
sub rsp, 0x68
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov r13, rcx
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1800acd67
mov qword [rsp + 0xa0], rbp
xor r14d, r14d
cmp byte [rdx], 0x5b
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r15
jne 0x1800acee3
cmp rbx, 4
jb 0x1800acef7
inc rdi
sub rbx, 2
cmp byte [rdi + rbx], 0x5d
jne 0x1800acef7
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rdi
call fcn.1801c4510
cmp rbx, rax
je 0x1800ace85
cmp byte [rdi + rax], 0x25
lea r15, [rdi + rax]
mov rbx, rax
jne 0x1800acef7
mov r8d, 2
lea rdx, [0x1802153cc]
lea rcx, [r15 + 1]
mov ebp, r14d
lea rsi, [r15 + 1]
call fcn.1801b1110
test eax, eax
jne 0x1800ace0b
movzx eax, byte [r15 + 3]
lea rcx, [r15 + 3]
test al, al
je 0x1800ace0b
cmp al, 0x5d
cmovne rsi, rcx
movzx edx, byte [rsi]
test dl, dl
je 0x1800acef7
mov rax, r14
movzx ecx, dl
nop dword [rax]
cmp dl, 0x5d
je 0x1800ace41
cmp rax, 0xf
jge 0x1800ace41
inc rsi
mov byte [rsp + rax + 0x20], cl
inc ebp
inc rax
movzx ecx, byte [rsi]
movzx edx, cl
test cl, cl
jne 0x1800ace20
test ebp, ebp
je 0x1800acef7
cmp byte [rsi], 0x5d
jne 0x1800acef7
movsxd rax, ebp
cmp rax, 0x10
jae 0x1800acefe
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], r14b
call qword [case.0x18008aad9.0]
mov qword [r13 + 0x28], rax
test rax, rax
jne 0x1800ace7f
mov eax, 7
jmp 0x1800aceb4
mov word [r15], 0x5d
lea r8, [rsp + 0x30]
mov byte [rdi + rbx], r14b
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1800acef7
mov byte [rdi + rbx], 0x5d
cmp byte [rdi], r14b
mov eax, select
cmove r14d, eax
mov eax, r14d
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180132af0
add rsp, 0x68
pop r14
pop r13
pop rdi
pop rbx
ret
lea rdx, [0x1802153d0]
mov rcx, rdi
call fcn.1801c3c10
cmp rbx, rax
je 0x1800acea5
mov eax, 3
jmp 0x1800aceb4
call fcn.18013302c
int3
Function at 0x1800b7800
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call case.0x18008aad9.0
mov r13, rax
test rax, rax
jne 0x1800b7880
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1800a3300
mov r9, rax
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.180098e50
xor ecx, ecx
mov ebx, 0x4d
call qword [fcn.1801ab9bc]
jmp 0x1800b7a38
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, r13
mov qword [rsp + 0x170], r14
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x1800b78f6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1800a3300
mov r9, rax
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.180098e50
xor ecx, ecx
mov ebx, 0x4d
jmp 0x1800b7a22
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1800b793f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1800a3300
mov r9, rax
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.180098e50
mov ebx, 0x4d
jmp 0x1800b7a16
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x1800b7974
mov r8d, 0x100000
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.180098e50
mov ebx, 0x4d
jmp 0x1800b7a0e
lea rcx, [rdi + 1]
call qword [fcn.1801ade94]
mov rbp, rax
test rax, rax
jne 0x1800b7990
mov ebx, 0x1b
jmp 0x1800b7a0e
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x1800b79e8
nop dword [rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800b7a5a
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x1800b79df
mov edi, esi
jmp 0x1800b79e1
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x1800b79a0
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.1800b7570
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [fcn.1801ab9bc]
mov rcx, r13
call fcn.1801ab9bc
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180132af0
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.1800a3300
mov r9, rax
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.180098e50
mov ebx, 0x4d
jmp 0x1800b7a06
Function at 0x1800c3900
Capabilities:
Access peb ldr_data

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword gs:[0x60]
xor r14d, r14d
mov rbp, rcx
mov rdx, qword [rax + 0x18]
mov rbx, qword [rdx + 0x10]
cmp qword [rcx + 0x28], r14
jne 0x1800c393e
mov rax, qword [rbx + 0x30]
jmp 0x1800c3aa9
cmp qword [rcx + 0x30], 7
lea rdx, [rcx + 0x18]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
jbe 0x1800c395a
mov rdx, qword [rcx + 0x18]
mov r8, qword [rcx + 0x28]
xorps xmm0, xmm0
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x38], r14
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x40], r14
call fcn.180003870
lea rcx, [rsp + 0x28]
call fcn.18002a830
mov rdx, qword [rsp + 0x40]
movzx esi, al
cmp rdx, 7
jbe 0x1800c39c9
mov rcx, qword [rsp + 0x28]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800c39c4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800c3ac5
call fcn.180132438
cmp qword [rbx + 0x30], r14
je 0x1800c3a28
xor rsi, 1
add rsi, rsi
nop word [rax + rax]
movups xmm0, xmmword [rbx + rsi*8 + 0x48]
lea rdx, [rbp + 0x18]
movd eax, xmm0
movzx r8d, ax
shr r8, 1
cmp qword [rbp + 0x28], r8
cmovb r8, qword [rbp + 0x28]
cmp qword [rbp + 0x30], 7
jbe 0x1800c3a08
mov rdx, qword [rbp + 0x18]
psrldq xmm0, 8
movq rcx, xmm0
call fcn.1801c64dc
test eax, eax
je 0x1800c3abf
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], r14
jne 0x1800c39e0
xorps xmm0, xmm0
mov qword [rsp + 0x38], r14
mov ecx, 0x30
mov qword [rsp + 0x40], r14
movups xmmword [rsp + 0x28], xmm0
call fcn.1801323fc
movups xmm0, xmmword [str.EAT__Failed_to_automatically_find_module]
mov qword [rsp + 0x28], rax
mov edx, 2
mov qword [rsp + 0x38], 0x29
mov qword [rsp + 0x40], 0x2f
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x180218ca0]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x180218cb0]
movsd qword [rax + 0x20], xmm0
movzx ecx, byte [0x180218cb8]
mov byte [rax + 0x28], cl
lea rcx, [rsp + 0x28]
mov byte [rax + 0x29], r14b
call fcn.1800c0ef0
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180132af0
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
mov rax, qword [rbx + 0x30]
jmp 0x1800c3a9c
call fcn.18017ecd8
int3
Function at 0x1800d7170
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx ebp, dl
mov rsi, rcx
xor ebx, ebx
lea rdx, [rcx + 0x60]
lea rcx, [rsp + 0x28]
call fcn.18001c230
nop
mov r14d, ebx
mov rdi, qword [rsi + 0x38]
sub rdi, qword [rsi + 0x30]
je 0x1800d7222
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x1800d73b9
cmp rdi, 0x1000
jb 0x1800d7200
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1800d73bf
call fcn.1801323fc
test rax, rax
je 0x1800d73b3
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800d720b
mov rcx, rdi
call fcn.1801323fc
mov rbx, rax
lea r14, [rbx + rdi]
mov r8, qword [rsi + 0x38]
mov rdx, qword [rsi + 0x30]
sub r8, rdx
mov rcx, rbx
call fcn.1801f2e70
mov rax, qword [rsi + 0x38]
sub rax, qword [rsi + 0x30]
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x28]
cmp rax, 1
jne 0x1800d723f
cmp byte [rbx], 0xcc
jmp 0x1800d724e
cmp rax, 2
jb 0x1800d7254
cmp byte [rbx], 0xf3
jne 0x1800d7254
cmp byte [rbx + 1], 0xc3
je 0x1800d73ab
lea rcx, [rsp + 0x28]
cmp r15, 0xf
cmova rcx, rdi
mov rsi, qword [rsp + 0x38]
cmp rsi, 3
jne 0x1800d7288
mov r8, rsi
lea rdx, [0x180219054]
call fcn.1801f2d70
test eax, eax
jne 0x1800d7288
test bpl, bpl
je 0x1800d73ab
lea rcx, [rsp + 0x28]
cmp r15, 0xf
cmova rcx, rdi
cmp rsi, 3
jne 0x1800d72b2
mov r8, rsi
lea rdx, [0x180218b14]
call fcn.1801f2d70
test eax, eax
je 0x1800d73ab
lea rbp, [rsp + 0x28]
cmp r15, 0xf
cmova rbp, rdi
cmp rsi, 4
jb 0x1800d730c
lea r8, [rsi - 3]
add r8, rbp
sub r8, rbp
mov edx, 0x69
mov rcx, rbp
call fcn.1801f2cd0
test rax, rax
je 0x1800d730c
cmp dword [rax], 0x74657269
je 0x1800d73a2
inc rax
lea r8, [rsi - 3]
add r8, rbp
sub r8, rax
mov edx, 0x69
mov rcx, rax
call fcn.1801f2cd0
test rax, rax
jne 0x1800d72e1
xor sil, sil
test rbx, rbx
je 0x1800d7344
sub r14, rbx
cmp r14, 0x1000
jb 0x1800d7338
add r14, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1800d73b3
mov rbx, rcx
mov rdx, r14
mov rcx, rbx
call fcn.180132438
nop
cmp r15, 0xf
jbe 0x1800d7377
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800d736f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d73c5
mov rcx, rdi
call fcn.180132438
movzx eax, sil
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180132af0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
cmp rax, rbp
jne 0x1800d730c
mov sil, 1
jmp 0x1800d730f
call fcn.18017ecd8
int3
call fcn.180022eb0
int3
call fcn.1800229a0
nop
call fcn.18017ecd8
int3
Function at 0x1800f4840
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov eax, dword [0x1802e377c]
nop
test eax, eax
jne 0x1800f48a7
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
dec eax
mov ecx, eax
shr ecx, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or eax, ecx
mov ecx, eax
shr ecx, 4
or ecx, eax
mov edx, ecx
shr edx, 8
or edx, ecx
mov eax, edx
shr eax, 0x10
or eax, edx
inc eax
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x64], eax
mov rax, qword [rsp + 0x60]
mov qword [0x1802e3780], rax
mov eax, 1
xchg dword [0x1802e377c], eax
mov rax, qword [0x1802e3780]
add rsp, 0x58
ret

Function at 0x1800f4a90
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, r8b
mov rax, rdx
shr rax, 6
mov r10, rcx
lea rax, [rcx + rax*8]
mov r8, 0xffffffffffffffff
movzx ecx, dl
and cl, 0x3f
lea rdx, [r9 - 1]
xor rdx, qword [rax]
shl r8, cl
and r8, rdx
jne 0x1800f4acd
nop
add rax, 8
lea r8, [r9 - 1]
xor r8, qword [rax]
je 0x1800f4ac0
sub rax, r10
sar rax, 3
bsf rcx, r8
shl rax, 6
add rax, rcx
ret
Function at 0x180111260
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
push r12
sub rsp, 0x178
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r12d, r12d
mov rdi, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x18011128d
mov rcx, qword [rcx]
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], rbp
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x168], r14
mov qword [rsp + 0x160], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180111435
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x1801114b3
mov rbp, r12
lea r15, [0x180288c74]
nop dword [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r15 + rbx], r12b
jne 0x1801112e7
cmp qword [rdi + 0x18], 0xf
mov r14, rdi
jbe 0x1801112fd
mov r14, qword [rdi]
test rbx, rbx
je 0x18011136d
cmp rbp, rsi
jae 0x18011136d
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.1801f3510
lea rdx, [rbx + r15]
mov rcx, r15
cmp r15, rdx
je 0x180111340
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rsp + rax + 0x50], 1
cmp rcx, rdx
jne 0x180111330
lea rcx, [rsi + r14]
lea rbx, [r14 + rbp]
cmp rbx, rcx
jae 0x18011136d
nop dword [rax]
movzx eax, byte [rbx]
cmp byte [rsp + rax + 0x50], r12b
jne 0x180111364
inc rbx
cmp rbx, rcx
jb 0x180111350
jmp 0x18011136d
sub rbx, r14
cmp rbx, 0xffffffffffffffff
jne 0x180111371
mov rbx, qword [rdi + 0x10]
cmp qword [rdi + 0x10], rbx
mov r8, rbx
xorps xmm0, xmm0
mov qword [rsp + 0x38], r12
cmovb r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x40], r12
jbe 0x18011139c
mov rdx, qword [rdi]
lea rcx, [rsp + 0x28]
call fcn.180003760
cmp qword [rsp + 0x38], r12
je 0x1801113e7
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1801113e7
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call fcn.1801cbda0
test eax, eax
jne 0x18011147a
mov rdx, qword [rsp + 0x40]
lea rbp, [rbx + 1]
cmp rdx, 0xf
jbe 0x180111428
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180111423
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801114b7
call fcn.180132438
mov rsi, qword [rdi + 0x10]
cmp rbp, rsi
jb 0x1801112e0
mov al, 1
mov r15, qword [rsp + 0x160]
mov r14, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x1a0]
mov rbx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180132af0
add rsp, 0x178
pop r12
pop rdi
ret
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1801114b3
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801114ae
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1801114b7
call fcn.180132438
xor al, al
jmp 0x180111437
call fcn.18017ecd8
int3