joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005aba4
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18005abbb
cmp r8b, 0x90
je 0x18005abbb
cmp r8b, 0xcc
jne 0x18005abdd
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18005abd9
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x18005abdd
add edx, r10d
cmp edx, r9d
jb 0x18005abc9
mov eax, r10d
ret
xor eax, eax
ret

Function at 0x18005c570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
cmp byte [0x1800e6437], 0
mov rdi, rdx
movups xmm0, xmmword [str.K_Y]
mov rbx, rcx
movups xmmword [rbp - 0x19], xmm0
movsd xmm0, qword [0x1800e6430]
movsd qword [rbp - 9], xmm0
je 0x18005c5dc
xor r8d, r8d
lea r9, [rbp - 0x19]
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9], al
inc r9
cmp r8d, 0x18
jl 0x18005c5b5
lea rcx, [rbp - 0x19]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movaps xmm0, xmmword [0x1800e6440]
lea r9, [rbp + 7]
movaps xmm1, xmmword [0x1800e6450]
mov r10, rax
movzx eax, word [0x1800e6488]
xor r8d, r8d
movaps xmmword [rbp + 7], xmm0
movaps xmm0, xmmword [0x1800e6460]
movaps xmmword [rbp + 0x27], xmm0
movsd xmm0, qword [0x1800e6480]
movaps xmmword [rbp + 0x17], xmm1
movaps xmm1, xmmword [0x1800e6470]
movsd qword [rbp + 0x47], xmm0
movaps xmmword [rbp + 0x37], xmm1
mov word [rbp + 0x4f], ax
mov eax, 0x5397829d
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
mov al, r8b
inc r8d
sub al, cl
add al, 0x39
xor byte [r9], al
inc r9
cmp r8d, 0x4a
jl 0x18005c634
lea rdx, [rbp + 7]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
call rax
test rax, rax
je 0x18005c677
mov rcx, rbx
call rax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180075b14
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180169b40]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180075b83
cmp byte [rcx + 0x71], 0
je 0x180075b83
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x180075bd8
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180075b9d
sub eax, 1
je 0x180075ba1
cmp eax, 2
jne 0x180075bd8
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800d85d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180075bcf
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180075bd8
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180075b85
xor al, al
jmp 0x180075b85
Function at 0x1800770bc
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
cmp byte [0x18016bb41], bpl
je 0x18007729b
mov rax, qword [0x18016bb88]
test rax, rax
jne 0x180077188
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18007716d
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x18007716d
mov esi, dword [r9 + 0x20]
dec ecx
mov ebx, 0x811c9dc5
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x180077169
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x180077148
cmp ebx, 0x95466b05
je 0x18007727e
test ecx, ecx
jne 0x18007712a
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x18007717e
cmp qword [rax + 0x30], rbp
jne 0x180077106
mov rax, rbp
mov qword [0x18016bb88], rax
mov ecx, dword [0x18016bb58]
call rax
test ax, ax
je 0x18007729b
mov rax, qword [0x18016a9c8]
mov rcx, qword [rax]
test rcx, rcx
je 0x18007729b
mov r9, qword [rcx + 8]
test r9, r9
je 0x18007729b
mov rax, qword [0x18016a9d0]
mov rcx, qword [rax]
test rcx, rcx
je 0x18007729b
mov r8, qword [rcx + 0x18]
test r8, r8
je 0x18007729b
movss xmm2, dword [0x1800e0bd0]
mov r10d, ebp
mov r11, rbp
movsxd rax, r10d
cmp rax, qword [r8 + 0x108]
jae 0x18007729b
mov rcx, qword [r8 + 0x100]
test rcx, rcx
je 0x180077272
mov rcx, qword [r11 + rcx]
test rcx, rcx
je 0x180077272
cmp rcx, r9
je 0x180077272
mov eax, dword [0x18016a9f4]
mov edx, dword [rax + rcx]
test edx, edx
je 0x180077272
and edx, 0x1fc000
cmp edx, 0x8000
je 0x180077272
movsd xmm0, qword [r9 + 0x90]
mov eax, dword [r9 + 0x98]
movsd qword [rsp + 0x20], xmm0
movss xmm0, dword [rsp + 0x20]
movss dword [rcx + 0x90], xmm0
movss xmm1, dword [rsp + 0x24]
addss xmm1, xmm2
movss dword [rcx + 0x94], xmm1
mov dword [rcx + 0x98], eax
mov dword [rcx + 0x280], 0x3dcccccd
inc r10d
add r11, 0x10
jmp 0x1800771e7
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180077181
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180077678
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180169b40]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov r9d, 0x20006
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Softwareproapp
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800776d3
mov rcx, qword [rsp + 0x30]
lea rdx, str.MyString
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800d85d0
add rsp, 0x48
ret
Function at 0x18007c7f8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x180169b40]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x38]
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x40], 0x100
mov r9d, 0x20019
lea rdx, str.Softwareproapp
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r8d, r8d
test eax, eax
je 0x18007c86c
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], r8
and qword [rdi + 0x18], r8
lea rdx, [0x18015433b]
jmp 0x18007c8d3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, str.MyString
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
and qword [rdi + 0x18], 0
test ebx, ebx
je 0x18007c8bb
xor r8d, r8d
jmp 0x18007c863
lea rax, [rsp + 0x50]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18007c8c4
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.180047798
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800d85d0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x18007e034
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180169b40]
xor rax, rsp
mov qword [rbp - 8], rax
or esi, 0xffffffff
mov r14d, edx
mov rdi, rcx
cmp edx, esi
jne 0x18007e06e
xor eax, eax
jmp 0x18007e18d
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x18007e0a7
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x18007e0a7
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], r14b
mov eax, r14d
jmp 0x18007e18d
cmp qword [rdi + 0x80], 0
je 0x18007e18b
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x18007e0e1
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x18007e102
movsx ecx, r14b
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, esi
jmp 0x18007e187
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], r14b
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18007e150
sub eax, 1
je 0x18007e150
cmp eax, 2
jne 0x18007e18b
movsx ecx, byte [rbp - 0x30]
jmp 0x18007e0ee
mov rbx, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub rbx, rax
je 0x18007e17b
mov r9, qword [rdi + 0x80]
lea rcx, [rbp - 0x28]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x18007e18b
lea rax, [rbp - 0x30]
mov byte [rdi + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne esi, r14d
mov eax, esi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800d85d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180080994
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x180169b40]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
and qword [rbp + 0x3f], 0
and qword [rbp + 0x47], 0
lea rdx, [0x18016a8c0]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1800809d0
lea rcx, [rbp + 0x2f]
call fcn.180047798
nop
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x3f]
sub rax, rcx
cmp rax, 0xb
jb 0x180080b91
lea rax, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0xf
cmova rax, qword [rbp + 0x2f]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], ntohl
lea r9, str.C:PerfLog_
lea r8, [rbp + 0x2f]
mov dl, byte [rbp - 0x19]
lea rcx, [rbp - 0x11]
call fcn.1800083f0
nop
mov r8d, 5
lea rdx, str..json
lea rcx, [rbp - 0x11]
call fcn.1800056a0
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f], xmm1
and qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov esi, 0x1000
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x180080abb
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, rsi
jb 0x180080ab6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180080ab6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d8028
movdqa xmm0, xmmword [0x1800e6090]
movdqu xmmword [rbp - 1], xmm0
mov byte [rbp - 0x11], 0
lea rcx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0xf
cmova rcx, qword [rbp + 0xf]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
jne 0x180080ae9
call fcn.180077678
call fcn.18007ff90
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x180080b29
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, rsi
jb 0x180080b24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180080b24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d8028
movdqa xmm0, xmmword [0x1800e6090]
movdqu xmmword [rbp + 0x1f], xmm0
mov byte [rbp + 0xf], 0
mov rdx, qword [rbp + 0x47]
cmp rdx, 0xf
jbe 0x180080b74
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, rsi
jb 0x180080b6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180080b6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800d8028
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1800d85d0
mov rsi, qword [rsp + 0xc0]
add rsp, 0xb0
pop rbp
ret
call fcn.180001810
nop
int3
Function at 0x180083908
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
mov rax, qword [0x180169b40]
xor rax, rsp
mov qword [rsp + 0x58], rax
and qword [r11 - 0x28], 0
lea rax, [r11 - 0x18]
mov qword [r11 - 0x30], rax
lea rdx, str.Softwareproapp
and qword [r11 - 0x38], 0
mov rbx, rcx
mov dword [rsp + 0x28], 0x20006
xor r9d, r9d
and dword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x18008399e
mov eax, dword [rbx + 0x10]
mov r9d, 1
add eax, r9d
cmp qword [rbx + 0x18], 0xf
jbe 0x180083975
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x50]
lea rdx, str.MyString
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800d85d0
add rsp, 0x60
pop rbx
ret
Function at 0x1800869b4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x1800869d4
xor eax, eax
jmp 0x180086abb
cmp qword [rcx + 0x68], 0
je 0x1800869e6
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x180086abb
mov rdi, rsi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x180086a26
cmp rax, rsi
mov rbx, rsi
mov rcx, rbp
cmovb rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rbx
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rbp
add r14, rbx
sub rdi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
je 0x180086ab5
mov rcx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rbp + 0x70]
cmp rax, rcx
jne 0x180086a60
mov rdx, qword [rbp + 0x88]
mov rcx, rbp
mov r9, qword [rbp + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, rdi
mov ebx, 0xfff
jmp 0x180086a90
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rcx, rdi
cmp rax, rbx
jne 0x180086ab5
cmp rdi, rbx
ja 0x180086a6a
test rcx, rcx
je 0x180086ab5
mov r9, qword [rbp + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rax, rsi
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180086ac8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180086af2
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x180086b62
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x180086b5c
test rax, rax
jle 0x180086b3c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x180086b5c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180086b5c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180086cc0
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x180169b40]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x180086c20]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x180086d37
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_200
lea rdx, [rsp + 0x30]
lea rcx, [0x180086c20]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.18005fd54
mov rcx, rax
call fcn.18005fe38
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180086d04
mov r8d, 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800d85d0
add rsp, 0xd8
ret

Function at 0x180086d78
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
and qword [rsp + 0x28], 0
lea r8, [0x180086db0]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
test rax, rax
je 0x180086da9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x38
ret
Function at 0x18009ab40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x18009ab9e
mov dl, 1
call fcn.18008b590
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.18008b590
mov eax, ebx
jmp 0x18009abe2
cmp ebx, 2
ja 0x18009abe0
mov r9, qword [rdi + 0x668]
lea rdx, [0x18014a278]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18009ac00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x180169b40]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x18009ac43
cmp qword [rcx + 0x678], 0
je 0x18009ad20
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.18009e210
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x18009ac71
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x18009acb8
cmp byte [rdi + 0x1597], 0
jne 0x18009acb8
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x18009aca0
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x18009ad18
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x18009ad73
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x18009ad39
mov dl, 1
mov rcx, rdi
call fcn.18008b590
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.18008b590
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800d85d0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x18014a278]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18009ad18
call fcn.1800d8b7c
int3
Function at 0x18009ad80
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x18009aee6
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x180169b40]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
je 0x18009aece
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.18009e210
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x18009ae41
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x18009ae00
cmp byte [rax + rcx - 1], 0xa
jne 0x18009ae28
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x18009ae3c
lea r8, [0x1800dfedc]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.18009e110
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18009ae46
cmp qword [rdi + 0x718], 0
je 0x18009ae8e
mov dl, 1
mov rcx, rdi
call fcn.18008b590
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.18008b590
jmp 0x18009aec6
mov r9, qword [rdi + 0x668]
lea rcx, [0x18014a278]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1800d85d0
add rsp, 0x860
pop rdi
ret

Function at 0x18009af80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x18009afc2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret