joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140d01058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d011df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d01089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d0106f
add dl, dl
jne 0x140d01096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d010f6
xor eax, eax
add dl, dl
jne 0x140d010a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d011ad
add dl, dl
jne 0x140d010b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d010c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d010d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d010dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d010ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d0107e
mov eax, 1
add dl, dl
jne 0x140d01106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d01113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d010fb
sub eax, ebx
mov ebx, 1
jne 0x140d0114c
mov ecx, 1
add dl, dl
jne 0x140d0112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d0113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d01123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d0107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d01168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d01175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d0115d
cmp eax, 0x7d00
jae 0x140d0119b
cmp eax, 0x500
jb 0x140d01196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d0107e
cmp eax, 0x7f
ja 0x140d0119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d0107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d011d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d0107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14005fe6c
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
mov dword [rax + 8], ecx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, rdx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x20], xmm0
xor esi, esi
mov qword [rbp - 0x10], rsi
mov dword [rbp + 0x30], esi
lea r8, [rbp + 0x30]
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x14005feb4
lea ebx, [rsi + 0xd]
jmp 0x14005ff1f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xea
jne 0x14005ff1f
mov word [rbp + 0x20], si
mov edx, dword [rbp + 0x30]
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x30], xmm0
lea r8, [rbp - 0x30]
lea rcx, [rbp - 0x20]
call fcn.14003cffc
lea r8, [rbp + 0x30]
mov rdx, qword [rbp - 0x20]
mov ecx, 3
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x14005ff11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x14005ff1f
mov rdx, qword [rbp - 0x20]
mov rcx, rdi
call fcn.1400033fc
mov ebx, esi
lea rcx, [rbp - 0x20]
call fcn.1400174fc
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x140060a48
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400bd0c0], eax
call fcn.140060cf8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400bd0c0], 0
jne case.default.0x140060a9e
mov ecx, 1
call fcn.140060cf8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esp, edi
mov eax, 0x803928a
add ecx, dword [rax]
fcom qword [rdi + rdi + 0x23]
invalid
mov dl, 0xb6
xor dword [rbx], 0xffffffe5
adc eax, 0x8a5e60ae
adc eax, 0xb5f74593
jrcxz 0x140125e29
jb 0x140125e2e
add bh, byte [rsi]
invalid
Function at 0x1401e2e60
Capabilities:
Terminate process

Disassembly:
movabs eax, dword [0x343ca70140759266]
movsd dword [rdi], dword [rsi]
mov bh, 0x6e
sbb byte [rbp + 0x2d], cl
add esp, dword [rbx + 0x752971d4]
lodsb al, byte [rsi]
sbb dh, byte [rdx + rdx + 0x50b5f085]
or ch, byte [rsi]
jne 0x1400e322f
jno 0x1400e324d
invalid
push rsp
sbb al, 0x1c
rol eax, 1
pop rax
invalid
cld
pop r11
jmp 0x1401e2e6d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401e2e7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401e2e65
lea eax, [rcx + 1]
jmp 0x1401e2e8b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401e2e9e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401e2e84
sub eax, 3
jb 0x1401e2ebe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401e2f0d
sar eax, 1
movsxd rbp, eax
jb 0x1401e2ef4
jmp 0x1401e2ecc
add ebx, ebx
jne 0x1401e2eca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401e2ef4
inc ecx
add ebx, ebx
jne 0x1401e2eda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401e2ef4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401e2eed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401e2edc
add ecx, 2
jmp 0x1401e2ef9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401e2e22
jmp 0x1401e2e6d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xf6e00
mov dl, 0x23
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401e2f59
cmp rsi, rcx
jae 0x1401e2f61
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401e2f40
cmp al, 0x8f
ja 0x1401e2f40
cmp byte [rsi - 2], 0xf
je 0x1401e2f46
sub al, 0xe8
cmp al, 1
ja 0x1401e2f2a
cmp rsi, rcx
jae 0x1401e2f61
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401e2f30
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401e2f61
lodsb al, byte [rsi]
jmp 0x1401e2f40
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1de000]
mov eax, dword [rdi]
or eax, eax
je 0x1401e2fbe
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1fd7d8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401e2f6e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401e2fb8
mov qword [rbx], rax
add rbx, 8
jmp 0x1401e2f8e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401e3016
sub rsp, 0xffffffffffffff80
jmp 0x1400e3220
Function at 0x1800032d0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [0x180193508], rcx
mov rbx, rcx
cmp edx, 1
jne 0x18000330a
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x1800032b0]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x1800052e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000533d
lea rbx, [0x1800c4f80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180005324
cmp r10, 2
jb 0x180005324
cmp byte [r9], r8b
jne 0x180005324
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180005300
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000537f
lea rbx, [0x1800c4f80]
cmp r8b, 0x23
jne 0x180005363
cmp byte [r9], r8b
jne 0x180005363
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180005350
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800054c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1800054da
mov qword [r8], 0
lea rdx, [0x1800c4ad0]
call fcn.180005390
mov rbx, rax
test rax, rax
jne 0x1800054fa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1800055d1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800055d1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800055d1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800055d1
cmp rdi, 0xffffffffffffffff
je 0x1800055d1
mov rax, qword [0x1801935b8]
test rax, rax
je 0x18000556e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1800055d1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1800055be
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1801935b8]
test rax, rax
je 0x1800055b3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800055da
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1800055cc
mov qword [r14], rdi
mov rax, rsi
jmp 0x1800055dc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800082a0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x1800c4f80]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x180008336
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18001bf70
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180008340
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x1800c4f80]
movss xmm2, dword [rcx + 0x110]
movss xmm3, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x18000c030
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18000c080
lea r11, [0x1800c4f80]
nop dword [rax]
cmp r9b, 0x23
jne 0x18000c063
cmp byte [r8], r9b
jne 0x18000c063
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18000c050
mov rcx, qword [0x1801935b8]
not eax
movsxd rdx, dword [rcx + 0x3eb0]
mov r9, qword [rcx + 0x3eb8]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18000c0e1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18000c0d9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000c0dc
mov rdx, r8
test rdx, rdx
jne 0x18000c0b0
cmp r9, r10
je 0x18000c0f0
cmp dword [r9], eax
jne 0x18000c0f0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x18001a780
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c60], 0
lea rbx, [rcx + 0x5c68]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18001a827
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x18001a7da
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001cfd0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180005ac0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c60]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c70]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1801934c2]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18001a82f
mov rcx, rbx
call fcn.180005ac0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18001acb0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1801935b8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18001ad13
mov qword [rsp], rbx
lea rbx, [0x1800c4f80]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001acf3
cmp byte [r8], r9b
jne 0x18001acf3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18001ace0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bd8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x18001ad47
mov r10, qword [r10 + 0x5be0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x18001ad4e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x18001ad34
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x18003cf30
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov r10, rcx
mov eax, r11d
test r9b, r9b
je 0x18003cf8b
mov qword [rsp], rbx
lea rbx, [0x1800c4f80]
cmp r9b, 0x23
jne 0x18003cf6b
cmp byte [r8], r9b
jne 0x18003cf6b
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18003cf58
mov rbx, qword [rsp]
movsxd rdx, dword [r10 + 0x90]
not eax
mov r9, qword [r10 + 0x98]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18003cfe1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18003cfd9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18003cfdc
mov rdx, r8
test rdx, rdx
jne 0x18003cfb0
cmp r9, r10
je 0x18003cff4
cmp dword [r9], eax
jne 0x18003cff4
mov eax, dword [r9 + 8]
add rsp, 8
ret
mov eax, 0xffffffff
add rsp, 8
ret
Function at 0x18003edc0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x1801925c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x18003ee0f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180194500]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18003ee4d
cmp rsi, r14
jb 0x18003ee45
cmp rsi, r15
jae 0x18003ee45
cmp qword [rsi + 8], 0
jne 0x18003f017
mov rsi, qword [rsi]
test rsi, rsi
jne 0x18003ee30
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x18003eee2
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x18003eed9
nop word [rax + rax]
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003eed9
cmp dword [rsp + 0x40], 0x10000
je 0x18003ef5b
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x18003eed9
sub rbx, rbp
cmp rbx, r14
jae 0x18003eea0
test rsi, rsi
jne 0x18003efc0
cmp rdi, r15
ja 0x18003efff
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18003efff
mov r8d, Ordinal_50
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003efff
cmp dword [rsp + 0x40], 0x10000
je 0x18003ef91
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x18003ef12
jmp 0x18003efff
test rbx, rbx
je 0x18003eed9
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18003efc0
cmp rbx, r14
jae 0x18003ee80
jmp 0x18003eee2
test rdi, rdi
je 0x18003efff
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x18003efc0
cmp rdi, r15
jbe 0x18003eef0
jmp 0x18003efff
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x18003efd0
mov rax, qword [0x180194500]
mov qword [rsi], rax
mov qword [0x180194500], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800b1bb0
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x18003f9a0
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1801925c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18003facb
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x18003fac2
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x18003faa4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x18003faa4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x18003faa4
mov rdx, qword [rbx]
test rdx, rdx
jne 0x18003fa62
mov rcx, qword [0x1801935d8]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x18003fac2
jmp 0x18003fa97
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x18003fa97
mov rcx, qword [0x1801935d8]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18003fac2
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_32
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18003fa10
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x18003fb23
cmp dword [rbx + 0xc], esi
jbe 0x18003fb23
nop word [rax + rax]
mov r8, qword [rbx]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18003fb1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.18003f7f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x18003fae0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800b1bb0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret