joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180026800
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], rbp
mov rsi, rcx
lea rbp, [r8 - 1]
mov qword [rsp + 0x58], r12
sar rbp, 1
mov r14, r9
mov qword [rsp + 0x60], r13
mov r13, r8
mov rbx, rdx
mov r15, rdx
mov rcx, rdx
cmp rdx, rbp
jge 0x180026870
nop dword [rax]
lea rdi, [rcx + rcx]
mov r8, qword [rsi + rdi*8 + 8]
mov rdx, qword [rsi + rdi*8 + 0x10]
call fcn.1800261c0
movzx ecx, al
xor rcx, 1
inc rcx
add rcx, rdi
mov rax, qword [rsi + rcx*8]
mov qword [rsi + rbx*8], rax
mov rbx, rcx
cmp rcx, rbp
jl 0x180026840
cmp rcx, rbp
mov rbp, qword [rsp + 0x50]
jne 0x18002688d
test r13b, 1
jne 0x18002688d
mov rax, qword [rsi + r13*8 - 8]
mov qword [rsi + rbx*8], rax
lea rbx, [r13 - 1]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
cmp r15, rbx
jge 0x1800268da
nop dword [rax]
mov r8, qword [r14]
lea rdi, [rbx - 1]
sar rdi, 1
mov rdx, qword [rsi + rdi*8]
call fcn.1800261c0
test al, al
je 0x1800268da
mov rax, qword [rsi + rdi*8]
mov qword [rsi + rbx*8], rax
mov rbx, rdi
cmp r15, rdi
jl 0x1800268a0
mov rax, qword [r14]
mov qword [rsi + rdi*8], rax
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [r14]
mov qword [rsi + rbx*8], rax
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x180038b30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x98], 0
mov rbx, rcx
jne 0x180038bce
movaps xmmword [rsp + 0x40], xmm6
movups xmm6, xmmword [0x180174ae8]
call fcn.180084170
mov qword [rsp + 0x28], 5
lea rcx, str..text
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov r9, rax
movdqa xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm6
call fcn.180083e60
mov rcx, qword [rsp + 0x70]
lea r9, [rsp + 0x60]
mov edx, 4
mov r8d, 0x40
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov dword [rsp + 0x60], 0
mov qword [rbx + 0x98], rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movaps xmm6, xmmword [rsp + 0x40]
mov rcx, qword [rbx + 0x98]
test rcx, rcx
je 0x180038be2
mov eax, dword [rbx + 0xa0]
mov dword [rcx], eax
add rsp, 0x50
pop rbx
ret
Function at 0x18003a780
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18003a7e1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18003a7a0
mov ecx, dword [r9]
jmp 0x18003a8cb
cmp ecx, 0x4e0
jb 0x18003a8cb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18003a800
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18003a850
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x18003d7e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor edi, edi
call fcn.180006a50
cmp qword [rbx + 0x18], 0xf
mov r8, rbx
jbe 0x18003d809
mov r8, qword [rbx]
mov rdx, r8
mov rax, r8
jmp 0x18003d80f
mov rax, rbx
mov rdx, rbx
add rdx, qword [rbx + 0x10]
mov rcx, rdx
sub rcx, r8
cmp r8, rdx
cmova rcx, rdi
test rcx, rcx
je 0x18003d87f
cmp rcx, 0x40
jb 0x18003d87f
movdqa xmm1, xmmword [0x1800a08b0]
and rcx, 0xffffffffffffffc0
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add rdi, 0x40
xorps xmm0, xmm1
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [rax + 0x20]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x20], xmm0
movdqu xmm0, xmmword [rax + 0x30]
xorps xmm0, xmm1
movdqu xmmword [rax + 0x30], xmm0
add rax, 0x40
cmp rdi, rcx
jne 0x18003d840
cmp rax, rdx
je 0x18003d88f
xor byte [rax], 0x7f
inc rax
cmp rax, rdx
jne 0x18003d884
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800429b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
xor eax, eax
mov qword [rcx + 0x3c], rax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
mov ecx, dword [0x18017423c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180175188], ecx
jle 0x180042a8a
lea rcx, [0x180175188]
call fcn.180086298
cmp dword [0x180175188], 0xffffffff
jne 0x180042a8a
movups xmm6, xmmword [0x180174e58]
call fcn.180084170
lea rdx, str..text
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 5
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm6
mov r9, rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180083e60
mov rax, qword [rsp + 0x60]
mov qword [0x180175190], rax
lea rcx, [0x180175188]
call fcn.18008622c
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [0x180175190]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x1800486b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x98]
lea r9, [rsp + 0x30]
mov rcx, rbx
mov edx, 5
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
movabs rax, 0x9090909090909090
mov edx, 5
mov dword [rbx], eax
mov rcx, rbx
mov byte [rbx + 4], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
pop rbx
ret

Function at 0x180048710
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx + 0x98]
lea r9, [rsp + 0x30]
mov rcx, rbx
mov edx, 5
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x18009bb00]
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov edx, 5
mov dword [rbx], eax
mov rcx, rbx
movzx eax, byte [0x18009bb04]
mov byte [rbx + 4], al
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x20
pop rbx
ret

Function at 0x18004eb10
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18004eb38
xor eax, eax
lea r8, [0x18004ea70]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180050fe0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18005103d
lea rbx, [0x180092090]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180051024
cmp r10, 2
jb 0x180051024
cmp byte [r9], r8b
jne 0x180051024
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180051000
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18005107f
lea rbx, [0x180092090]
cmp r8b, 0x23
jne 0x180051063
cmp byte [r9], r8b
jne 0x180051063
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180051050
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x1800511c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1800511da
mov qword [r8], 0
lea rdx, [0x18009d244]
call fcn.180051090
mov rbx, rax
test rax, rax
jne 0x1800511fa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1800512d3
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800512d3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800512d3
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800512d3
cmp rdi, 0xffffffffffffffff
je 0x1800512d3
mov rax, qword [0x180174338]
test rax, rax
je 0x180051270
inc dword [rax + 0xf0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1800512d3
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1800512c0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180174338]
test rax, rax
je 0x1800512b5
dec dword [rax + 0xf0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800512dc
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1800512ce
mov qword [r14], rdi
mov rax, rsi
jmp 0x1800512de
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800536b0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x180092090]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
sar eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
sar eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov eax, r10d
xor rdx, rcx
sar eax, 0x18
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f50], ebx
jne 0x180053748
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.180065850
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180056ae0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180056b30
lea r11, [0x180092090]
nop dword [rax]
cmp r9b, 0x23
jne 0x180056b13
cmp byte [r8], r9b
jne 0x180056b13
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180056b00
mov rcx, qword [0x180174338]
not eax
movsxd rdx, dword [rcx + 0x3ee8]
mov r9, qword [rcx + 0x3ef0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180056b91
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180056b89
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x180056b8c
mov rdx, r8
test rdx, rdx
jne 0x180056b60
cmp r9, r10
je 0x180056ba0
cmp dword [r9], eax
jne 0x180056ba0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x180063f90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ce0], 0
lea rbx, [rcx + 0x5ce8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180064037
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180063fea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1800669e0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1800516d0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ce0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cf0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180174321]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18006403f
mov rcx, rbx
call fcn.1800516d0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1800644c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180174338]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180064523
mov qword [rsp], rbx
lea rbx, [0x180092090]
nop dword [rax]
cmp r9b, 0x23
jne 0x180064503
cmp byte [r8], r9b
jne 0x180064503
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800644f0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c50]
not eax
mov r8, qword [r10 + 0x5c58]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18006454f
cmp dword [r8 + 8], eax
je 0x180064556
add r8, 0x48
cmp r8, rcx
jne 0x180064540
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x180082b60
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x1801757f0]
mov r8b, byte [rbx + 0x20]
mov rdx, qword [rbx]
mov rdi, rdx
and r8b, 1
je 0x180082b97
lea rdi, [rdx - 5]
movzx eax, r8b
lea rcx, [rdx - 5]
test r8b, r8b
lea r9, [rsp + 0x30]
mov r8d, 0x40
cmove rcx, rdx
lea rbp, [rax*2 + 5]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180082bd0
mov eax, 0xa
jmp 0x180082c5c
test esi, esi
je 0x180082bf2
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180082c13
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180082c13
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180082c0d
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180082c13
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18008308c
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x1800830f2
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800830e3
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800830d9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800830ad
mov r8, qword [rbx]
mov rcx, qword [0x180173bf8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180083220
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x18008326a
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x1801757e8]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x1800832a7
cmp rbx, r14
jb 0x1800832a2
cmp rbx, r15
jae 0x1800832a2
cmp qword [rbx + 8], 0
jne 0x1800833fc
mov rbx, qword [rbx]
jmp 0x180083288
mov rsi, rdi
cmp rdi, r14
jb 0x180083324
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, rsi
div r12
sub rsi, rdx
jmp 0x1800832ea
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800832f2
cmp dword [rbp - 0x10], 0x10000
je 0x1800832f4
mov rsi, qword [rbp - 0x28]
cmp rsi, r12
jb 0x1800832f2
sub rsi, r12
cmp rsi, r14
jae 0x1800832c0
xor esi, esi
test rsi, rsi
je 0x180083324
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800833bd
cmp rsi, r14
jae 0x1800832af
test rbx, rbx
jmp 0x1800833b0
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x180083389
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180083389
cmp dword [rbp - 0x10], 0x10000
je 0x18008338b
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jbe 0x18008334c
xor edi, edi
test rdi, rdi
je 0x1800833fc
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x1800833bd
cmp rdi, r15
jbe 0x18008332c
jmp 0x1800833fc
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov edx, 0x40
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x1800833cf
mov rax, qword [0x1801757e8]
mov qword [rbx], rax
mov qword [0x1801757e8], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180083788
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18008379f
cmp r8b, 0x90
je 0x18008379f
cmp r8b, 0xcc
jne 0x1800837c1
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x1800837bd
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x1800837c1
add edx, r10d
cmp edx, r9d
jb 0x1800837ad
mov eax, r10d
ret
xor eax, eax
ret

Function at 0x180084180
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
xor r12d, r12d
mov rbp, rdx
mov r14, rcx
cmp word [rdx], ax
jne 0x180084204
movsxd rsi, dword [rdx + 0x3c]
add rsi, rdx
cmp dword [rsi], 0x4550
jne 0x180084204
movzx ebx, word [rsi + 0x14]
mov edi, r12d
add rbx, 0x18
add rbx, rsi
cmp r12w, word [rsi + 6]
jae 0x180084204
mov r15, qword [r8]
nop dword [rax + rax]
mov r8d, 8
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x18008422d
movzx eax, word [rsi + 6]
inc edi
add rbx, 0x28
cmp edi, eax
jl 0x1800841e0
mov qword [r14], r12
mov qword [r14 + 8], r12
mov rbx, qword [rsp + 0x40]
mov rax, r14
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov eax, dword [rbx + 0xc]
add rax, rbp
mov qword [r14], rax
mov eax, dword [rbx + 8]
mov qword [r14 + 8], rax
jmp 0x18008420b

Function at 0x180085754
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18008578e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x180085793
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800857dc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.d2d1.dll_Ordinal_1
cmp byte [rcx + rax], 0
je 0x1800857dc
dec r8
sub rdx, 1
jne 0x1800857c2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x180005bd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180005c2d
lea rbx, [0x180099580]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180005c14
cmp r10, 2
jb 0x180005c14
cmp byte [r9], r8b
jne 0x180005c14
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180005bf0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180005c6f
lea rbx, [0x180099580]
cmp r8b, 0x23
jne 0x180005c53
cmp byte [r9], r8b
jne 0x180005c53
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180005c40
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180005db0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180005dca
mov qword [r8], 0
lea rdx, [0x180098818]
call fcn.180005c80
mov rbx, rax
test rax, rax
jne 0x180005dea
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180005ec1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180005ec1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180005ec1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180005ec1
cmp rdi, 0xffffffffffffffff
je 0x180005ec1
mov rax, qword [0x1800ef3f0]
test rax, rax
je 0x180005e5e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180005ec1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180005eae
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1800ef3f0]
test rax, rax
je 0x180005ea3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180005eca
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180005ebc
mov qword [r14], rdi
mov rax, rsi
jmp 0x180005ecc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret