joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031c30
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140031c7a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140031c7a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140031c7a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140031c7a
cmp dword [rcx + 0x84], 0xe
jbe 0x140031c7a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140031c7c
xor al, al
add rsp, 0x28
ret

Function at 0x14003d4f0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x140075048]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x14005c318]
mov rbp, rcx
call fcn.14004ab88
xor edi, edi
test rax, rax
je 0x14003d5d6
mov ebx, edi
call fcn.14003df64
mov r14d, dword [rax]
call fcn.14003df64
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.14004aad4
mov rsi, rax
test rax, rax
je 0x14003d567
call fcn.14003df64
mov dword [rax], r14d
jmp 0x14003d591
call fcn.14003df64
cmp dword [rax], 0x22
jne 0x14003d5ce
call fcn.14003df64
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.14004aad4
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x14003d5ce
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x14003d595
cmp rax, 3
je 0x14003d5b0
mov rcx, rsi
call fcn.14003d44c
test al, al
je 0x14003d5c1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x14003d5c1
mov dil, 1
mov rcx, rbx
call fcn.14003be7c
mov al, dil
jmp 0x14003d5d8
mov rcx, rbx
call fcn.14003be7c
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140030ef0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14003d910
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14003d77b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003d77b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003d77b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003d77b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003d77b
cmp dword [rcx + 0x84], 0xe
jbe 0x14003d77b
cmp dword [rcx + 0xf8], 0
je 0x14003d77b
mov ecx, ebx
call fcn.14003d82c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14003d608
nop
cmp dword [rbp + 0x20], 0
je 0x14003d7c9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14003d7d4
int3
xor r8d, r8d
xor edx, edx
jmp 0x14003d70c
Function at 0x14003dda8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14003dddf
call fcn.14003df64
mov dword [rax], SafeArrayUnaccessData
call fcn.140037a4c
xor eax, eax
jmp 0x14003de6d
mov rdx, r9
mov rcx, r8
call fcn.14003dd44
mov rbx, rax
test rax, rax
je 0x14003de6a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14003dc70]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14003de57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14003ded8
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14003de3e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14003de4d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.1400470c0
jmp 0x14003de6a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003de67
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14004e9b0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14004ea37
mov rsi, rbx
cmp word [rax], bp
je 0x14004e9f6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14004e9e0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14004e9dc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400470fc
mov rdi, rax
test rax, rax
je 0x14004ea24
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140033370
mov rbp, rdi
xor ecx, ecx
call fcn.1400470c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400515c8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.140046d60
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140051669
cmp ebx, dword [rsp + 0x30]
je 0x140051662
test esi, esi
je 0x140051662
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14005163d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14005164a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140051627
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14005164e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x14005166b
mov eax, 1
jmp 0x14005166b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400534b0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140075048]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400534fa
call fcn.14003df44
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayDestroy
call fcn.14003df64
mov dword [rax], SafeArrayDestroy
call fcn.140037a4c
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140030ef0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x140053505
lea eax, [rbx + 1]
jmp 0x1400534e7
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1400534e5
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1400534e7

Function at 0x140055930
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140055958
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140055958
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140757640
Capabilities:
Terminate process

Disassembly:
invalid
cld
pop r11
jmp 0x14075764d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14075765d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140757645
lea eax, [rcx + 1]
jmp 0x14075766b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14075767e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140757664
sub eax, 3
jb 0x14075769e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1407576ed
sar eax, 1
movsxd rbp, eax
jb 0x1407576d4
jmp 0x1407576ac
add ebx, ebx
jne 0x1407576aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1407576d4
inc ecx
add ebx, ebx
jne 0x1407576ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1407576d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1407576cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1407576bc
add ecx, 2
jmp 0x1407576d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140757602
jmp 0x14075764d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x754000]
mov eax, dword [rdi]
or eax, eax
je 0x140757759
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x7571e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1407576fd
jns 0x140757732
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14075773c
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140757753
mov qword [rbx], rax
add rbx, 8
jmp 0x14075771d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14075779d
cmp al, 0xef
ja 0x140757785
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140757765
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140757774
mov eax, dword [rdi]
add rdi, 4
jmp 0x140757774
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1407577f1
sub rsp, 0xffffffffffffff80
jmp 0x1406ed48c
Function at 0x18000b2a0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x68
mov rax, qword [0x180082010]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp byte [0x180097ff0], 0
je 0x18000b320
mov eax, 0xa2
mov qword [rsp + 0x60], rbx
xor ebx, ebx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], ax
call fcn.1800162c0
test al, al
jne 0x18000b2ec
lea edx, [rbx + 2]
jmp 0x18000b302
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov edx, 2
cmovne edx, ebx
mov r8d, 0x28
mov dword [rsp + 0x34], edx
lea rdx, [rsp + 0x28]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800636e0
add rsp, 0x68
ret

Function at 0x18000b8c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
cmp byte [0x180097fe5], 0
je 0x18000ba54
call fcn.1800162c0
test al, al
je 0x18000ba54
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp byte [0x180082098], bl
je 0x18000b98d
lea ecx, [rbx + 2]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18000ba4f
lea ecx, [rbx + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18000b98d
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea ecx, [rbx + 2]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
lea ecx, [rbx + 0x3c]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea ecx, [rbx + 4]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
lea ecx, [rbx + 0x1e]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea ecx, [rbx + 2]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
lea ecx, [rbx + 0x3c]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea ecx, [rbx + 4]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
lea ecx, [rbx + 0x1e]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x180082084], bl
je 0x18000ba4f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18000ba4f
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18000ba4f
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 8]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0x1e
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 8]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x10]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, 0x1e
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
jmp qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
Function at 0x18000c520
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18000c581
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18000c540
mov ecx, dword [r9]
jmp 0x18000c668
cmp ecx, 0x4e0
jb 0x18000c668
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18000c5a0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18000c5f0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x180014dd0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 0x40000000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x180014de0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x180082010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x68], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0xe
jb 0x180014f0a
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180014e28
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xe
lea r9, str.start_https:__
lea rcx, [rsp + 0x48]
call fcn.1800130f0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180014ea4
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180014e9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180014e9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180063ac4
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180014eda
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180014ed5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180014f03
mov rcx, r8
call fcn.180063ac4
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800636e0
add rsp, 0x80
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1800019e0
nop

Function at 0x18001b7d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001b82d
lea rbx, [0x18006e950]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18001b814
cmp r10, 2
jb 0x18001b814
cmp byte [r9], r8b
jne 0x18001b814
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18001b7f0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001b86f
lea rbx, [0x18006e950]
cmp r8b, 0x23
jne 0x18001b853
cmp byte [r9], r8b
jne 0x18001b853
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18001b840
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18001b9b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18001b9ca
mov qword [r8], 0
lea rdx, [0x18006e4e0]
call fcn.18001b880
mov rbx, rax
test rax, rax
jne 0x18001b9ea
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x18001bac1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001bac1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001bac1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001bac1
cmp rdi, 0xffffffffffffffff
je 0x18001bac1
mov rax, qword [0x180098080]
test rax, rax
je 0x18001ba5e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x18001bac1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18001baae
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180098080]
test rax, rax
je 0x18001baa3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18001baca
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18001babc
mov qword [r14], rdi
mov rax, rsi
jmp 0x18001bacc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18001f2c0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov rax, qword [rcx + 0xf0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x18006e950]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x180098080]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3f00], ebx
jne 0x18001f356
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.180032410
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180022e10
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180022e60
lea r11, [0x18006e950]
nop dword [rax]
cmp r9b, 0x23
jne 0x180022e43
cmp byte [r8], r9b
jne 0x180022e43
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180022e30
mov rcx, qword [0x180098080]
not eax
movsxd rdx, dword [rcx + 0x3e98]
mov r9, qword [rcx + 0x3ea0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180022ec1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180022eb9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x180022ebc
mov rdx, r8
test rdx, rdx
jne 0x180022e90
cmp r9, r10
je 0x180022ed0
cmp dword [r9], eax
jne 0x180022ed0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x180030c10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c38], 0
lea rbx, [rcx + 0x5c40]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180030cb7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180030c6a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180033b90
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.18001c090
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c38]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c48]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180098056]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180030cbf
mov rcx, rbx
call fcn.18001c090
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180031140
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180098080]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1800311a3
mov qword [rsp], rbx
lea rbx, [0x18006e950]
nop dword [rax]
cmp r9b, 0x23
jne 0x180031183
cmp byte [r8], r9b
jne 0x180031183
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180031170
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bb0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1800311d7
mov r10, qword [r10 + 0x5bb8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1800311de
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1800311c4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret