joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141847570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx rbp, bp
bswap ebp
not bp
mov rbp, qword [rsp + 0x30]
jns 0x1419f33c0
call fcn.14192b9b0
call rax
mov r11, rax
cmp r14b, 0x78
test spl, r14b
test rax, rax
jmp 0x1420d1773
call rax
jmp 0x1420d18c9
xor eax, eax
jmp 0x1420d16b1
jmp 0x1420d18c9
je 0x1420d16aa
cmp r11, rsi
jmp 0x1420d1781
jne 0x1420d182c
cmp byte [rsp + 0x180], dil
jmp 0x1420d1794
je 0x1420d1817
lea rax, [rsp + 0x40]
shld ecx, ecx, 0xf4
movzx ecx, ax
sub rbp, rax
rol ah, cl
movsxd rdx, r12d
btr ecx, 0x9b
nop
movzx ax, ch
lea rdx, [rsp + rdi + 0x40]
bts ax, di
mov cl, r13b
mov ecx, edi
bt eax, r9d
clc
mov eax, 0x36ab0587
jmp 0x1420d17d5
rol eax, cl
test al, 0x8d
add al, dil
cmc
xor al, byte [rdx + rbp]
jmp 0x1420d17e5
mov byte [rdx], al
jmp 0x1420d17ec
je 0x1420d1810
inc rdi
cmp rbx, 0x3c76617a
clc
stc
cmp rdi, 0x104
jmp 0x1420d180a
jb 0x1420d17b7
lea rbp, [rsp + 0x40]
rdtsc
mov rdx, rbp
not ax
mov rcx, rsi
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1420c0eae
cmp byte [rbx + 1], 0x23
lea rdx, [rbx + 1]
jmp 0x1420d1839
jne 0x1420d18aa
movzx edx, byte [rbx + 2]
stc
test cl, r14b
add rbx, 2
test dl, dl
je 0x1420d18a1
nop
mov ah, 0x8d
inc rax
lea eax, [rdx - 0x30]
jmp 0x1420d1862
inc rbx
cmp sp, r15w
cmp al, 9
ja 0x1420d18a1
movsx eax, dl
neg cx
stc
movzx edx, byte [rbx]
bsf cx, r11w
ror ch, cl
lea ecx, [rdi + rdi*4]
xchg dil, dil
jmp 0x1420d188d
lea edi, [rax + rcx*2 - 0x30]
test dil, r8b
test dl, dl
jmp 0x1420d189b
jne 0x1420d185a
movsxd rdx, edi
mov cx, 0x6b83
bswap ecx
sub r8d, r8d
mov cl, bl
mov rcx, r11
jmp 0x1420d18b7
call fcn.1420d12d2
jmp 0x1420d18c9
mov rbx, qword [rsp + 0x178]
btr rsi, 0x30
movzx si, r8b
mov rdi, qword [rsp + 0x150]
add rsp, 0x158
pop rsi
pop rbp
jmp 0x1420d18f1
ret

Function at 0x1419001db
Capabilities:
Encode data using xor

Disassembly:
sub r10w, bx
or r12d, r15d
push rbx
not bl
push rdx
cmovl r15d, r10d
cli
cmovs r12d, dword [rsp + 0x41]
mov rdx, qword [rsp + 8]
xor r15d, r10d
call fcn.1418e5413
movabs dword es:[0xaf242e63a2414194], eax
cmpsd dword [rsi], dword [rdi]
or ch, byte [rsp]
imul byte [rdi]
sub eax, 0x55cf2429
xor eax, 0xf709242c
jae 0x1419001e9
fcmovne st(0), st(3)
adc eax, 0x992423a1
call 0x12ab42438
and dl, byte [rcx]
and al, 0x24
sahf
and ebp, dword [rbx + 0x2c]
and al, 0x3b
hlt

Function at 0x14193b413
Capabilities:
Encode data using base64

Disassembly:
mov word [rsp + 0x18], 0x4579
jge 0x141b63be1
not byte [rsp + 0x18]
not byte [rsp + 0x10]
or qword [rsp + 0x18], 0x399a1dfd
Function at 0x141942806
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rsp + 0x10], 0x90
not byte [rsp + 8]
and r12w, word [rsp + 8]
or r9b, 0x16
movzx r13w, r14w
and word [rsp + 8], r12w
jge 0x141923c53
call 0x1420b89d6
xor dword [rbx], edx
invalid
jl 0x1420b89ba
sub r9d, dword [rsp + 0x24]
neg word [rsp + 0x20]
test dword [rsp + 0x20], r13d
lea r9, [r13*8 + 0x4ed201ef]
lea r13, [r9 + r13*8 + 0x3f5d518c]
je 0x1418df6f0
movzx r12w, byte [rsp + 0x23]
and r12b, byte [rsp + 0x20]
jg 0x141bb8540
or qword [rsp + 0x28], 0x59553678
and r14d, dword [rsp + 0x2c]
jae 0x141b9e96f
xor r8w, 0x5199
mov qword [rsp + 0x18], 0x6bff2702
bswap ecx
or r8, 0x18976ccc
add qword [rsp + 0x10], 0x2b91f0
mov r8, qword [rsp + 0x60]
or word [rsp + 0x18], 0x68ea
not qword [rsp + 0x18]
sub cl, byte [rsp + 0x36]
movsx rcx, cx
add qword [rsp + 0x28], 0x48c18
mov dword [rsp + 0x30], 0x230175c3
or dword [rsp + 0x30], 0x49ae78ab
add word [rsp + 0x30], 0x4914
not rcx
not ecx
not word [rsp + 0x30]
or word [rsp + 0x18], cx
test cl, 0x2b
not dword [rsp + 0x18]
lea rsp, [rsp + 0x10]
ret 8
add qword [rsp], 0xffffffffbe45756f
and r12, qword [rsp + 0x20]
neg word [rsp + 0x28]
cmp word [rsp + 0x20], 0x2f21
movsx r14, word [rsp + 0x28]
not r13b
seta byte [rsp + 0x28]
setbe r12b
mov r9, qword [rsp + 0x30]
test byte [rsp + 0x28], r14b
mov r12b, r14b
not qword [rsp + 0x28]
bswap r12d
not r14b
setne r14b
xor r12d, r12d
movsxd r13, r12d
setne r12b
call fcn.141b843f8
and dword [rsp + 0x40], r12d
call fcn.14191ba0a
xor eax, 0x9fa70f85
fistp qword [rsi - 3]
mov dh, 0x85
invalid
movsx edi, r9w
mov r9d, 0xa1d2c22
seta dil
add r14b, r13b
js fcn.1418df768
call fcn.141ba8a80
and r10b, 0xcf
mov r10, qword [rsp + 0x48]
jne 0x1418f1703
lea rsp, [rsp + 0x30]
ret 8
Function at 0x14196df19
Capabilities:
Encode data using xor

Disassembly:
xor r10b, 0xa4
push rbx
mov rbx, qword [rsp + 0x50]
je 0x141853f5a
push r8
test r10, r10
js 0x141bae5b1
push rsi
movabs r8, 0x227405b9041a0499
add qword [rsp + 0x60], 0x49687783
sub qword [rsp + 0x60], 0x7ab47db2
add qword [rsp + 0x40], 0xffffffffbe6962b2
or dword [rsp + 0x38], r8d
add r8, qword [rsp + 0x38]
push r10
mov r8b, byte [rsp + 0x6b]
pop rsi
xor r8w, word [rsp + 0x3d]
sub r8d, dword [rsp + 0x62]
push r15
cmp bl, 0xbc
mov r8, qword [rsp + 0x10]
jae 0x141853eb4
xor dword [rsp + 0x40], esi
lea rbx, [rsi + rbx + 0x17aa0df5]
neg r10d
and byte [rsp + 0x40], 0xad
setb bl
mov byte [rsp + 0x40], 0xfd
not r15b
xor word [rsp], r15w
neg dword [rsp]
cmp qword [rsp + 0x40], 0xf262283
jo 0x141853e98
add byte [rsp], 0x26
mov word [rsp + 0x68], 0x721a
cmp byte [rsp], r10b
setl byte [rsp + 0x68]
xor r10w, word [rsp + 0x6b]
test dword [rsp + 0x68], 0xd6e2377
movsx si, bl
mov r10, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 8]
lea rsp, [rsp + 0x70]
ret
not dword [rsp + 0x20]
push r8
mov r15, qword [rsp + 0x28]
jle 0x141853e98
add dword [rsp + 0x28], 0x29650595
cmovo r15w, word [rsp + 2]
neg r15b
push r10
add byte [rsp + 8], r15b
mov r10, r8
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0x4feb1dfc
call fcn.1418dd5cf
and word [rsp + 0x40], 0x2596
and dword [rsp + 0x40], 0x71db3080
and byte [rsp + 0x10], 0x38
not qword [rsp + 0x10]
xor r11, 0x4543323a
not byte [rsp + 0x40]
sub r11d, r10d
setl r10b
or dword [rsp + 0x40], 0x689a6b35
add byte [rsp + 0x10], 0x12
add qword [rsp + 8], 0xffffffffbdf5a9ae
xor r11d, r11d
not dword [rsp + 0x40]
lea r11, [r11*4 + 0x6aa655d]
mov word [rsp + 0x10], 0x2bcc

Function at 0x141b686fa
Capabilities:
Encode data using xor

Disassembly:
push rdx
movabs rdi, 0x23d4021d78c526f8
mov r8, qword [rsp + 0x28]
setno r15b
add di, 0x5858
movabs rdx, 0xa1632064f4c05ad
sub r15d, 0x65a34b88
bswap rdx
ja 0x1418db229
push rdx
test dword [rcx - 0x49265a6d], ebx
invalid

Function at 0x141b93e02
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x30]
and al, 0x30
call fcn.14213c2cc
jnp 0x141b93e69
xor dh, byte fs:[rdx + 0x4d9e2503]
movabs al, byte [0x9a78dc298d9ab5cd]
invalid
xor cl, ah
add al, al
jb 0x141b93e09
std
in al, dx
popfq
adc al, 0xa5
andnps xmm7, xmmword [rdi - 0x70]
sbb r13b, bpl
cmovae ebp, dword [rdx - 0x17]
or al, 0xb7
xchg esp, eax
int1
dec byte [rax + 8]
jb 0x141b93e88
fnstsw word [rsi - 0x4f3b880c]
invalid
Function at 0x141bb02d4
Capabilities:
Encode data using xor

Disassembly:
cmovb r15w, word [rsp + 0x63]
bswap r15d
setge r15b
add qword [rsp], 0xffffffffffd9eb18
test r15, r15
not dx
lea rdx, [r15*2 + 0xf6d09cb]
jge 0x1420be543
push rdi
push rbx
mov rbx, r10
push r14
mov r13, rbx
movabs r14, 0x7f7978617be36763
xor r13d, r14d
jo 0x141bb02ff
push rsi
movabs rdi, 0x208803fd4c3c1e16
cmp r13, 0x189c16b8
bswap rdi
not r14
push r9
call fcn.141b75015
jge 0x141bb03aa
xlatb
sahf
invalid
mov byte [rcx - 0x3df3f81f], dl
movabs dword [0x5b1128ac4290688], eax
and byte [rbp + 0x77], bh
mov rsi, fs
pop rsi
enter 0x307, 0x2f
xor dl, ch
mov ch, 0x1e
sbb byte [rax + rbx], ch
out dx, eax
test byte [rsi + 0x78c92bba], ah
or eax, 0x3488a3c2
outsb dx, byte [rsi]
sti
hlt

Function at 0x141bbb037
Capabilities:
Encode data using xor

Disassembly:
mov r8d, 0x1502eb3b
xor al, 0x70
invalid
setb byte [rsp + 0x10]
call fcn.141846003
sub al, byte [rdx + 0x2f70847b]
shl ebp, 0xf7
cmp eax, dword [rsi]
movabs eax, dword [0x9e8471c5fec9081c]
cmp esp, 0x65ab047f
pop rdx
pop rdx
jl 0x141bbafe2
xor dh, al
in eax, dx
loope 0x141bbb05a
and dl, byte [rsi + 0x257b8e03]
sbb byte [rsi + rbx], bl
mov byte [rdi + rdx*2 + 0x54f7e5d7], ch
invalid
Function at 0x1420c85e7
Capabilities:
Encode data using xor

Disassembly:
sete byte [rsp + 0x30]
call fcn.141b9e9c6
mov byte [rsp + 0x48], sil
add esi, 0x130e4482
add esi, 0xd59753d
jg 0x1420bdc74
lea r11, [r11*4 + 0x10984f85]
movabs rcx, 0x478b3e127b6a3806
push rdi
and cx, 0x57e2
mov rdi, rcx
xor r11d, dword [rsp + 0x2b]
setl cl
or r11b, 0xdc
and di, 0x319
cmp r11b, 0xab
movzx r11d, r11b
movzx di, r11b
bswap ecx
lea rcx, [r11*8 + 0x48517435]
setae r11b
push r8
or byte [rsp + 0x30], 0xcd
not edi
mov rdi, qword [rsp + 8]
add qword [rsp + 0x18], 0xffffffffffffffa6
test qword [rsp + 0x30], 0x3f6c7399
setb cl
mov r8, r11
jo fcn.1420bdcc4
or cl, byte [rsp + 0x33]
setg r8b
lea r8, [rcx + r8*2 + 0x6bdb34d2]
xor word [rsp + 0x30], 0x5b52
xor r8b, cl
or dword [rsp + 0x30], 0x70a63681
neg r8b
jbe 0x141ba8202
call fcn.1419f69c9
setns byte [rsp + 0x18]
jb 0x14185221d
and r13w, r11w
movabs r11, 0x26a7733c20714767
sub r11w, bp
xor qword [rsp + 0x18], rsi
not r13d
setno r11b
mov r13, qword [rsp + 0x58]
xor word [rsp + 0x18], 0x7cc6
test bpl, 0xbd
lea rbp, [r11*8 + 0x25a14f14]
not byte [rsp + 0x18]
lea r11, [r11 + 0x38404856]
not rbp
setl r11b
call fcn.14196a400
neg sil
add word [rsp + 0x10], r11w
test word [rsp + 0x10], si
cmovne r11, qword [rsp + 0x48]
mov r11, qword [rsp + 0x58]
test dword [rsp + 0x48], ebp
call 0x1420c85e7
not r11b
movzx r10d, r10w
and byte [rsp + 0x10], r11b
cmp r11d, dword [rsp + 0x31]
setl byte [rsp + 0x30]
and r11d, 0x72f014b3
lea rcx, [rcx + rcx*8 + 0x5805224d]
neg r8
call fcn.14192deb9
jmp 0x141ba82a1
pop rdx
invalid
jg 0x14196dfb0
xor dword [rsp + 0x28], r11d
jl 0x1420c85e2
cmp byte [rsp + 0x28], 0x9a
setg byte [rsp + 0x28]
test word [rsp + 0x28], 0x6898
mov r11, qword [rsp + 0x40]
not dword [rsp + 0x28]
mov dword [rsp + 0x28], 0x29ec7386
not dword [rsp + 0x28]
setne byte [rsp + 0x28]
and dword [rsp + 0x28], 0x565f32c9
call fcn.141972107
retf 0x727a
and esi, ebp
or si, word [rsp + 0x56]
and bp, si
xor qword [rsp + 0x48], 0x36b44f57
not si
add sil, byte [rsp + 0x2f]
movzx bp, byte [rsp + 0x4b]
sets sil
mov rbp, qword [rsp + 0x38]
xor byte [rsp + 0x50], 0xfd
add dword [rsp + 0x28], 0x247a1144
test byte [rsp + 0x50], 0x9a
call fcn.141bb0679
not r11w
jle 0x14190e578
call fcn.1419686ff
call fcn.1418515d0
js 0x14195a988
je 0x14196a430
mov qword [rsp + 0x48], rsi
or qword [rsp + 0x48], rbp
or dword [rsp + 0x28], 0x62c271ee
jge 0x1418f2e3f
retf 0x6860

Function at 0x1420cfb6c
Capabilities:
Execute anti-debugging instructions

Disassembly:
and al, 0x40
jle 0x141b9edcf
mov edx, 0x990f411b
shl dword [rsi + 0x41], 0x81
int3
add r13w, r8w
mov r12, qword [rsp + 0x20]
jg 0x141bb5529
push rdi
xchg byte [rax], cl
test dword gs:[rbx], ecx
jle 0x141b9ed59
push rax
invalid
push r12
movabs r12, 0x4d364c583c921338
mov r8, qword [rsp + 0x18]
push rbp
push rcx
bswap r13
push r12
mov rbp, qword [rsp + 0x40]
movabs rcx, 0x643105ac040017ea
cmovno r8, qword [rsp + 0x30]
movsx rcx, byte [rsp + 0x30]
sub r8b, r13b
or rcx, 0x5aed71c7
cmp r13d, dword [rsp + 0x33]
push r15
jbe 0x141b9edbe
Function at 0x1800057f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea edi, [r9 + 0xb]
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp r9d, edi
jae case.0x180005860.1
mov r13, qword [rsp + 0xa0]
lea ebx, [r9 - 0xa6]
mov rbp, qword [rsp + 0x98]
lea rdx, [0x180000000]
mov r14, qword [rsp + 0x30]
cmp ebx, 0x30
ja case.0x180005860.9
movzx eax, byte [rdx + rbx + 0x5a20]
mov ecx, dword [rdx + rax*4 + 0x59f8]
add rcx, rdx
jmp rcx
mov rax, qword [rsp + 0x90]
lea rcx, [rsp + 0x88]
mov qword [r14 + 0x78], r13
mov r9d, 0x4b
xor r8d, r8d
mov dword [rsp + 0x88], 0x186a0
xor edx, edx
mov rax, qword [rax]
mov qword [r14 + 0x68], rax
mov qword [r14 + 0x10], r12
call fcn.180041ad0
lea rdx, [0x180000000]
jmp case.0x180005860.9
mov qword [r14], rsi
mov eax, dword [r15]
mov dword [r14 + 0x70], eax
mov qword [r14 + 0x18], rbp
jmp case.0x180005860.9
mov eax, dword [rbp]
lea rdx, [rsp + 0x88]
xor r9d, r9d
mov dword [rsp + 0x88], eax
mov r8, rsi
mov dword [rsp + 0x20], 0xf6
xor ecx, ecx
call fcn.180012a60
test rax, rax
je 0x1800059ef
lea rcx, [rax + 8]
mov qword [rsp + 0x20], 0
mov r9d, 0x112
xor r8d, r8d
xor edx, edx
call fcn.18005ae90
mov qword [rsp + 0x30], rax
lea rdx, [0x180000000]
jmp case.0x180005860.9
movzx eax, byte [r12]
mov r9, rbp
mov byte [rsp + 0x88], al
mov r8, rsi
lea rax, [rsp + 0x88]
mov rdx, r15
mov ecx, 0x2c
mov qword [rsp + 0x20], rax
call fcn.18002e400
lea rdx, [0x180000000]
jmp case.0x180005860.9
mov r8, qword [rbp]
xor edx, edx
add r8, rsi
xor ecx, ecx
lea r9d, [rdx + 0x71]
call fcn.18000ee10
mov qword [rsp + 0x30], rax
lea rdx, [0x180000000]
jmp case.0x180005860.9
mov ecx, 0x3020100
mov rax, rsi
mov edx, 0x40
nop dword [rax]
mov dword [rax], ecx
lea rax, [rax + 4]
add ecx, 0x4040404
sub rdx, 1
jne 0x180005980
lea rdx, [0x180000000]
jmp case.0x180005860.9
mov dword [rsp + 0x30], 0
jmp case.0x180005860.9
movsxd rax, dword [r15]
lea r14, [rsi + 8]
shl rax, 7
add r14, rax
mov rax, qword [rsi]
mov qword [r14 + 8], rax
inc ebx
lea eax, [rbx + 0xa6]
cmp eax, edi
jb 0x180005845
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [0x1800c7780]
jmp 0x1800059cf
Function at 0x18002a750
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18002a784
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18002a770
ret
Function at 0x1800363b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
imul eax, edx, 0x93
mov r13, r8
mov r12d, edx
mov rsi, rcx
mov edi, edx
mov dword [rsp + 0x68], eax
cmp edx, eax
ja 0x18003653a
mov rbp, qword [rsp + 0x78]
xor ebx, ebx
mov r14, qword [rsp + 0x78]
mov r15d, dword [rsp + 0x68]
nop word [rax + rax]
cmp edi, 0x141c
ja 0x1800364e2
je 0x1800364af
mov eax, edi
sub eax, 0xbf
je 0x180036469
sub eax, 0x2b
je 0x180036430
cmp eax, 0xf80
je 0x18003653a
jmp 0x18003651f
lea rdx, [0x1800aa52c]
mov rcx, r13
call fcn.180089618
mov rbp, rax
test rax, rax
je 0x180036531
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call fcn.180089d8c
mov rcx, rbp
call fcn.18008a270
mov r15d, eax
jmp 0x18003651f
mov r9d, 0xa8
mov qword [rsi], rbx
mov r8, r13
xor edx, edx
xor ecx, ecx
call fcn.18006a450
test eax, eax
js 0x180036536
movsxd rdx, eax
mov ecx, 1
call fcn.180080de4
xor r9d, r9d
mov qword [rsi], rax
mov r8, r13
mov edx, 0xf1
mov rcx, rax
call fcn.18002b3f0
mov dword [rsp + 0x78], eax
jmp 0x18003651f
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call fcn.180089d8c
lea eax, [r15 + 1]
movsxd rsi, eax
mov rcx, rsi
call fcn.180080df4
mov r8, rsi
xor edx, edx
mov rcx, rax
mov r14, rax
call fcn.18007d6a0
mov rsi, qword [rsp + 0x60]
jmp 0x18003651f
cmp edi, 0x274e
je 0x18003650b
cmp edi, 0x3a80
je 0x1800364fc
cmp edi, 0x4db2
je 0x18003653a
jmp 0x18003651f
mov rcx, rbp
call fcn.1800893a0
mov qword [rsp + 0x78], r14
jmp 0x18003651f
movsxd rdx, r15d
mov r9, rbp
mov r8d, 1
mov rcx, r14
call fcn.180089a50
imul eax, r12d, 0x15
add edi, eax
cmp edi, dword [rsp + 0x68]
jbe 0x180036400
jmp 0x18003653a
mov rax, rbx
jmp 0x18003653f
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180055520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, qword [rsp + 0x98]
lea r15d, [r8 - 4]
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
cmp r8d, r15d
jbe 0x1800556ff
movzx edi, word [rsp + 0x90]
xor r13d, r13d
mov r12d, 0x8000
mov eax, ebp
sub eax, 0x5c
je 0x180055692
sub eax, 1
je 0x1800555ab
sub eax, 3
je 0x1800556ff
cmp eax, 1
jne 0x1800556f4
mov r8d, 0xe8
mov qword [rsp + 0x98], r13
lea rdx, [rsp + 0x98]
mov rcx, rsi
call fcn.180048e80
mov rbx, rax
jmp 0x1800556f4
mov r8, qword [r14]
mov eax, 1
mov edi, r13d
lea rcx, [r8 - 1]
cmp r8, rax
jbe 0x1800556f4
cmp rcx, 0x10
jb 0x180055668
movdqa xmm3, xmmword [0x1800adb30]
and ecx, 0xf
mov rdx, r8
xorps xmm4, xmm4
sub rdx, rcx
xorps xmm2, xmm2
lea rcx, [rsi + 0x12]
nop dword [rax + rax]
movdqu xmm1, xmmword [rcx - 0x12]
add rax, 0x10
movdqu xmm0, xmmword [rcx - 0x10]
lea rcx, [rcx + 0x20]
paddw xmm1, xmm3
paddw xmm0, xmm3
pxor xmm1, xmm0
por xmm1, xmm4
movdqa xmm4, xmm1
movdqu xmm1, xmmword [rcx - 0x22]
movdqu xmm0, xmmword [rcx - 0x20]
paddw xmm1, xmm3
paddw xmm0, xmm3
pxor xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, rdx
jb 0x1800555f0
por xmm2, xmm4
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movd edi, xmm2
cmp rax, r8
jae 0x1800556f4
movzx edx, word [rsi + rax*2 - 2]
movzx ecx, word [rsi + rax*2]
add dx, r12w
add cx, r12w
inc rax
xor dx, cx
or di, dx
cmp rax, r8
jb 0x180055671
jmp 0x1800556f4
test di, di
je 0x1800556f4
xor r9d, r9d
mov word [rsp + 0x90], di
lea r8, [rsp + 0x90]
mov dword [rsp + 0x20], 0xc2
xor edx, edx
xor ecx, ecx
call fcn.180022410
mov rcx, qword [r14]
lea r9, [rsp + 0x98]
mov word [rsp + 0x30], ax
lea r8, [rsp + 0x30]
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x38]
mov rcx, rsi
mov word [rsp + 0x98], di
mov edx, StrCmpICA
mov qword [rsp + 0x20], rax
call fcn.18003ebd0
dec ebp
cmp ebp, r15d
ja 0x180055563
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005a060
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, qword [rsp + 0x98]
lea r12d, [rdx + 0x470]
mov rbp, r8
mov esi, edx
mov r15, rcx
cmp edx, r12d
jae 0x18005a201
mov r14, qword [rsp + 0x98]
lea rcx, [0x1800790a0]
xor r13d, r13d
nop word [rax + rax]
cmp esi, 0xcd
ja 0x18005a1bf
je 0x18005a18b
mov eax, esi
sub eax, 0x22
je 0x18005a155
sub eax, 0x22
je 0x18005a148
sub eax, 0x4f
je 0x18005a123
cmp eax, 3
jne 0x18005a1f2
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x98]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], r15
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8, rbp
mov qword [rsp + 0x38], r13
mov edx, 0x20
mov byte [rsp + 0x98], 1
call fcn.180070780
mov rdi, rax
jmp 0x18005a1eb
lea r8, [rsp + 0x88]
mov byte [rsp + 0x88], 1
mov rdx, rbp
mov ecx, 0x101
call fcn.18000b500
mov r14, rax
jmp 0x18005a1eb
movzx eax, word [r15]
mov word [rbp + 8], ax
jmp 0x18005a1f2
test rbp, rbp
je 0x18005a1f2
lea rax, [rsp + 0x38]
mov dword [rsp + 0x28], 0x50
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], r13
mov rdx, rbp
xor ecx, ecx
call fcn.180005a60
mov qword [rbp + 0x20], r13
jmp 0x18005a1eb
mov r8d, 0xa2
mov rdx, rbp
xor ecx, ecx
call fcn.18004a330
xor r9d, r9d
mov qword [rsp + 0x20], r13
mov r8d, 0x11c
mov rdx, rbp
xor ecx, ecx
mov rbx, rax
call fcn.180049a40
mov rdi, rax
imul rdi, rbx
jmp 0x18005a1eb
mov eax, esi
sub eax, 0x121
je 0x18005a1d4
sub eax, 3
je 0x18005a201
cmp eax, 0x37
je 0x18005a201
jmp 0x18005a1f2
test r14, r14
je 0x18005a1f2
xor r9d, r9d
mov r8, r14
mov edx, 0x8a
xor ecx, ecx
call fcn.180013dd0
lea rcx, [0x1800790a0]
add esi, 0x8e
cmp esi, r12d
jb 0x18005a0b0
mov rbx, qword [rsp + 0x80]
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180073d20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
lea edi, [rdx + 6]
mov r14, r8
mov rsi, rcx
cmp edx, edi
jae case.0x180073d5f.15
lea ebx, [rdx - 0x23]
lea rbp, [0x180000000]
nop dword [rax]
cmp ebx, 0xf
ja case.0x180073d5f.1
mov ecx, dword [rbp + rbx*4 + 0x73e18]
add rcx, rbp
jmp rcx
mov qword [0x1800c8ca8], rsi
mov qword [rsi + 0x80], r14
jmp case.0x180073d5f.1
cmp qword [0x1800c8cb0], 0
setne byte [rsp + 0x78]
jmp case.0x180073d5f.1
movzx eax, byte [r14]
mov byte [rsi], al
jmp case.0x180073d5f.1
mov qword [rsp + 0x28], 0
lea r8, [0x180013d90]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1800c8cb0], rax
inc ebx
lea eax, [rbx + 0x23]
cmp eax, edi
jb 0x180073d50
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
lea rax, [0x180079350]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x78]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x78], 0
mov r8, rsi
mov qword [rsp + 0x20], rax
mov edx, 0x20
mov byte [rsp + 0x68], 0
lea rcx, [rsp + 0x30]
call fcn.180070780
jmp 0x180073dc2
Function at 0x1800816f4
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x180081514
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180081514
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180081514
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180081514
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180081514
cmp dword [rcx + 0x84], 0xe
jbe 0x180081514
cmp dword [rcx + 0xf8], esi
je 0x180081514
mov ecx, r14d
call fcn.18008165c
mov ecx, 2
call fcn.18008f80c
nop
cmp byte [0x1800ca7d0], 0
jne 0x1800815de
mov r15d, 1
mov eax, r15d
xchg dword [0x1800ca7c0], eax
test ebx, ebx
jne 0x180081587
mov rdi, qword [0x1800c7ef8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1800ca7c8]
cmp rcx, rax
je 0x18008157e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x1800a64c8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1800cab38]
jmp 0x180081593
cmp ebx, r15d
jne 0x180081599
lea rcx, [0x1800cab50]
call fcn.180093884
nop
test ebx, ebx
jne 0x1800815b0
lea rdx, [0x1800a6588]
lea rcx, [0x1800a6568]
call fcn.180093adc
lea rdx, [0x1800a6598]
lea rcx, [0x1800a6590]
call fcn.180093adc
movzx eax, byte [0x1800ca7d0]
test esi, esi
cmove eax, r15d
mov byte [0x1800ca7d0], al
jmp 0x1800815de
mov ecx, 2
call fcn.18008f860
test esi, esi
jne 0x1800815f5
mov ecx, r14d
call fcn.180081610
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x1800814a4

Function at 0x18009a9f8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x18009a9d5
call fcn.18008070c
mov dword [rax], 0x16
call fcn.180080214
or eax, 0xffffffff
jmp 0x18009a9f2
sub dword [rcx + 0x10], 1
jns 0x18009a9e4
add rsp, 0x28
jmp fcn.18009aee0
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x18009a9b4