joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802734d4
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbx, r8
mov r15d, edx
mov r13, rcx
mov qword [rsp + 0x30], 0
lea rcx, [0x18058feb4]
call fcn.1802a00fc
test rax, rax
je 0x18027355b
mov rdi, rax
lea rdx, str.CryptAcquireContextA
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov rbp, rax
lea rdx, str.CryptReleaseContext
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov r12, rax
lea rdx, str.CryptGenRandom
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rbp, rbp
je 0x180273553
test r12, r12
je 0x180273553
mov rsi, rax
test rax, rax
jne 0x180273607
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
test r15d, r15d
je 0x18027367e
mov qword [rsp + 0x40], rbx
xor r8d, r8d
lea rdi, [rsp + 0x38]
mov r12d, r15d
xor eax, eax
xor ebp, ebp
xor ebx, ebx
mov esi, 7
mov r14d, eax
rdtsc
mov eax, eax
shl rdx, 0x20
or rdx, rax
mov qword [rsp + 0x38], rdx
mov edx, 8
mov rcx, rdi
call fcn.18031b774
mov r8d, eax
and eax, 1
xor ebp, eax
rdtsc
mov eax, eax
shl rdx, 0x20
or rdx, rax
mov qword [rsp + 0x38], rdx
mov edx, 8
mov rcx, rdi
call fcn.18031b774
mov r8d, eax
and eax, 1
xor eax, r14d
mov r14d, ebp
cmp ebp, eax
je 0x180273582
add ebx, ebx
or ebx, ebp
lea ecx, [rsi - 1]
test esi, esi
mov esi, ecx
jne 0x18027357f
mov byte [r13], bl
lea r13, [r13 + 1]
dec r12d
jne 0x180273578
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180273696
mov dword [rax], 4
jmp 0x180273696
mov dword [rsp + 0x20], 0xf0000020
lea r8, [0x18058fef9]
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9d, 1
call rbp
test eax, eax
jne 0x18027364f
mov dword [rsp + 0x20], 0xf0000028
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
lea rcx, [rsp + 0x30]
xor edx, edx
mov r9d, 1
call rbp
test eax, eax
je 0x180273553
mov rcx, qword [rsp + 0x30]
mov edx, r15d
mov r8, r13
call rsi
mov esi, eax
mov rcx, qword [rsp + 0x30]
xor edx, edx
call r12
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
cmp esi, 1
jne 0x18027355b
test r15d, r15d
jne 0x18027368b
test rbx, rbx
je 0x180273696
mov dword [rbx], 0
jmp 0x180273696
test rbx, rbx
je 0x180273696
mov dword [rbx], 5
mov eax, r15d
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18027ad34
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov esi, r9d
mov rdi, r8
mov rbx, rcx
mov r9, rcx
sub r9, 0xffffffffffffff80
mov rcx, rdx
mov rdx, r8
mov r8d, esi
call fcn.18022d4b4
test eax, eax
je 0x18027ad65
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
add rbx, 0x9a0
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.18020f6e4

Function at 0x18028fc34
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov ebp, r9d
mov r12, r8
mov edi, edx
mov rsi, rcx
mov ecx, edx
call fcn.18010df24
mov ebx, eax
test eax, eax
jne 0x18028fda2
mov dword [rsi + 0x110], edi
test ebp, ebp
jne 0x18028fc74
mov ebx, 0x20001
jmp 0x18028fda2
movsxd rax, edi
imul r13, rax, 0x78
lea r15, [0x18060d510]
mov eax, dword [r13 + r15 + 0xc]
mov qword [rsp + 0x28], rax
mov ecx, dword [r13 + r15 + 0x10]
call fcn.1802fb6e2
mov ebx, 0xc
test rax, rax
je 0x18028fda2
mov r14, rax
add r15, r13
add r15, 0x10
mov ecx, dword [r15]
call fcn.1802fb6e2
mov qword [rsi + 0x228], rax
test rax, rax
je 0x18028fd9a
mov ecx, dword [r15]
cmp ecx, ebp
jae 0x18028fd0a
lea rdx, [rsp + 0x34]
mov dword [rdx], ecx
mov qword [rsp + 0x20], rdx
mov ecx, edi
mov rdx, r12
mov r8d, ebp
mov r9, rax
call fcn.180218554
mov ebx, eax
test eax, eax
jne 0x18028fd8e
mov edx, dword [r15]
mov rcx, qword [rsp + 0x28]
cmp edx, ecx
jbe 0x18028fd38
sub edx, ecx
add rcx, qword [rsi + 0x228]
jmp 0x18028fd30
mov edi, ebp
mov rcx, rax
mov rdx, r12
mov r8, rdi
call fcn.18017fd34
mov edx, dword [r15]
mov eax, edx
sub eax, ebp
jbe 0x18028fd38
add rdi, qword [rsi + 0x228]
mov rcx, rdi
mov rdx, rax
call fcn.1800708d4
mov edx, dword [r15]
test edx, edx
je 0x18028fd5a
xor eax, eax
mov rcx, qword [rsi + 0x228]
mov cl, byte [rcx + rax]
xor cl, 0x36
mov byte [r14 + rax], cl
inc rax
mov ecx, dword [r15]
cmp rax, rcx
jb 0x18028fd3e
mov rcx, rsi
lea rax, [0x18060d510]
call qword [r13 + rax + 0x58]
mov ebx, eax
test eax, eax
jne 0x18028fd8e
mov r8d, dword [r15]
mov rcx, rsi
mov rdx, r14
lea rax, [0x18060d510]
call qword [r13 + rax + 0x60]
mov ebx, eax
test eax, eax
jne 0x18028fd8e
xor ebx, ebx
jmp 0x18028fd9a
mov rcx, qword [rsi + 0x228]
call fcn.1802fbeb6
mov rcx, r14
call fcn.1802fbeb6
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18029e7b4
Capabilities:
Print debug messages
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
call sub.KERNEL32.dll_OutputDebugStringA
lea rcx, [0x180592b08]
call fcn.1802a00fc
test rax, rax
je 0x18029e88e
mov rdi, rax
lea rdx, str.RegisterEventSourceA
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov rbx, rax
lea rdx, str.ReportEventA
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov r15, rax
lea rdx, str.DeregisterEventSource
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rbx, rbx
je 0x18029e886
test r15, r15
je 0x18029e886
mov r14, rax
test rax, rax
je 0x18029e886
lea rax, [0x180592b4d]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsi
lea rdx, str.hasplms
xor ecx, ecx
call rbx
test rax, rax
je 0x18029e886
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 2
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, 0xc0070003
call r15
mov rcx, rbx
call r14
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
lea rcx, [0x180592b63]
call fcn.1802a00fc
test rax, rax
je 0x18029e8d2
mov rdi, rax
lea rdx, [0x180592b6e]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x18029e8ca
lea r8, str.Sentinel_HASP
xor ecx, ecx
mov rdx, rsi
mov r9d, 0x10
call rax
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 1
call sub.KERNEL32.dll_TerminateProcess
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1802a00fc
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov rsi, rcx
lea rcx, [0x18060bfd0]
lea rdx, str.SetDefaultDllDirectories
call fcn.18029feca
test eax, eax
jne 0x1802a018b
lea rcx, [rsp + 0x20]
mov edx, 0x104
call sub.KERNEL32.dll_GetSystemDirectoryA
test eax, eax
jne 0x1802a0136
xor eax, eax
jmp 0x1802a0180
mov edi, eax
mov rcx, rsi
call fcn.180236c54
lea ecx, [rdi + 1]
add rcx, rax
add rcx, 1
cmp rcx, 0x104
ja 0x1802a0132
inc rax
mov ecx, edi
add rcx, rsp
add rcx, 0x21
mov byte [rcx - 1], 0x5c
mov rdx, rsi
mov r8, rax
call fcn.18017fd34
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 8
call 0x1803e037f
nop
add rsp, 0x128
pop rdi
pop rsi
ret
mov rcx, rsi
xor edx, edx
mov r8d, 0x800
add rsp, 0x128
pop rdi
pop rsi
jmp 0x1803e037f
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
Function at 0x1802d67c4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r12, rdx
mov rbx, rcx
mov ecx, dword [rcx]
call fcn.1801bffc4
test eax, eax
jne 0x1802d68ef
movsxd rcx, dword [rbx + 4]
mov eax, 0x16
cmp rcx, 0x80
ja 0x1802d68ef
mov edx, dword [rbx + 8]
cmp edx, 0x80
jg 0x1802d68ef
cmp ecx, edx
jg 0x1802d68ef
cmp ecx, edx
jne 0x1802d6820
xor edi, edi
jmp 0x1802d6850
lea eax, [rcx + 1]
mov dword [rbx + 4], eax
mov byte [rbx + rcx + 0xc], 0x80
mov edx, dword [rbx + 4]
mov ecx, dword [rbx + 8]
mov edi, 1
jmp 0x1802d684c
lea ecx, [rdx + 1]
mov dword [rbx + 4], ecx
movsxd rcx, edx
mov byte [rbx + rcx + 0xc], 0
mov edx, dword [rbx + 4]
mov ecx, dword [rbx + 8]
cmp edx, ecx
jl 0x1802d6838
test ecx, ecx
je 0x1802d6879
mov ecx, ecx
xor edx, edx
shl rdi, 7
add rdi, rbx
mov al, byte [rdx + rdi + 0x10c]
xor al, byte [rbx + rdx + 0x8c]
xor byte [rbx + rdx + 0xc], al
inc rdx
cmp rdx, rcx
jb 0x1802d685f
movsxd rax, dword [rbx]
lea rdi, [rax + rax*4]
shl rdi, 5
lea r15, [0x18060c0b0]
lea r14, [rbx + 0x210]
lea rcx, [rbx + 0xc]
mov rdx, rcx
mov r8, r14
call qword [rdi + r15 + 0x28]
test eax, eax
jne 0x1802d68ef
movsxd rax, dword [rbx]
lea rax, [rax + rax*4]
shl rax, 5
mov rcx, r14
call qword [rax + r15 + 0x38]
xor eax, eax
cmp dword [rbx + 8], 0
mov esi, 0
je 0x1802d68eb
xor edx, edx
xor esi, esi
mov edi, dword [r13]
cmp rdx, rdi
jae 0x1802d68e9
mov cl, byte [rbx + rdx + 0xc]
mov byte [r12 + rdx], cl
inc rdx
inc esi
mov ecx, dword [rbx + 8]
cmp rdx, rcx
jb 0x1802d68c9
jmp 0x1802d68eb
mov esi, edx
mov dword [r13], esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180303418
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x180303475
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
mov r10, qword [rcx + 0x18]
mov r9, qword [rcx + 0x10]
xor r11d, r11d
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add r9, r10
rol r10, 0x10
xor r10, r9
add r8, r10
rol r10, 0x15
xor r10, r8
add r9, rax
rol rax, 0x11
xor rax, r9
rol r9, 0x20
inc r11d
cmp r11d, edx
jne 0x18030342e
mov qword [rcx + 8], rax
mov qword [rcx], r8
mov qword [rcx + 0x18], r10
mov qword [rcx + 0x10], r9
ret
Function at 0x18030a7c4
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
mov r10, rdx
lea rax, [rdx + 2]
movabs rsi, 0xaaaaaaaaaaaaaaab
mul rsi
movabs rax, 0x7ffffffffffffffe
and rax, rdx
lea rdx, [rax + rax]
add rdx, 1
mov eax, 0x54
cmp qword [r9], rdx
jb 0x18030a8e7
mov rax, r10
mul rsi
shr rdx, 1
lea r11, [rdx + rdx*2]
xor eax, eax
test r11, r11
jne 0x18030a817
mov rdx, r8
jmp 0x18030a87f
lea rsi, [0x180539300]
mov rdx, r8
movzx edi, byte [rcx]
shr rdi, 2
mov bl, byte [rdi + rsi]
mov byte [rdx], bl
movzx edi, byte [rcx]
shl rdi, 4
movzx ebx, byte [rcx + 1]
shr rbx, 4
and edi, 0x30
or rdi, rbx
mov bl, byte [rsi + rdi]
mov byte [rdx + 1], bl
movzx edi, byte [rcx + 1]
movzx ebx, byte [rcx + 2]
shr rbx, 6
and edi, 0xf
lea rdi, [rbx + rdi*4]
mov bl, byte [rsi + rdi]
mov byte [rdx + 2], bl
movzx edi, byte [rcx + 2]
and edi, 0x3f
mov bl, byte [rdi + rsi]
mov byte [rdx + 3], bl
add rdx, 4
add rcx, 3
add rax, 3
cmp rax, r11
jb 0x18030a821
cmp rax, r10
jae 0x18030a8df
movzx esi, byte [rcx]
inc rax
xor r11d, r11d
cmp rax, r10
jae 0x18030a897
movzx r11d, byte [rcx + 1]
mov rdi, rsi
shr rdi, 2
shl rsi, 4
mov ecx, r11d
shr rcx, 4
and esi, 0x30
or rsi, rcx
lea rcx, [0x180539300]
mov bl, byte [rdi + rcx]
mov byte [rdx], bl
mov bl, byte [rcx + rsi]
mov byte [rdx + 1], bl
mov bl, 0x3d
cmp rax, r10
jae 0x18030a8d4
shl r11d, 2
and r11d, 0x3c
mov bl, byte [r11 + rcx]
mov byte [rdx + 2], bl
mov byte [rdx + 3], 0x3d
add rdx, 4
mov byte [rdx], 0
sub edx, r8d
xor eax, eax
mov qword [r9], rdx
pop rbx
pop rdi
pop rsi
ret
Function at 0x18031b774
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r11d, 0x9e3779b9
cmp rdx, 3
jae 0x18031b790
mov eax, 0x9e3779b9
mov r10, rdx
jmp 0x18031b82c
mov r9d, 2
mov r10, rdx
mov eax, 0x9e3779b9
movzx ebx, byte [rcx]
add ebx, eax
movzx eax, byte [rcx + 1]
add eax, r11d
movzx edi, byte [rcx + 2]
add edi, r8d
sub ebx, eax
sub ebx, edi
mov esi, edi
shr esi, 0xd
xor esi, ebx
sub eax, edi
sub eax, esi
mov ebx, esi
shl ebx, 8
xor ebx, eax
sub edi, esi
sub edi, ebx
mov eax, ebx
shr eax, 0xd
xor eax, edi
sub esi, ebx
sub esi, eax
mov edi, eax
shr edi, 0xc
xor edi, esi
sub ebx, eax
sub ebx, edi
mov esi, edi
shl esi, 0x10
xor esi, ebx
sub eax, edi
sub eax, esi
mov ebx, esi
shr ebx, 5
xor ebx, eax
sub edi, esi
sub edi, ebx
mov eax, ebx
shr eax, 3
xor eax, edi
sub esi, ebx
sub esi, eax
mov r11d, eax
shl r11d, 0xa
xor r11d, esi
sub ebx, eax
sub ebx, r11d
mov r8d, r11d
shr r8d, 0xf
xor r8d, ebx
add rcx, 3
add r10, 0xfffffffffffffffd
cmp r10, r9
ja 0x18031b79e
add edx, r8d
cmp r10, 1
je 0x18031b842
cmp r10, 2
jne 0x18031b847
movzx ebx, byte [rcx + 1]
add r11d, ebx
movzx ecx, byte [rcx]
add eax, ecx
sub eax, edx
sub eax, r11d
mov ecx, edx
shr ecx, 0xd
xor ecx, eax
sub r11d, edx
sub r11d, ecx
mov eax, ecx
shl eax, 8
xor eax, r11d
sub edx, ecx
sub edx, eax
mov ebx, eax
shr ebx, 0xd
xor ebx, edx
sub ecx, eax
sub ecx, ebx
mov edx, ebx
shr edx, 0xc
xor edx, ecx
sub eax, ebx
sub eax, edx
mov edi, edx
shl edi, 0x10
xor edi, eax
sub ebx, edx
sub ebx, edi
mov ecx, edi
shr ecx, 5
xor ecx, ebx
sub edx, edi
sub edx, ecx
mov eax, ecx
shr eax, 3
xor eax, edx
sub edi, ecx
sub edi, eax
sub ecx, eax
shl eax, 0xa
xor eax, edi
sub ecx, eax
shr eax, 0xf
xor eax, ecx
pop rbx
pop rdi
pop rsi
ret
Function at 0x18032ed04
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
sub rsp, 0x20
test rcx, rcx
jne 0x1801473f5
mov eax, 0xe
jmp 0x180147421
mov rsi, rcx
mov ecx, 0xc
call fcn.1802fb6e2
test rax, rax
jne 0x18014740e
mov eax, 0xc
jmp 0x180147421
mov qword [rax], 0
mov dword [rax + 8], 0
mov qword [rsi], rax
xor eax, eax
add rsp, 0x20
pop rsi
ret
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
call fcn.18010df5b
cmp eax, 1
je 0x180270acf
test eax, eax
jne 0x180270ae0
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x18032ed04
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp 0x1801473e4
mov eax, 0xe1
add rsp, 0x28
pop rdi
pop rsi
ret
push rsi
push rdi
push rbx
sub rsp, 0x20
test rcx, rcx
jne 0x18032ed1a
mov eax, 0xe
jmp 0x18032ee0a
mov rsi, rcx
mov ecx, 0x68
call fcn.1802fb6e2
test rax, rax
jne 0x18032ed36
mov eax, 0xc
jmp 0x18032ee0a
mov rdi, rax
mov dword [rax], 0
lea rcx, [0x18059edfc]
call sub.KERNEL32.dll_GetModuleHandleA
cmp rax, 0xffffffffffffffff
je 0x18032edec
mov rbx, rax
lea rdx, str.AcquireSRWLockShared
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x40], rax
lea rdx, str.ReleaseSRWLockShared
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x48], rax
lea rdx, str.AcquireSRWLockExclusive
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x50], rax
lea rdx, str.ReleaseSRWLockExclusive
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x58], rax
lea rdx, str.InitializeSRWLock
mov rcx, rbx
call sub.KERNEL32.dll_GetProcAddress
mov qword [rdi + 0x60], rax
cmp qword [rdi + 0x40], 0
je 0x18032edec
cmp qword [rdi + 0x48], 0
je 0x18032edec
cmp qword [rdi + 0x50], 0
je 0x18032edec
test rax, rax
je 0x18032edec
mov rax, qword [rdi + 0x58]
test rax, rax
je 0x18032edec
mov dword [rdi], 1
mov rcx, rdi
add rcx, 0x30
call qword [rdi + 0x60]
jmp 0x18032edfd
cmp dword [rdi], 0
jne 0x18032ede0
mov rcx, rdi
add rcx, 8
call sub.KERNEL32.dll_InitializeCriticalSection
mov qword [rdi + 0x38], 0
mov qword [rsi], rdi
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x18037de64
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, r9
mov r13d, r8d
mov rdi, rdx
mov rbx, rcx
mov ecx, dword [r9]
call fcn.1801bffc4
mov ecx, eax
test eax, eax
jne 0x18037df5c
mov ebp, dword [rsi + 4]
lea eax, [rbp - 1]
mov ecx, 0x16
cmp eax, 0x7f
ja 0x18037df5c
mov eax, r13d
xor edx, edx
div ebp
and ebp, 7
or ebp, edx
jne 0x18037df5c
movsxd rcx, dword [rsi]
lea r9, [rcx + rcx*4]
shl r9, 5
lea r12, [0x18060c0b0]
mov rbp, qword [r9 + r12 + 0x60]
test rbp, rbp
jne 0x18037df6f
test r13d, r13d
jne 0x18037dee1
xor ecx, ecx
jmp 0x18037df5c
lea r14, [rsi + 0x88]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov r8, r14
call qword [r9 + r12 + 0x30]
mov ecx, eax
test eax, eax
jne 0x18037df5c
lea r15, [rsp + 0x30]
mov ecx, dword [rsi + 4]
xor eax, eax
test ecx, ecx
jle 0x18037df2f
cdqe
mov rcx, qword [rsp + rax + 0x30]
xor rcx, qword [rsi + rax + 8]
mov rdx, qword [rbx + rax]
mov qword [rsi + rax + 8], rdx
mov qword [rdi + rax], rcx
add eax, 8
mov ecx, dword [rsi + 4]
cmp eax, ecx
jl 0x18037df0c
sub r13d, ecx
je 0x18037dedd
movsxd rax, ecx
add rdi, rax
add rbx, rax
movsxd rax, dword [rsi]
lea rbp, [rax + rax*4]
shl rbp, 5
mov rcx, rbx
mov rdx, r15
mov r8, r14
call qword [rbp + r12 + 0x30]
mov ecx, eax
test eax, eax
je 0x18037df03
mov eax, ecx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsi + 0x88]
add rsi, 8
mov qword [rsp + 0x20], rcx
mov rcx, rbx
mov rdx, rdi
mov r8d, eax
mov r9, rsi
call rbp
jmp 0x18037df5e

Function at 0x18037ef54
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x30
movsxd rcx, ecx
lea rsi, [rsp + 0x2c]
mov dword [rsi], 0xffffffff
mov qword [rsp + 0x20], 0
mov r9, rsi
call sub.KERNEL32.dll_ReadFile
mov edx, dword [rsi]
xor ecx, ecx
cmp eax, 1
sbb rcx, rcx
or rcx, rdx
mov rax, rcx
add rsp, 0x30
pop rsi
ret

Function at 0x18038f234
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
movsxd rcx, ecx
lea rsi, [rsp + 0x2c]
mov dword [rsi], 0xffffffff
mov qword [rsp + 0x20], 0
mov r9, rsi
call sub.KERNEL32.dll_WriteFile
mov edx, dword [rsi]
xor ecx, ecx
cmp eax, 1
sbb rcx, rcx
or rcx, rdx
mov rax, rcx
add rsp, 0x30
pop rsi
ret
Function at 0x18039e420
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1805b6a20]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.18040d610
mov rcx, qword [rsp + 0x78]
call fcn.180396680
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.18039ecd0
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.18039ed70
nop
lea rcx, [rsp + 0x38]
call fcn.18040d580
lea rax, [0x18039edc0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.18040d5c0
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1803e94a4
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x18039e4e8
lea rcx, [rsp + 0x50]
call fcn.18040d5e0
jmp 0x18039e4ff
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1803e0f40
nop
lea rcx, [rsp + 0x50]
call fcn.18040d580
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1803e2650
add rsp, 0x68
ret
Function at 0x1803a19c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1805b6a20]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x80], 0
jg 0x1803a19f4
xor eax, eax
jmp 0x1803a1ba0
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x1803a1a1c
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.180397280
jmp 0x1803a1ba0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
call fcn.1803985f0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1803a1ab8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.18039a710
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
call fcn.1803987c0
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.180399430
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call fcn.180398720
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x1803a1b90
mov rcx, qword [rsp + 0x70]
call fcn.1803a33f0
mov qword [rsp + 0x38], 0xfff
cmp qword [rsp + 0x40], 0xfff
jbe 0x1803a1b58
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1803ea978
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x28], 0xfff
je 0x1803a1b56
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x1803a1ba0
jmp 0x1803a1ade
cmp qword [rsp + 0x40], 0
jbe 0x1803a1b90
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1803ea978
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1803e2650
add rsp, 0x68
ret
Function at 0x1803a34a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1805b6a20]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xa0]
cmp qword [rax + 0x68], 0
je 0x1803a34dd
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1803a34e4
mov al, 1
jmp 0x1803a362c
call fcn.180399320
mov rcx, qword [rsp + 0xa0]
mov rcx, qword [rcx]
mov qword [rsp + 0x48], rcx
mov edx, eax
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x48]
call qword [rax + 0x18]
mov dword [rsp + 0x38], eax
call fcn.180399320
mov dword [rsp + 0x3c], eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x3c]
call fcn.180399380
movzx eax, al
test eax, eax
je 0x1803a3535
xor al, al
jmp 0x1803a362c
mov qword [rsp + 0x50], 0x20
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
add rcx, 0x74
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x60]
mov rdx, rcx
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rax + 0x68]
call fcn.1803a4160
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x1803a359a
cmp dword [rsp + 0x30], 1
je 0x1803a35a6
cmp dword [rsp + 0x30], 3
je 0x1803a361a
jmp 0x1803a362a
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jbe 0x1803a35f1
mov rax, qword [rsp + 0xa0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.1803ea2a4
cmp qword [rsp + 0x40], rax
je 0x1803a35f1
xor al, al
jmp 0x1803a362c
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1803a360b
mov dword [rsp + 0x34], 1
jmp 0x1803a3613
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1803a362c
mov rax, qword [rsp + 0xa0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1803a362c
xor al, al
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1803e2650
add rsp, 0x98
ret

Function at 0x1803aeb50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1805b6a20]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
lea rcx, [rsp + 0x50]
call fcn.180411250
mov rcx, qword [rsp + 0x78]
call fcn.180396680
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1803af880
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1803af920
nop
lea rcx, [rsp + 0x38]
call fcn.1804111c0
lea rax, [0x1803af970]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
add rax, 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.180411200
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call fcn.1803e94a4
mov rcx, qword [rsp + 0x70]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
cmp qword [rax], 0
je 0x1803aec18
lea rcx, [rsp + 0x50]
call fcn.180411220
jmp 0x1803aec2f
mov rax, qword [rsp + 0x70]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1803e0f40
nop
lea rcx, [rsp + 0x50]
call fcn.1804111c0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1803e2650
add rsp, 0x68
ret