joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d8670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rdx]
mov rbp, rcx
mov rcx, rdx
mov esi, r8d
mov rbx, rdx
call qword [rax + 0x28]
mov r9, qword [rbx]
mov rcx, rbx
test eax, eax
movsxd rdi, eax
setns dl
call qword [r9 + 0xd0]
test al, al
je 0x1800d87fb
test esi, esi
js 0x1800d86c6
cmp edi, esi
je 0x1800d86c6
xor edx, edx
jmp 0x1800d86c8
mov dl, 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd0]
test al, al
je 0x1800d87fb
lea rcx, [rbp + 0x18]
mov edx, edi
call fcn.1800da140
mov rcx, qword [rbp + 0x20]
lea r8, [rdi*8]
xor edx, edx
mov rsi, rdi
call fcn.1801cf330
test edi, edi
jle 0x1800d8745
xor edi, edi
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test al, al
je 0x1800d8729
mov rax, qword [rbx]
mov edx, 2
mov rcx, rbx
call qword [rax + 0x88]
mov rcx, qword [rbp + 0x20]
mov qword [rcx + rdi*8], rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd8]
test al, al
je 0x1800d87fb
inc rdi
cmp rdi, rsi
jl 0x1800d8703
mov rax, qword [rbx]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [rax + 0x70]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd8]
test al, al
je 0x1800d87fb
movss xmm1, dword [rsp + 0x40]
movss xmm2, dword [rsp + 0x38]
comiss xmm1, xmm2
jb 0x1800d87ae
movss xmm0, dword [rsp + 0x44]
movss xmm3, dword [rsp + 0x3c]
comiss xmm0, xmm3
jb 0x1800d87ae
subss xmm1, xmm2
xorps xmm4, xmm4
mulss xmm1, xmm4
ucomiss xmm1, xmm1
jp 0x1800d87ae
jne 0x1800d87ae
subss xmm0, xmm3
mulss xmm0, xmm4
ucomiss xmm0, xmm0
jp 0x1800d87ae
jne 0x1800d87ae
mov dl, 1
jmp 0x1800d87b0
xor dl, dl
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd0]
test al, al
je 0x1800d87fb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbp], xmm0
mov dword [rbp + 0x10], eax
mov eax, dword [rbx + 0x24]
dec eax
movups xmmword [rsp + 0x20], xmm0
cmp eax, 0x26
ja 0x1800d87ed
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xd8]
jmp 0x1800d87fd
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801ccd40
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800fd830
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
mov rsi, rdx
call fcn.1801dfe68
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800fd8e9
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800fd8e9
cmp qword [rsp + 0x50], 0
jl 0x1800fd8e9
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x40], rdi
mov rcx, rbx
mov dword [rsp + 0x20], 0
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
je 0x1800fd8cb
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x1800fd8cb
mov rax, qword [rsp + 0x50]
mov qword [rsi], rax
jmp 0x1800fd8cd
xor edi, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rsi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rsi
ret
Function at 0x1801062c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
sub rsp, 0x60
cmp dword [rcx + 0x4c], 0
movzx r10d, r8b
mov rdi, rcx
jle 0x18010645e
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x50], rsi
test dl, dl
je 0x180106397
movzx eax, byte [rcx + 0x50]
lea rdx, [rcx + 0x24]
movss xmm0, dword [rcx + 4]
lea r9, [rcx + 0x3c]
movss xmm1, dword [rcx]
lea r8, [rcx + 0x2c]
mov byte [rsp + 0x40], r10b
mov byte [rsp + 0x38], al
movss dword [rsp + 0x30], xmm0
movss dword [rsp + 0x28], xmm1
mov qword [rsp + 0x20], rdx
lea rdx, [rcx + 0x68]
add rcx, 0x78
call qword [rdi + 0x60]
lea rcx, [rdi + 0x78]
call fcn.1800ac640
mov rax, qword [rdi + 0x68]
movsxd rcx, dword [rax + 0x3c]
test ecx, ecx
jle 0x18010635b
mov rax, qword [rax + 0x28]
movsd xmm0, qword [rax + rcx*8 - 8]
movaps xmm1, xmm0
movsd qword [rsp + 0x70], xmm0
movss xmm3, dword [rsp + 0x70]
shufps xmm1, xmm1, 0x55
jmp 0x18010636d
xorps xmm3, xmm3
xorps xmm1, xmm1
movss dword [rsp + 0x70], xmm3
movss dword [rsp + 0x74], xmm1
movaps xmm2, xmm1
lea rcx, [rdi + 0x78]
movaps xmm1, xmm3
call fcn.1800ac0a0
lea rdx, [rdi + 0x68]
lea rcx, [rdi + 0x78]
call fcn.1800adc50
lea rcx, [rdi + 0x78]
call fcn.1800ac640
jmp 0x180106454
mov rax, qword [rcx + 0x68]
lea rsi, [rcx + 0x68]
mov qword [rsp + 0x58], rbp
movsxd rcx, dword [rax + 0x3c]
test ecx, ecx
jle 0x1801063be
mov rax, qword [rax + 0x28]
movsd xmm0, qword [rax + rcx*8 - 8]
movsd qword [rsp + 0x70], xmm0
jmp 0x1801063c7
mov qword [rsp + 0x70], 0
xor ebp, ebp
lea r8, [rdi + 0x1c]
test r10b, r10b
lea rdx, [rdi + 0x3c]
mov rax, rsi
lea r9, [rsp + 0x70]
cmove rax, rbp
lea rcx, [rdi + 0x78]
mov qword [rsp + 0x20], rax
call qword [rdi + 0x58]
mov rdx, rsi
lea rcx, [rdi + 0x78]
call fcn.1800adc50
movss xmm0, dword [rdi + 0x14]
lea r9, [rdi + 0x44]
xorps xmm0, xmmword [0x18023b6f0]
lea rdx, [rdi + 0x34]
cmp byte [rdi + 0x50], bpl
lea r8, [rsp + 0x88]
movss dword [rsp + 0x88], xmm0
lea rcx, [rdi + 0x78]
movss xmm0, dword [rdi + 0x18]
cmove rsi, rbp
xorps xmm0, xmmword [0x18023b6f0]
movss dword [rsp + 0x8c], xmm0
mov qword [rsp + 0x20], rsi
call qword [rdi + 0x58]
lea rcx, [rdi + 0x78]
call fcn.1800ac640
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x50]
lea rcx, [rdi + 0x68]
call fcn.1800abb80
mov dword [rdi + 0x4c], 0xffffffff
add rsp, 0x60
pop rdi
ret
Function at 0x18010ea40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r14
sub rsp, 0x98
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov eax, dword [rcx + 0xa0]
lea r14, [rcx + 0x10]
mov rdx, qword [rcx]
mov rbx, rcx
mov r8d, dword [rcx + 0x9c]
mov r10d, dword [rcx + 0x98]
mov ecx, dword [rdx + 0x18]
lea r11d, [rax + r8]
lea r9d, [rax + r10]
mov eax, dword [rdx + 0x1c]
test ecx, ecx
jle 0x18010ec87
test eax, eax
jle 0x18010ec87
cmp r10d, r9d
jge 0x18010ec87
cmp r8d, r11d
jge 0x18010ec87
test r9d, r9d
jle 0x18010ec87
cmp r10d, ecx
jge 0x18010ec87
test r11d, r11d
jle 0x18010ec87
cmp r8d, eax
jge 0x18010ec87
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xc0], rsi
mov rsi, qword [rdx + 0x10]
mov qword [rsp + 0xc8], rdi
xor edi, edi
test r10d, r10d
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r13
mov r12d, r8d
mov r13, qword [rdx]
mov qword [rsp + 0x80], r15
mov r15d, r10d
cmovle r15d, edi
test r8d, r8d
cmovle r12d, edi
cmp ecx, r9d
cmovle r9d, ecx
cmp eax, r11d
cmovle r11d, eax
test r13, r13
je 0x18010eb52
movsxd rbp, dword [rdx + 0x20]
lea rcx, [0x180222578]
movsxd rax, r15d
movsxd rdi, r12d
imul rdi, rsi
movzx ecx, byte [rbp + rcx]
imul rax, rcx
add rax, r13
add rdi, rax
jmp 0x18010eb55
mov ebp, dword [rdx + 0x20]
mov eax, dword [rdx + 0x24]
sub r9d, r15d
mov ecx, dword [rdx + 0x28]
sub r11d, r12d
mov dword [rsp + 0x40], r9d
neg r10d
mov dword [rsp + 0x4c], eax
lea r9, [rbx + 0x40]
mov rax, qword [rdx + 8]
neg r8d
mov dword [rsp + 0x44], r11d
mov edx, r10d
mov qword [r14], rdi
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rsi
mov dword [rsp + 0x48], ebp
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14 + 0x18], xmm0
mov dword [r14 + 0x28], ecx
mov rcx, qword [rbx + 8]
call fcn.1800e3050
mov r9d, dword [rbx + 0xa0]
xor eax, eax
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x3c], r9d
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
cmp byte [rbx + 0x71], al
je 0x18010ec56
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x60]
mov r8, qword [rsp + 0x30]
mov rdi, 0xffffffffffffffff
shr rax, 0x20
xor edx, edx
shr r8, 0x20
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x70], rdi
call fcn.1800bfe20
lea r9, [rbx + 0x40]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x60]
lea rcx, [rbx + 0x40]
call fcn.1800c08c0
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18010ec6a
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x18010ec6a
mov rcx, qword [rsp + 0x70]
call fcn.1801d1bcc
jmp 0x18010ec6a
lea rcx, [rbx + 0x58]
mov r8d, 1
lea rdx, [rsp + 0x40]
call fcn.1800e59a0
mov dl, 1
lea rcx, [rbx + 0x40]
call fcn.1800e21b0
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
jmp 0x18010ec90
lea rcx, [rbx + 0x40]
call fcn.1800e2400
lea rax, [rbx + 0x40]
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x80], rax
cmp byte [rax + 0x32], 0
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1801ccd40
add rsp, 0x98
pop r14
pop rbx
ret
Function at 0x180127900
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11d, r8d
mov rbx, rcx
sar r11d, 3
mov edi, 0x7e0
sub rbx, rdx
nop dword [rax]
movzx eax, word [rdx]
dec r9d
movzx r10d, word [rbx + rdx]
lea rdx, [rdx + 2]
mov r8d, eax
mov ecx, r10d
and ecx, edi
and r8d, edi
shl ecx, 0x10
or ecx, r10d
shl r8d, 0x10
or r8d, eax
and ecx, 0xfffff81f
and r8d, 0xfffff81f
sub ecx, r8d
imul ecx, r11d
shr ecx, 5
add ecx, r8d
mov eax, ecx
shr eax, 0x10
xor ax, cx
and ax, di
xor ax, cx
mov word [rdx - 2], ax
test r9d, r9d
jg 0x180127920
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x180157300
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov esi, dword [reloc.gdiplus.dll_Ordinal_1]
xor r10d, r10d
movaps xmmword [rax - 0x28], xmm6
mov r11, rcx
movaps xmmword [rax - 0x38], xmm7
mov r14, r8
movsd xmm7, qword [0x18023b6d0]
mov rbp, rdx
movaps xmmword [rax - 0x48], xmm8
lea r15d, [r10 + 2]
movsd xmm8, qword [0x18023ae60]
lea r12d, [r10 + 4]
movaps xmmword [rax - 0x58], xmm9
mov dil, 1
movaps xmmword [rax - 0x68], xmm10
mov rbx, rcx
movaps xmmword [rax - 0x78], xmm11
movq xmm10, r11
movsd xmm11, qword [0x18023aeb0]
xorps xmm9, xmm9
movaps xmmword [rsp + 0x10], xmm12
movdqa xmm12, xmmword [0x18023b7b0]
punpcklqdq xmm10, xmm10
nop dword [rax]
nop word [rax + rax]
movd xmm1, r10d
mov r8d, 1
pshufd xmm1, xmm1, 0
cmp esi, r15d
jl 0x18015740a
movdqa xmm3, xmmword [0x18023b3c0]
movq xmm0, xmm1
paddd xmm3, xmmword [0x18023b390]
movq xmm1, xmm1
pxor xmm3, xmm0
movd xmm0, r15d
psubd xmm3, xmm1
movdqa xmm1, xmm3
psrad xmm1, xmm0
pmovsxdq xmm0, xmm3
pandn xmm1, xmm12
pmovsxdq xmm2, xmm1
pand xmm2, xmm0
movd xmm0, r12d
psllq xmm2, xmm0
paddq xmm2, xmm10
movdqu xmmword [rsp], xmm2
jmp 0x180157441
lea r9, [rsp]
nop
mov edx, r8d
lea r9, [r9 + 8]
xor edx, r10d
inc r8d
sub edx, r10d
mov eax, edx
sar eax, 2
not eax
movsxd rcx, eax
movsxd rax, edx
and rcx, rax
shl rcx, 4
add rcx, r11
mov qword [r9 - 8], rcx
cmp r8d, 3
jl 0x180157410
mov rax, qword [rsp]
movsd xmm2, qword [rbx + 8]
movsd xmm0, qword [rbx]
movsd xmm5, qword [rax]
movsd xmm6, qword [rax + 8]
subsd xmm0, xmm5
mov rax, qword [rsp + 8]
subsd xmm2, xmm6
movsd xmm3, qword [rax]
movsd xmm4, qword [rax + 8]
subsd xmm3, xmm5
subsd xmm4, xmm6
mulsd xmm2, xmm3
mulsd xmm0, xmm4
subsd xmm2, xmm0
movaps xmm0, xmm2
andps xmm0, xmm7
comisd xmm11, xmm0
ja 0x1801574e6
xor dil, dil
mov rax, rbp
xor ecx, ecx
nop word [rax + rax]
movsd xmm1, qword [rax + 8]
movsd xmm0, qword [rax]
subsd xmm1, xmm6
subsd xmm0, xmm5
mulsd xmm1, xmm3
mulsd xmm0, xmm4
subsd xmm1, xmm0
movaps xmm0, xmm1
mulsd xmm0, xmm2
comisd xmm0, xmm9
jbe 0x1801574d5
andps xmm1, xmm7
comisd xmm8, xmm1
jbe 0x1801574e6
inc rcx
add rax, 0x10
cmp rcx, 3
jl 0x1801574a0
xor al, al
jmp 0x1801574fc
inc r10d
add rbx, 0x10
cmp r10d, 3
jl 0x1801573a0
mov byte [r14], dil
mov al, 1
movaps xmm6, xmmword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm7, xmmword [rsp + 0x60]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180157550
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [reloc.gdiplus.dll_Ordinal_1], 2
mov r10d, edx
mov r11, rcx
mov r9, r8
mov eax, 1
movd xmm1, r10d
movq xmm4, r11
pshufd xmm1, xmm1, 0
punpcklqdq xmm4, xmm4
jl 0x1801575e0
movdqa xmm3, xmmword [0x18023b3c0]
movq xmm0, xmm1
paddd xmm3, xmmword [0x18023b390]
movq xmm1, xmm1
pxor xmm3, xmm0
mov eax, 2
psubd xmm3, xmm1
movdqa xmm1, xmm3
movd xmm0, eax
mov eax, 4
psrad xmm1, xmm0
pmovsxdq xmm0, xmm3
pandn xmm1, xmmword [0x18023b7b0]
pmovsxdq xmm2, xmm1
pand xmm2, xmm0
movd xmm0, eax
psllq xmm2, xmm0
paddq xmm2, xmm4
movdqu xmmword [r8], xmm2
ret
mov r8d, eax
lea r9, [r9 + 8]
xor r8d, r10d
inc eax
sub r8d, r10d
mov ecx, r8d
sar ecx, 2
not ecx
movsxd rdx, ecx
movsxd rcx, r8d
and rdx, rcx
shl rdx, 4
add rdx, r11
mov qword [r9 - 8], rdx
cmp eax, 3
jl 0x1801575e0
ret

Function at 0x180159350
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x18029d6e8], 0
jne 0x1801593d1
mov eax, 0xffffffff
lock xadd dword [0x18028f608], eax
test eax, eax
jg 0x180159388
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39d0
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x18029d6e8], 0
jne 0x1801593a4
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18029d568], eax
mov byte [0x18029d6e8], 1
mov eax, 1
lock xadd dword [0x18028f608], eax
test eax, eax
jns 0x1801593d1
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39d0
xor r8d, r8d
mov rcx, qword [rax]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, dword [0x18029d568]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x18017e230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov r14, rdx
mov rsi, rcx
mov eax, 0xffffffff
lock xadd dword [0x18028f5e0], eax
test eax, eax
jg 0x18017e26a
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39d0
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.180104040
cmp qword [rax + 0x18], 0
mov rbx, qword [rax + 0x38]
jne 0x18017e28d
mov rax, qword [rax + 0x30]
test rbx, rbx
je 0x18017e28a
cmp rbx, rax
cmovb rax, rbx
mov rbx, rax
mov eax, 1
lock xadd dword [0x18028f5e0], eax
test eax, eax
jns 0x18017e2ba
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39d0
xor r8d, r8d
mov rcx, qword [rax]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test rbx, rbx
jne 0x18017e2ca
mov al, 1
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rcx, qword [rsi + 0x48]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
xor edi, edi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r15
lea ebp, [rdi + 5]
test rcx, rcx
je 0x18017e303
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x48]
mov eax, ebp
mov edx, dword [rcx + 0x10]
jmp 0x18017e317
movups xmm0, xmmword [rsi + 0x28]
mov rcx, rdi
movups xmmword [rsp + 0x34], xmm0
mov eax, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x34]
cdqe
lea r12, [0x180222578]
movzx r15d, byte [rax + r12]
movsxd rax, edx
imul r15, rax
test rcx, rcx
je 0x18017e34b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rsi + 0x48]
mov edx, dword [rax + 0x10]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], edx
jmp 0x18017e35c
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rsp + 0x20], xmm0
mov ebp, dword [rsp + 0x28]
mov edx, dword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
shr r8, 0x20
test r8d, r8d
jne 0x18017e36f
mov rdx, rdi
jmp 0x18017e38b
movsxd rax, ebp
movzx ecx, byte [rax + r12]
lea eax, [r8 - 1]
imul ecx, edx
movsxd rdx, ecx
movsxd rcx, eax
imul rcx, r15
add rdx, rcx
movss xmm2, dword [0x18023b20c]
xorps xmm1, xmm1
mov r15, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
movsxd rax, edx
cmp rax, rdx
cmove rdi, rax
test rdi, rdi
cvtsi2ss xmm1, rdi
mov rdi, qword [rsp + 0x78]
jns 0x18017e3c8
addss xmm1, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, rbx
test rbx, rbx
jns 0x18017e3d9
addss xmm0, xmm2
mulss xmm0, dword [r14]
mulss xmm0, dword [r14 + 0x10]
comiss xmm0, xmm1
seta al
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
Function at 0x1801e3e34
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1801e3cd4
call fcn.1801d1bac
mov dword [rax], 0x16
call fcn.1801d1a5c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1801e3cbc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1801e3cbc
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1801e3d06
lock or dword [rax + 0x14], 0x10
jmp 0x1801e3cbc
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1801e3d23
mov rcx, qword [rbp + 0x10]
call fcn.1801e579c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1801dfee0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1801e370c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1801e3d7a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1801e3cbc
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1801e3de6
mov rcx, qword [rbp + 0x10]
call fcn.1801dfee0
cmp eax, 0xffffffff
je 0x1801e3dcd
mov rcx, qword [rbp + 0x10]
call fcn.1801dfee0
cmp eax, 0xfffffffe
je 0x1801e3dcd
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1801dfee0
movsxd rdi, eax
lea rsi, [0x180295c10]
mov rcx, rbx
sar rdi, 6
call fcn.1801dfee0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1801e3dd4
lea rax, [0x18028e410]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1801e3de6
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1801e3e1c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1801e3e18
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1801e3e18
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1801e3cbf
jmp 0x1801e3c8c
Function at 0x140014f80
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x14006a100]
xor rax, rsp
mov qword [rbp + 0x20], rax
movabs rax, 0x125b5336430b1b02
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movabs rcx, 0xe2c61810545522d0
mov qword [rbp - 0x68], rcx
movabs rax, 0x44744c984f333273
mov qword [rsp + 0x48], rax
movabs rdi, 0x51071e7317584251
movdqa xmm0, xmmword [rsp + 0x40]
movabs rax, 0x6c158c61372f2905
mov qword [rsp + 0x50], rax
movabs rbx, 0x2b3738f62a414006
movabs rax, 0x77b7262c95b3bed4
mov qword [rbp + 0x18], rcx
mov qword [rsp + 0x58], rax
mov r9d, 2
movdqa xmm1, xmmword [rsp + 0x50]
movabs rax, 0xf53d86464845d499
mov qword [rsp + 0x60], rax
xor r8d, r8d
movabs rax, 0x13034faeeb0adf3f
mov qword [rbp - 0x40], rdi
mov qword [rsp + 0x68], rax
mov rcx, 0xffffffff80000002
movabs rax, 0xff7fe576246329f1
mov qword [rbp - 0x38], rbx
xorps xmm0, xmmword [rbp - 0x40]
mov qword [rsp + 0x70], rax
movabs rax, 0x4e1ab4a25de9ff35
mov qword [rsp + 0x78], rax
movabs rax, 0x8d101fc477342e4b
mov qword [rbp - 0x80], rax
movabs rax, 0x63a3cf8b3bdec32a
mov qword [rbp - 0x78], rax
movabs rax, 0x94e20a516f35af76
mov qword [rbp - 0x70], rax
movabs rax, 0x1870df0d585d5d6b
mov qword [rbp - 0x30], rax
movabs rax, 0x1bd85458fbdcfd88
mov qword [rbp - 0x28], rax
movabs rax, 0xb258e52f3e2090c5
xorps xmm1, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movabs rax, 0x76601cf28f78be4a
mov qword [rbp - 0x18], rax
movabs rax, 0xb72396194d11489f
mov qword [rbp - 0x10], rax
movabs rax, 0x2169ddd42f8c8f4c
mov qword [rbp - 8], rax
movabs rax, 0xe8736dab115a6b39
mov qword [rbp], rax
movabs rax, 0x17cd86ee5fb1804e
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x10]
mov qword [rbp + 8], rax
movabs rax, 0x94e273250647c813
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [rbp - 0x70]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x60]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400151d9
mov rcx, qword [rbp - 0x60]
lea rdx, [rsp + 0x30]
mov dword [rbp - 0x58], eax
mov r9d, 4
mov qword [rsp + 0x38], rbx
movabs rax, 0x51637b1f75392c14
mov qword [rsp + 0x30], rax
xor r8d, r8d
movdqa xmm0, xmmword [rsp + 0x30]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rbx
xorps xmm0, xmmword [rbp - 0x50]
mov dword [rsp + 0x28], 4
movdqa xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14002a850
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret