joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18014d500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rbx, rdx
mov rdi, rcx
mov byte [rcx + 0x1be], 0
lea rdx, [rsp + 0x38]
add rcx, 0xffffffffffffff28
call fcn.180173f30
mov r8b, 1
mov rdx, rax
lea rcx, [rdi - 0xd8]
call fcn.18016cd80
cmp dword [rbx + 0x10], 0
jbe 0x18014d554
mov rdx, qword [rbx]
jmp 0x18014d55b
lea rdx, [0x180416eb8]
lea rcx, [rsp + 0x70]
call fcn.1800e7430
nop
lea rbp, [0x1802bccb0]
mov rbx, qword [rsp + 0x70]
cmp byte [rbx], 0
je 0x18014d600
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18014d5fb
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, 1
test al, 0x10
je 0x18014d5c2
cmp eax, 0xffffffff
je 0x18014d5c2
mov eax, ecx
jmp 0x18014d5c4
xor eax, eax
cmp al, byte [rdi + 0x1bc]
jne 0x18014d5fb
mov rbx, qword [rsp + 0x70]
mov qword [rsp + 0x78], rbx
lea rax, [rbx - 0x10]
cmp rax, rbp
je 0x18014d5e8
lock xadd dword [rax], ecx
mov rbx, qword [rsp + 0x70]
lea rdx, [rsp + 0x78]
lea rcx, [rdi - 0xd8]
call fcn.18014d1b0
jmp 0x18014d600
mov rbx, qword [rsp + 0x70]
lea rcx, [rbx - 0x10]
cmp rcx, rbp
je 0x18014d61c
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x18014d61c
call fcn.1800a0c6c
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x18014efa0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 0xc8]
call fcn.180151ec0
mov r8, qword [rbx + 8]
movzx ecx, byte [r8 + 0x191]
movzx edx, cl
shr dl, 4
and dl, 1
cmp dl, al
jne 0x18014f01a
test al, al
sete al
shl al, 4
xor al, cl
and al, 0x10
xor al, cl
mov byte [r8 + 0x191], al
mov rax, qword [r8 + 0xe8]
test rax, rax
je 0x18014f00e
test byte [rax + 0xc1], 0x10
jne 0x18014f01a
mov rcx, qword [rax + 0x18]
test rcx, rcx
je 0x18014f00e
call fcn.1801699f0
test al, al
je 0x18014f01a
lea rcx, [r8 + 0xd0]
call fcn.180169920
mov rax, qword [rbx + 8]
mov rdx, qword [rax + 0xc8]
mov eax, dword [rdx + 0x128]
shr eax, 1
test al, 1
je 0x18014f058
lea rcx, [rsp + 0x30]
add rdx, 0x130
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x18014f058
cmp eax, 0xffffffff
je 0x18014f058
mov dl, 1
jmp 0x18014f05a
xor edx, edx
mov rcx, qword [rbx + 8]
add rcx, 0x3c0
mov rax, qword [rcx]
add rsp, 0x20
pop rbx
jmp qword [rax + 0x50]
Function at 0x180150d50
Capabilities:
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rbp, rdx
mov rsi, rcx
lea rcx, [rsp + 0x60]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x180150dd2
cmp eax, 0xffffffff
je 0x180150dd2
lea rcx, [rsi - 0xc8]
mov rdx, rbp
call fcn.180151830
mov eax, dword [rsi + 0x60]
test al, 8
je 0x180150e65
bt eax, 8
jb 0x180150e65
lea rax, [0x1802bccc0]
mov qword [rsp + 0x58], rax
lea rcx, [rsi + 0x230]
mov r8b, 1
lea rdx, [rsp + 0x58]
call fcn.1801107f0
nop
jmp 0x180150e65
lea rdx, [rsi - 0xc8]
test rdx, rdx
je 0x180150def
lea rcx, [rdx + 0xb8]
call fcn.180025030
mov rdi, rax
jmp 0x180150df1
xor edi, edi
mov qword [rsp + 0x68], rdi
test rdi, rdi
je 0x180150e05
mov eax, 1
lock xadd dword [rdi + 8], eax
mov ebx, dword [rsi + 0x98]
nop dword [rax + rax]
test rdi, rdi
je 0x180150e4d
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x180150e4d
test ebx, ebx
jle 0x180150e4d
mov eax, dword [rsi + 0x98]
dec ebx
cmp ebx, eax
jl 0x180150e35
lea ebx, [rax - 1]
test ebx, ebx
js 0x180150e4d
movsxd rax, ebx
mov rcx, qword [rsi + 0x88]
mov rdx, rbp
mov rcx, qword [rcx + rax*8]
call fcn.180054d6c
jmp 0x180150e10
test rdi, rdi
je 0x180150e65
lock dec dword [rdi + 8]
jne 0x180150e65
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x180151ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [rsp + 0x30]
xor r8d, r8d
mov rbx, rcx
call fcn.180151f80
mov ecx, dword [rbx + 0x128]
mov eax, ecx
shr eax, 1
test al, 1
je 0x180151f0e
test cl, 8
jne 0x180151f0a
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x180151f0a
cmp eax, 0xffffffff
jne 0x180151f39
mov bl, 1
jmp 0x180151f3b
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
je 0x180151f39
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180151f39
mov bl, 1
jmp 0x180151f3b
xor bl, bl
mov rcx, qword [rsp + 0x30]
lea rax, [0x1802bccb0]
add rcx, 0xfffffffffffffff0
cmp rcx, rax
je 0x180151f63
or edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x180151f63
call fcn.1800a0c6c
movzx eax, bl
add rsp, 0x20
pop rbx
ret
Function at 0x1801533f0
Capabilities:
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x80], ebx
call fcn.180153540
lea rdx, [rdi + 0x48]
lea rcx, [rsp + 0x98]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x180153528
cmp eax, 0xffffffff
je 0x180153528
lea ecx, [rbx + 0x50]
call fcn.1800a103c
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1801534a4
lea rax, [0x1802c1654]
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x88]
call fcn.18001a440
nop
mov ebx, 1
mov dword [rsp + 0x80], ebx
mov eax, dword [rdi + 0x60]
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, [rdi + 0x48]
mov rcx, rsi
call fcn.1800e8280
jmp 0x1801534a7
mov rax, rbx
mov rsi, qword [rdi + 0xa8]
cmp rsi, rax
je 0x1801534d0
mov qword [rdi + 0xa8], rax
test rsi, rsi
je 0x1801534d0
mov rcx, rsi
call fcn.1800e8170
mov rcx, rsi
call fcn.1800a0ca0
nop
test bl, 1
je 0x180153514
and ebx, 0xfffffffe
mov dword [rsp + 0x80], ebx
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rax - 0x10]
lea rax, [0x1802bccb0]
cmp rcx, rax
je 0x180153514
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x180153514
call fcn.1800a0c6c
mov byte [rdi + 0xb0], 0
lea rdx, [rdi + 0x38]
mov rcx, qword [rdi + 0x58]
call fcn.1800d1840
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180153a10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rbp, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x48
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x180153af7
lea rcx, [rsp + 0x60]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180153af7
xor edi, edi
mov dword [rsp + 0x20], edi
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rsi
call fcn.18028d040
test rax, rax
je 0x180153a91
lea rcx, [rax + 0xb8]
mov rdx, rax
call fcn.180025030
mov rdi, rax
mov qword [rsp + 0x70], rdi
test rdi, rdi
je 0x180153aa5
mov eax, 1
lock xadd dword [rdi + 8], eax
mov ebx, dword [rsi + 0x20]
test rdi, rdi
je 0x180153adf
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x180153adf
test ebx, ebx
jle 0x180153adf
mov eax, dword [rsi + 0x20]
dec ebx
cmp ebx, eax
jl 0x180153aca
lea ebx, [rax - 1]
test ebx, ebx
js 0x180153adf
movsxd rax, ebx
mov rcx, qword [rsi + 0x10]
mov rdx, rbp
mov rcx, qword [rcx + rax*8]
call fcn.180054d6c
jmp 0x180153aa8
test rdi, rdi
je 0x180153af7
lock dec dword [rdi + 8]
jne 0x180153af7
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180153b10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rdx + 0x10]
mov rdi, rdx
mov edx, dword [rcx + 0x118]
mov rbx, rcx
mov rcx, qword [rcx + 0xe8]
lea r8, [rsp + 0x30]
mov r9b, 1
mov dword [rsp + 0x30], eax
call fcn.180115b40
mov rcx, qword [rbx + 0xe8]
lea rdx, [rbx + 0xf8]
add rcx, 0x128
mov r8, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x180153b10
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x48
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x180153c03
lea rcx, [rsp + 0x60]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180153c03
xor edi, edi
mov dword [rsp + 0x20], edi
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rsi
call fcn.18028d040
test rax, rax
je 0x180153b9a
lea rcx, [rax + 0xb8]
mov rdx, rax
call fcn.180025030
mov rdi, rax
mov qword [rsp + 0x78], rdi
test rdi, rdi
je 0x180153bae
mov eax, 1
lock xadd dword [rdi + 8], eax
mov ebx, dword [rsi + 0x20]
test rdi, rdi
je 0x180153beb
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x180153beb
test ebx, ebx
jle 0x180153beb
mov eax, dword [rsi + 0x20]
dec ebx
cmp ebx, eax
jl 0x180153bd3
lea ebx, [rax - 1]
test ebx, ebx
js 0x180153beb
movsxd rax, ebx
mov rcx, qword [rsi + 0x10]
mov r8, rbp
mov rdx, r14
mov rcx, qword [rcx + rax*8]
call fcn.180054704
jmp 0x180153bb1
test rdi, rdi
je 0x180153c03
lock dec dword [rdi + 8]
jne 0x180153c03
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1801625e0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, rcx
call fcn.18016ea20
test al, al
je 0x1801626d1
mov rcx, rbp
call fcn.1801735a0
test al, al
jne 0x1801626d1
mov eax, dword [rbp + 0xe8]
dec eax
movsxd rbx, eax
js 0x1801626d1
lea rdi, [rbx + rbx*2]
shl rdi, 2
nop word [rax + rax]
mov rsi, qword [rbp + 0xd8]
mov ecx, dword [rsi + rdi]
bt ecx, 0x10
jb 0x1801626a6
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x18016265d
sub cx, 0x20
movdqa xmm0, xmmword [0x180393ad0]
movdqa xmm1, xmmword [0x180393ae0]
mov dword [rsp + 0x40], 0xdb005b
mov dword [rsp + 0x44], 0xdd005d
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
movdqu xmmword [rsp + 0x30], xmm1
nop dword [rax + rax]
cmp cx, word [rsp + rax*2 + 0x20]
jne 0x18016269c
movzx ecx, word [rsp + rax*2 + 0x22]
add rax, 2
cmp rax, 0x14
jl 0x180162690
movsx ecx, cx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x1801626c4
mov eax, dword [rsi + rdi + 4]
xor eax, dword [0x1804235cc]
test al, 7
je 0x1801626f1
sub rdi, 0xc
dec rbx
jns 0x180162640
xor al, al
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov al, 1
jmp 0x1801626d3
Function at 0x18016fa00
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov ebx, r9d
mov rsi, r8
mov rdi, rcx
mov r8b, 1
call fcn.1800febb0
nop
lea rax, vtable.juce::AlertWindow.0
mov qword [rdi], rax
lea rax, vtable.juce::AlertWindow.1.0
mov qword [rdi + 0xd8], rax
lea rax, [0x1802bccc0]
mov qword [rdi + 0xe0], rax
xor ecx, ecx
mov qword [rdi + 0xe8], rcx
mov dword [rdi + 0xf0], ecx
mov dword [rdi + 0xf8], ecx
mov qword [rdi + 0x100], rcx
mov dword [rdi + 0x108], 9
mov dword [rdi + 0x110], ebx
lea rax, vtable.juce::ComponentBoundsConstrainer.0
mov qword [rdi + 0x118], rax
mov dword [rdi + 0x120], ecx
mov qword [rdi + 0x124], 0x3fffffff
mov qword [rdi + 0x12c], 0x3fffffff
mov qword [rdi + 0x134], rcx
mov dword [rdi + 0x13c], ecx
mov qword [rdi + 0x140], rcx
lea rax, vtable.juce::ComponentDragger.0
mov qword [rdi + 0x148], rax
mov qword [rdi + 0x150], rcx
mov qword [rdi + 0x158], rcx
mov qword [rdi + 0x160], rcx
mov qword [rdi + 0x168], rcx
mov dword [rdi + 0x170], ecx
mov dword [rdi + 0x178], ecx
mov qword [rdi + 0x180], rcx
mov dword [rdi + 0x188], ecx
mov dword [rdi + 0x190], ecx
mov qword [rdi + 0x198], rcx
mov dword [rdi + 0x1a0], ecx
mov dword [rdi + 0x1a8], ecx
mov qword [rdi + 0x1b0], rcx
mov dword [rdi + 0x1b8], ecx
mov dword [rdi + 0x1c0], ecx
mov qword [rdi + 0x1c8], rcx
mov dword [rdi + 0x1d0], ecx
mov dword [rdi + 0x1d8], ecx
mov qword [rdi + 0x1e0], rcx
mov dword [rdi + 0x1e8], ecx
mov dword [rdi + 0x1f0], ecx
mov qword [rdi + 0x1f8], rcx
mov dword [rdi + 0x200], ecx
mov dword [rdi + 0x208], ecx
mov qword [rdi + 0x210], rcx
mov dword [rdi + 0x218], ecx
mov dword [rdi + 0x220], ecx
mov qword [rdi + 0x228], rcx
mov dword [rdi + 0x230], ecx
mov dword [rdi + 0x238], ecx
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x240], rax
mov byte [rdi + 0x248], 1
mov byte [rsp + 0x68], cl
lea rdx, [rsp + 0x68]
lea rcx, [0x1800f9190]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx edx, byte [rsp + 0x68]
mov rcx, rdi
call fcn.180171b70
mov rax, qword [rsi]
cmp byte [rax], 0
jne 0x18016fc14
lea rax, [0x1802c1e5c]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.18001a440
mov rax, qword [rdi + 0xe0]
mov rcx, qword [rsp + 0x60]
mov qword [rdi + 0xe0], rcx
lea rcx, [rax - 0x10]
lea rax, [0x1802bccb0]
cmp rcx, rax
je 0x18016fc14
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x18016fc14
call fcn.1800a0c6c
mov rdx, rsi
mov rcx, rdi
call fcn.18016f670
mov rcx, rdi
call fcn.180104cb0
mov dword [rdi + 0x130], 0x10000
mov dword [rdi + 0x134], 0x10000
mov dword [rdi + 0x138], 0x10000
mov dword [rdi + 0x13c], 0x10000
mov rax, rdi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x180187cf0
Capabilities:
Open clipboard

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0xe0]
mov rdi, rcx
lea rcx, [0x1802bccc0]
mov byte [rdx + 0xb0], 1
xchg qword [rdx + 0x98], rcx
lea rsi, [0x1802bccb0]
add rcx, 0xfffffffffffffff0
or ebx, 0xffffffff
cmp rcx, rsi
je 0x180187d42
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x180187d42
call fcn.1800a0c6c
mov rcx, qword [rdi + 0x468]
mov edx, 0x258
call fcn.1800bd4e0
mov rcx, qword [rdi + 0xe0]
lea r9, [rdi + 0x150]
lea r8, [rdi + 0x138]
lea rdx, [rsp + 0x30]
call fcn.18018bce0
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
je 0x180187d92
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180187d92
lea rcx, [rsp + 0x30]
call fcn.1800f8e90
mov rax, qword [rsp + 0x30]
lea rcx, [rax - 0x10]
cmp rcx, rsi
je 0x180187db1
lock xadd dword [rcx], ebx
lea eax, [rbx - 1]
cmp eax, 0xffffffff
jne 0x180187db1
call fcn.1800a0c6c
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x18018f1f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x50
cmp dword [rcx + 0x10], 0
movaps xmmword [rsp + 0x40], xmm6
mov ebp, r8d
movaps xmm6, xmm3
movsxd r14, edx
mov rsi, rcx
jle 0x18018f3a4
test r8d, r8d
jle 0x18018f3a4
mov r9d, r8d
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsp + 0x98]
test byte [rbx], 0x44
lea rdx, [rsp + 0x30]
mov r8d, r14d
sete al
mov byte [rsp + 0x20], al
call fcn.18018f3c0
mov ecx, dword [rbx]
movss xmm2, dword [0x180393198]
movss xmm4, dword [rsp + 0x88]
mov eax, ecx
shr eax, 6
test al, 1
jne 0x18018f284
mov eax, ecx
shr eax, 2
test al, 1
je 0x18018f29e
movaps xmm0, xmm4
subss xmm0, dword [rsp + 0x38]
mulss xmm0, xmm2
addss xmm0, xmm6
movaps xmm6, xmm0
subss xmm6, dword [rsp + 0x30]
mov eax, ecx
shr eax, 3
test al, 1
je 0x18018f2bc
movss xmm1, dword [rsp + 0x80]
jmp 0x18018f304
mov eax, ecx
shr eax, 1
test al, 1
je 0x18018f284
movss xmm0, dword [rsp + 0x30]
addss xmm6, xmm4
addss xmm0, dword [rsp + 0x38]
subss xmm6, xmm0
jmp 0x18018f28a
shr ecx, 4
test cl, 1
je 0x18018f2e8
movss xmm1, dword [rsp + 0x80]
movss xmm0, dword [rsp + 0x34]
addss xmm1, dword [rsp + 0x90]
addss xmm0, dword [rsp + 0x3c]
subss xmm1, xmm0
jmp 0x18018f30a
movss xmm1, dword [rsp + 0x90]
subss xmm1, dword [rsp + 0x3c]
mulss xmm1, xmm2
addss xmm1, dword [rsp + 0x80]
subss xmm1, dword [rsp + 0x34]
movaps xmm3, xmm6
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
movss dword [rsp + 0x20], xmm1
call fcn.18018f8e0
mov eax, dword [rbx]
shr eax, 6
test al, 1
je 0x18018f39f
mov rax, qword [rsi]
mov qword [rsp + 0x68], rdi
xor ecx, ecx
mov rdi, r14
mov ebx, ecx
shl rdi, 5
movss xmm0, dword [rdi + rax + 0x14]
test ebp, ebp
jle 0x18018f39a
nop word [rax + rax]
mov rax, qword [rsi]
movss xmm2, dword [rdi + rax + 0x14]
ucomiss xmm2, xmm0
je 0x18018f378
mov r8d, ebx
lea edx, [rcx + r14]
movaps xmm3, xmm4
sub r8d, ecx
mov rcx, rsi
call fcn.18018f000
mov ecx, ebx
movaps xmm0, xmm2
inc ebx
add rdi, 0x20
cmp ebx, ebp
jl 0x18018f350
cmp ebx, ecx
jle 0x18018f39a
sub ebx, ecx
lea edx, [rcx + r14]
movaps xmm3, xmm4
mov r8d, ebx
mov rcx, rsi
call fcn.18018f000
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
ret
Function at 0x1801afca0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x30
cmp dword [rcx + 0x64], 1
mov r13, qword [rcx + 0x250]
mov rdi, rcx
jne 0x1801afccc
mov ebx, 0x1fe
mov byte [r13 + 0x38], 1
jmp 0x1801afcd2
xor ebx, ebx
mov byte [r13 + 0x38], bl
mov rax, qword [rcx + 8]
mov r9d, dword [rcx + 0x7c]
lea r8d, [rbx + 0x100]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov ebp, dword [r13 + 0x28]
xor r15d, r15d
mov qword [r13 + 0x30], rax
cmp dword [rdi + 0x7c], r15d
jle 0x1801afe22
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], r12
movsxd rcx, ebx
mov qword [rsp + 0x20], r14
lea r12, [r13 + 0x3c]
mov qword [rsp + 0x68], rcx
xor r14d, r14d
nop dword [rax]
mov esi, dword [r12]
mov eax, ebp
cdq
idiv esi
mov ebp, eax
test rcx, rcx
je 0x1801afd3c
mov rax, qword [r13 + 0x30]
add qword [rax + r14], 0xff
mov rax, qword [r13 + 0x30]
lea ecx, [rsi - 1]
xor r8d, r8d
mov rdi, qword [r14 + rax]
lea eax, [rcx + 0xff]
add ecx, ecx
cdq
xor r10d, r10d
idiv ecx
xor ebx, ebx
mov r9d, eax
nop dword [rax]
cmp r10d, r9d
jle 0x1801afd97
imul eax, r8d, 0x1fe
lea ecx, [rsi + 0xfe]
lea r11d, [rsi*2 - 2]
add ecx, eax
nop dword [rax]
add ecx, 0x1fe
inc r8d
mov eax, ecx
cdq
idiv r11d
mov r9d, eax
cmp r10d, eax
jg 0x1801afd80
movzx eax, r8b
inc rbx
inc r10d
imul bpl
mov byte [rbx + rdi - 1], al
cmp rbx, 0xff
jle 0x1801afd60
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1801afdf9
mov ecx, 1
lea rdx, [rdi - 1]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdi]
inc rcx
lea rdx, [rdx - 1]
mov byte [rdx + 1], al
movzx eax, byte [rdi + 0xff]
mov byte [rdi + rcx + 0xfe], al
cmp rcx, 0xff
jle 0x1801afdd0
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
inc r15d
add r12, 4
add r14, 8
cmp r15d, dword [rax + 0x7c]
jl 0x1801afd20
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x1801b0200
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov qword [rcx + 8], rsi
mov ecx, 0x98
mov dword [rsp + 0x38], esi
call fcn.1800a0a4c
mov rbx, rax
test rax, rax
jne 0x1801b0246
mov rdx, qword [rdi]
mov dword [rdx + 0x28], 0x36
mov rcx, qword [rdi]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov dword [rbx + 0x5c], 0x3b9aca00
lea rax, [fcn.1801b1240]
lea rcx, str.JPEGMEM
mov qword [rbx], rax
lea rax, [fcn.1801b1140]
mov qword [rbx + 8], rax
lea rax, [fcn.1801b1060]
mov qword [rbx + 0x10], rax
lea rax, [fcn.1801b0f70]
mov qword [rbx + 0x18], rax
lea rax, [0x1801b0ec0]
mov qword [rbx + 0x20], rax
lea rax, [0x1801b0e10]
mov qword [rbx + 0x28], rax
lea rax, [0x1801b0c60]
mov qword [rbx + 0x30], rax
lea rax, [0x1801b0880]
mov qword [rbx + 0x38], rax
lea rax, [0x1801b0610]
mov qword [rbx + 0x40], rax
lea rax, [0x1801b04d0]
mov qword [rbx + 0x48], rax
lea rax, [0x1801b0370]
mov qword [rbx + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x58], eax
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x78], rsi
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
mov dword [rbx + 0x90], 0x98
mov qword [rdi + 8], rbx
call fcn.1800a6274
test rax, rax
je 0x1801b034d
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call fcn.1800a5484
test eax, eax
jle 0x1801b034d
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x1801b0340
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x1801b0344
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rbx + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1801bcfd0
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x1801bcffe
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x1801bd0ad
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x1801bd07d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1801bd04f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x208]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x1801bd0d5
cmp eax, dword [rbx + 0x78]
jb 0x1801bd030
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], bpl
jne 0x1801bd020
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x1801bd0c0
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x1801bd145
mov rax, qword [rcx + 8]
mov edx, 1
lea r8d, [rdx + 0x2f]
call qword [rax]
lea rcx, [0x1801b6310]
mov qword [rbx + 0x200], rax
mov qword [rax], rcx
lea rcx, [0x1801b62e0]
mov qword [rax + 8], rcx
mov rcx, rbx
mov byte [rax + 0x10], 0
call fcn.1801b6480
cmp byte [rbx + 0x58], 0
je 0x1801bd13e
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x1801bd1d5
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x20], 0
je 0x1801bd1bc
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1801bd16e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1801bd1b4
cmp eax, 2
je 0x1801bd1bc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1801bd160
dec eax
test eax, 0xfffffffd
jne 0x1801bd160
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x1801bd160
mov ecx, dword [rbx + 0x184]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x1801bd160
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x1801bcfd0
cmp eax, 0xcc
je 0x1801bd1f7
mov rax, qword [rbx]
mov dword [rax + 0x28], SafeArrayGetElement
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1801bcfd0