joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000e2c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
lea r14d, [r8 + 0xb]
mov r12, r9
mov edi, r8d
mov r13, rdx
mov rbx, rcx
cmp r8d, r14d
jae case.0x18000e32b.23
mov r15d, dword [rbp + 0x77]
lea esi, [r8 - 0x45]
xor edx, edx
lea r8, [0x180000000]
movabs r10, 0x65006e0072
mov r9d, 0x74
cmp esi, 0x17
ja case.0x18000e32b.7
mov ecx, dword [r8 + rsi*4 + 0xe544]
add rcx, r8
jmp rcx
mov ebx, 0x5f
cmp ebx, 0x5f
je 0x18000e35b
cmp ebx, 0x7e
jne 0x18000e397
mov rax, qword [rbp - 0x29]
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x30], rdx
lea r8, [rbp - 0x11]
mov qword [rsp + 0x28], rdx
lea rcx, [rbp + 7]
xor edx, edx
mov dword [rsp + 0x20], 0xe9
xor r9d, r9d
call fcn.18000df30
lea rcx, [rbp - 0x21]
call rax
test eax, eax
je 0x18000e538
cmp byte [rbp - 0x21], 1
sete byte [rbp - 0x29]
xor edx, edx
add ebx, 0x1f
cmp ebx, 0x9d
jb 0x18000e332
mov rbx, qword [rbp + 0x67]
lea rcx, [rbp - 0x11]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000e3b0
mov eax, dword [str.owerS]
mov dword [rcx], eax
movzx eax, word [0x18009b730]
mov word [rcx + 4], ax
jmp case.0x18000e32b.7
lea rcx, [rbp - 0x11]
mov word [rbp - 9], 0x6d
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000e3e0
movzx eax, word [0x18009b734]
mov word [rcx], ax
jmp case.0x18000e32b.7
mov r9d, 0x71
mov dword [rbp + 0x77], 5
xor r8d, r8d
lea rdx, [rbp + 0x77]
mov rcx, r13
call fcn.180027320
mov qword [rbp - 0x29], rax
mov qword [rax + 8], r12
mov qword [rax + 0x10], rbx
jmp case.0x18000e32b.7
cmp r15d, 0xb7
jne case.0x18000e32b.7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rbp - 0x11]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000e443
movzx eax, word [0x18009a7f4]
mov word [rcx], ax
mov eax, dword [str.atus]
mov dword [rbp - 1], eax
movzx eax, byte [0x18009b73c]
mov byte [rbp + 3], al
jmp case.0x18000e32b.7
mov r8d, 4
mov word [rbp - 0x11], 0x47
lea rdx, [0x18009b740]
lea rcx, [rbp - 0x10]
call fcn.18006e170
lea rcx, [rbp - 0x11]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000e492
movzx eax, word [0x18009b744]
mov word [rcx], ax
jmp case.0x18000e32b.7
mov r8, qword [0x1800ba6f8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
jmp case.0x18000e32b.7
lea rcx, [rbp - 0x11]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18000e4d0
movzx eax, word [0x18009a800]
mov word [rcx], ax
mov word [rbp - 0xb], r9w
mov byte [rbp - 0xa], 0x65
jmp case.0x18000e32b.7
mov eax, dword [0x18009b748]
lea rdx, str.2.dll
mov dword [rbp + 7], eax
lea rcx, [rbp + 0x15]
mov eax, dword [0x18009b750]
mov r8d, 6
mov qword [rbp + 0xb], r10
mov dword [rbp + 0x11], eax
movzx eax, word [0x18009b754]
mov word [rbp + 0x15], ax
call fcn.18006dbdc
inc edi
inc esi
cmp edi, r14d
jae case.0x18000e32b.23
jmp 0x18000e2fe
mov byte [rbp - 0x29], 0
jmp case.0x18000e32b.23
Function at 0x18001c800
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x230
mov ebx, dword [rsp + 0x270]
lea esi, [rcx + 6]
mov dword [rsp + 0x20], esi
mov rdi, r8
mov r15, rdx
mov r13d, ecx
cmp ecx, esi
jae case.0x18001c861.1
mov r14, qword [rsp + 0x288]
lea r12d, [rcx - 0x118]
lea rdx, [0x180000000]
cmp r12d, 0x12
ja case.0x18001c861.2
mov ecx, dword [rdx + r12*4 + 0x1c9fc]
add rcx, rdx
jmp rcx
xor ecx, ecx
test r14, r14
je case.0x18001c861.2
nop
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x18001c87d
mov rdx, qword [rdi]
movzx eax, byte [r15 + rcx*2]
mov byte [rdx + rcx], al
inc rcx
cmp rcx, r14
jb 0x18001c870
jmp case.0x18001c861.2
xor ebp, ebp
cmp dword [rdi], ebp
jle 0x18001c8fa
mov rbx, r15
lea esi, [rbp + 2]
nop
movzx ecx, byte [rbx]
call fcn.18006d564
test eax, eax
jne 0x18001c8bf
movzx eax, byte [rbx]
cmp al, 0xd
je 0x18001c8bf
cmp al, 0xa
je 0x18001c8c4
cmp al, 0x80
jb 0x18001c9ea
cmp byte [rbx], 0xa
jne 0x18001c8eb
mov ecx, dword [rdi]
lea eax, [rsi - 1]
cmp eax, ecx
jge 0x18001c8d7
cmp byte [rbx + 1], 0xa
je 0x18001c9f1
cmp esi, ecx
jge 0x18001c8eb
cmp byte [rbx + 1], 0xd
jne 0x18001c8eb
cmp byte [rbx + 2], 0xa
je 0x18001c9f6
inc ebp
inc esi
inc rbx
cmp ebp, dword [rdi]
jl 0x18001c8a0
mov esi, dword [rsp + 0x20]
xor ebx, ebx
jmp case.0x18001c861.2
movzx eax, word [rdi]
lea r8, [rsp + 0x288]
mov r9d, 0x15
mov word [rsp + 0x288], ax
lea rdx, [rsp + 0x270]
mov byte [rsp + 0x270], 7
mov rcx, r15
call fcn.180050930
jmp case.0x18001c861.2
mov r14, 0xffffffffffffffff
nop
inc r14
cmp word [r15 + r14*2], 0
jne 0x18001c940
xor r8d, r8d
mov rdx, r14
mov rcx, rdi
call fcn.180059730
jmp case.0x18001c861.2
mov r9, rdi
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8d, 0x200
call fcn.180075990
test rax, rax
je case.0x18001c861.2
nop dword [rax + rax]
lea r9, [rsp + 0x270]
mov dword [rsp + 0x270], eax
lea r8, [rsp + 0x30]
mov rdx, r15
mov ecx, 0xc0
call fcn.180034720
mov r9, rdi
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8d, 0x200
call fcn.180075990
test rax, rax
jne 0x18001c980
inc r13d
inc r12d
cmp r13d, esi
jb 0x18001c845
mov eax, ebx
mov rbx, qword [rsp + 0x278]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xffffffff
jmp 0x18001c9cf
lea eax, [rbp + 2]
jmp 0x18001c9cf
lea eax, [rbp + 3]
jmp 0x18001c9cf
Function at 0x1800235c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
lea edi, [rdx + 0xb]
mov r12, r9
mov r14, r8
mov r15, rcx
cmp edx, edi
jae 0x1800237c1
mov rsi, qword [rsp + 0x110]
lea ebx, [rdx - 0x6d]
mov rbp, qword [rsp + 0x48]
lea r13, [0x180000000]
mov edx, 0x6e69
lea r8, str.__create_array_iterator
cmp ebx, 0xb
ja case.0x18002362a.10
mov ecx, dword [r13 + rbx*4 + 0x237f4]
add rcx, r13
jmp rcx
lea rax, [rsp + 0x40]
mov dword [rsp + 0x88], 7
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x28], rsi
lea r8, [rsp + 0x48]
mov r9, r14
mov dword [rsp + 0x20], 0x72
mov qword [rsp + 0x90], r12
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], 0
call fcn.18001a330
movups xmm0, xmmword [rsp + 0xa0]
lea r8, str.__create_array_iterator
mov edx, 0x6e69
movsd xmm1, qword [rsp + 0xb0]
movups xmmword [r15], xmm0
movsd qword [r15 + 0x10], xmm1
jmp case.0x18002362a.10
movzx eax, word [0x18009bfcb]
mov word [rsp + 0x50], ax
movzx eax, byte [0x18009bfcd]
mov byte [rsp + 0x52], al
jmp case.0x18002362a.10
mov byte [rsp + 0x53], 0
jmp case.0x18002362a.10
mov qword [rsi + 0x80], r14
jmp case.0x18002362a.10
test rbp, rbp
je 0x1800237ea
mov rax, rbp
lea rdx, [rsp + 0xf8]
xchg qword [0x1800bb540], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, 0x6e69
lea r8, str.__create_array_iterator
jmp case.0x18002362a.10
mov r8d, 3
mov byte [rsp + 0x56], 0
lea rdx, [0x18009bfec]
lea rcx, [rsp + 0xf8]
call fcn.18006e170
mov r8d, 1
lea rdx, [0x18009bff0]
lea rcx, [rsp + 0xf8]
call fcn.18006df30
mov edx, 0x6e69
lea r8, str.__create_array_iterator
jmp case.0x18002362a.10
mov qword [rsp + 0x28], 0
lea r8, [0x18001bf50]
mov r9, rsi
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, 0x6e69
lea r8, str.__create_array_iterator
mov rbp, rax
jmp case.0x18002362a.10
mov qword [0x1800bb538], rsi
jmp case.0x18002362a.10
mov word [rsp + 0x53], dx
mov byte [rsp + 0x55], 0
jmp case.0x18002362a.10
mov byte [rsp + 0x55], 0x67
inc ebx
lea eax, [rbx + 0x6d]
cmp eax, edi
jb 0x180023616
movzx eax, byte [rsp + 0xf8]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor al, al
jmp 0x1800237c9
mov al, 1
jmp 0x1800237c9
Function at 0x1800359e0
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r12
push r13
push r14
sub rsp, 0x58
mov eax, dword [0x1800bb8d0]
mov r14, r9
mov r12d, r8d
mov r13, rdx
mov rbp, rcx
test al, 1
jne 0x180035a0b
or eax, 1
mov dword [0x1800bb8d0], eax
imul ecx, r12d, 0x220
mov dword [rsp + 0x38], ecx
cmp r12d, ecx
ja 0x180035c82
mov r11, qword [0x1800bb8c8]
mov qword [rsp + 0x80], rbx
mov ebx, dword [rsp + 0x90]
mov qword [rsp + 0x88], rsi
mov esi, dword [rsp + 0x90]
mov qword [rsp + 0x98], rdi
mov edi, dword [rsp + 0x90]
imul edx, r12d, 0x88
mov qword [rsp + 0x50], r15
mov r15d, dword [rsp + 0x90]
mov dword [rsp + 0x3c], edx
nop dword [rax + rax]
cmp r12d, 0x11
je 0x180035c0f
cmp r12d, 0x14
je 0x180035bff
cmp r12d, 0xab4
je 0x180035aa8
cmp r12d, 0x1554
jne 0x180035c59
movsxd rax, ebx
inc ebx
mov byte [rax + rbp], 0
jmp 0x180035c59
xor ebx, ebx
xor r8d, r8d
cmp dword [r14], ebx
jle 0x180035bbd
lea r9d, [rbx + 2]
lea r10, [r13 + 2]
nop
mov edx, 0x36
cmp edx, 0x36
je 0x180035b89
cmp edx, 0x1f6e
je 0x180035b36
cmp edx, 0x3ea6
je 0x180035b0b
cmp edx, 0x5dde
jne 0x180035b8e
cmp r9d, dword [r14]
jge 0x180035b8e
mov eax, edi
inc ebx
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r8 + rbp], al
inc r8
jmp 0x180035b8e
lea eax, [r9 - 1]
cmp eax, dword [r14]
jge 0x180035b8e
mov ecx, esi
movsxd rax, edi
and ecx, 0xf
sar rax, 6
shl ecx, 2
inc ebx
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [r8 + rbp], al
inc r8
jmp 0x180035b8e
mov eax, dword [r14]
cmp r9d, eax
jle 0x180035b42
xor esi, esi
jmp 0x180035b47
movzx esi, byte [r10 - 1]
cmp r9d, eax
jl 0x180035b50
xor edi, edi
jmp 0x180035b54
movzx edi, byte [r10]
mov ecx, r15d
movsxd rax, r15d
sar rax, 2
and ecx, 3
shl ecx, 4
add ebx, 2
movzx eax, byte [rax + r11]
mov byte [r8 + rbp], al
mov eax, esi
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r11]
mov byte [r8 + rbp + 1], al
add r8, 2
jmp 0x180035b8e
movzx r15d, byte [r10 - 2]
add edx, 0x1f38
cmp edx, 0x7ce0
jbe 0x180035ac5
add r9d, 3
add r10, 3
lea eax, [r9 - 2]
cmp eax, dword [r14]
jl 0x180035ac0
mov ecx, dword [rsp + 0x38]
mov edx, dword [rsp + 0x3c]
mov eax, ebx
and eax, 0x80000003
jge 0x180035bcd
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x180035c59
movsxd rcx, ebx
add rcx, rbp
nop dword [rax + rax]
inc ebx
mov byte [rcx], 0x3d
mov eax, ebx
lea rcx, [rcx + 1]
and eax, 0x80000003
jge 0x180035bf9
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x180035be0
jmp 0x180035c55
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov qword [0x1800bb8c8], r11
jmp 0x180035c59
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], 0
mov r9d, 0xd3
mov qword [rsp + 0x20], rax
mov r8, r13
mov byte [rsp + 0x30], 0
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x90], 0xc
lea rcx, [rsp + 0x30]
call fcn.18004d040
mov r11, qword [0x1800bb8c8]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
add r12d, edx
cmp r12d, ecx
jbe 0x180035a70
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x58
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180036cd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180036d04
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180036cf0
ret
Function at 0x1800481a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov edi, dword [rsp + 0x88]
lea r13d, [rdx + 8]
mov r14, r8
mov rsi, rcx
cmp edx, r13d
jae case.0x18004820b.3
mov r12d, dword [rsp + 0x88]
lea ebp, [rdx - 0x52]
lea rdx, [0x180000000]
xor r15d, r15d
nop dword [rax + rax]
cmp ebp, 0x18
ja case.0x18004820b.7
movzx eax, byte [rdx + rbp + 0x483c8]
mov ecx, dword [rdx + rax*4 + 0x483a8]
add rcx, rdx
jmp rcx
mov edi, r12d
jmp case.0x18004820b.7
mov rdx, qword [r14]
cmp rdx, qword [rsi + 0x10]
ja 0x18004822e
jae 0x180048364
cmp rdx, qword [rsi + 8]
jb 0x180048364
mov rcx, qword [rsi]
call fcn.18006e628
lea rdx, [0x180000000]
mov rcx, rax
test rax, rax
je case.0x18004820b.7
mov rax, qword [r14]
mov qword [rsi + 0x10], rax
mov qword [rsi], rcx
jmp case.0x18004820b.7
mov r12d, r15d
test rsi, rsi
je 0x180048287
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x18004827a
call qword [sym.imp.KERNEL32.dll_FindClose]
neg eax
sbb r12d, r12d
neg r12d
dec r12d
mov rcx, rsi
call fcn.18006e620
jmp 0x180048364
mov ecx, 0xa0
mov r12d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180048364
mov edi, r15d
jmp case.0x18004820b.7
mov r9d, 0xa7
mov qword [rsp + 0x20], r15
mov r8, rsi
xor edx, edx
xor ecx, ecx
call fcn.180022390
mov rbx, rax
mov dword [rsp + 0x20], 0x5d
xor r9d, r9d
mov dword [rsp + 0x88], ebx
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.180044730
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movd eax, xmm1
movups xmmword [rsp + 0x40], xmm0
test eax, eax
je 0x180048315
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x3d]
call fcn.180055840
test eax, eax
js 0x18004837b
jmp 0x180048364
cmp ebx, 0x22
jne 0x180048399
xor r8d, r8d
lea ecx, [rbx + 0x1f]
mov rdx, rsi
call fcn.18005b270
test eax, eax
js 0x18004837b
jmp 0x180048364
mov rdx, qword [r14]
test rdx, rdx
je case.0x18004820b.3
mov rax, r15
cmp qword [rsi + 8], rdx
je 0x180048364
nop
add rdx, qword [rsi]
mov rcx, rax
and ecx, 3
movzx ecx, byte [rcx + r14 + 8]
xor byte [rdx + rax], cl
inc rax
mov rdx, qword [r14]
mov rcx, qword [rsi + 8]
sub rcx, rdx
cmp rax, rcx
jb 0x180048340
lea rdx, [0x180000000]
inc ebp
lea eax, [rbp + 0x52]
cmp eax, r13d
jb 0x1800481f0
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp ebx, 0xffffffff
setne r15b
lea eax, [r15 - 2]
jmp 0x18004837b
Function at 0x18004cde0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
imul edi, ecx, 0x113
mov rsi, r8
mov ebx, ecx
mov edx, ecx
cmp ecx, edi
ja 0x18004cee5
mov r8, qword [str.dummy]
lea rbp, str.dummy
mov r9, qword [str.dummy]
xor r14d, r14d
mov r10, qword [str.dummy]
mov r11, qword [str.dummy]
nop dword [rax]
cmp edx, 0xb5
je 0x18004ce9a
cmp edx, 0x2798
je 0x18004ce7a
cmp edx, 0x3f70
je 0x18004cefc
cmp edx, 0x4e7b
jne 0x18004ced8
mov rcx, r14
nop dword [rax + rax]
movzx eax, byte [r10 + rcx]
inc rcx
cmp al, byte [rcx + rbp - 1]
jne 0x18004cf51
cmp rcx, 6
jne 0x18004ce60
jmp 0x18004ced8
mov rcx, r14
nop dword [rax]
movzx eax, byte [r11 + rcx]
inc rcx
cmp al, byte [rcx + rbp - 1]
jne 0x18004cfa1
cmp rcx, 6
jne 0x18004ce80
jmp 0x18004ced8
mov rcx, r14
nop dword [rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rcx + rbp - 1]
jne 0x18004cf06
cmp rcx, 6
jne 0x18004cea0
mov rcx, r14
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
cmp al, byte [rcx + rbp - 1]
jne 0x18004cfec
cmp rcx, 6
jne 0x18004cec0
imul eax, ebx, 0x37
add edx, eax
cmp edx, edi
jbe 0x18004ce30
mov eax, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.18007be90
jmp 0x18004cee9
mov rax, qword [0x1800ba010]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], rax
lea rcx, [0x180098787]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov r9d, 0x6b
xor edx, edx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x60], r14d
call fcn.180041ad0
lea rcx, str.compile_error_message_format_error._n
call fcn.1800111b0
int3
mov rax, qword [0x1800ba010]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], rax
lea rcx, [0x180098787]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov r9d, 0x6b
xor edx, edx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x60], r14d
call fcn.180041ad0
mov edx, 0x37
lea rcx, str.RecordRegistrationGotZoneData:_nta___p____zoneData___p____s___s_
call fcn.1800111b0
int3
mov rax, qword [0x1800ba010]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], rax
lea rcx, [0x180098787]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov r9d, 0x6b
xor edx, edx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x60], r14d
call fcn.180041ad0
lea rcx, str.Support_for_floating_point_denormals
call fcn.1800111b0
int3
mov rax, qword [0x1800ba010]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x78], rax
lea rcx, [0x180098787]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov r9d, 0x6b
xor edx, edx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x60], r14d
call fcn.180041ad0
mov edx, 0xa
lea rcx, str.bool___thiscall_OT::Ligature::apply_OT::hb_apply_context_t___const
call fcn.1800111b0
int3
Function at 0x1800647d0
Capabilities:
Hash data with md5

Disassembly:
mov r9d, 0x6c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
jmp fcn.180015490

Function at 0x18006eb10
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x18006e930
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18006e930
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18006e930
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18006e930
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18006e930
cmp dword [rcx + 0x84], 0xe
jbe 0x18006e930
cmp dword [rcx + 0xf8], esi
je 0x18006e930
mov ecx, r14d
call fcn.18006ea78
mov ecx, 2
call fcn.18007c470
nop
cmp byte [0x1800bc9f0], 0
jne 0x18006e9fa
mov r15d, 1
mov eax, r15d
xchg dword [0x1800bc9e0], eax
test ebx, ebx
jne 0x18006e9a3
mov rdi, qword [0x1800ba758]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1800bc9e8]
cmp rcx, rax
je 0x18006e99a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x180096498]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1800bcd78]
jmp 0x18006e9af
cmp ebx, r15d
jne 0x18006e9b5
lea rcx, [0x1800bcd90]
call fcn.1800817c0
nop
test ebx, ebx
jne 0x18006e9cc
lea rdx, [0x180096558]
lea rcx, [0x180096538]
call fcn.180081a18
lea rdx, [0x180096568]
lea rcx, [0x180096560]
call fcn.180081a18
movzx eax, byte [0x1800bc9f0]
test esi, esi
cmove eax, r15d
mov byte [0x1800bc9f0], al
jmp 0x18006e9fa
mov ecx, 2
call fcn.18007c4c4
test esi, esi
jne 0x18006ea11
mov ecx, r14d
call fcn.18006ea2c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x18006e8c0
Function at 0x180088828
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1800886c8
call fcn.18006db74
mov dword [rax], 0x16
call fcn.18006d264
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800886b0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1800886b0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1800886fa
lock or dword [rax + 0x14], 0x10
jmp 0x1800886b0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180088717
mov rcx, qword [rbp + 0x10]
call fcn.180091518
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180081b04
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.180086bb0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x18008876e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1800886b0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1800887da
mov rcx, qword [rbp + 0x10]
call fcn.180081b04
cmp eax, 0xffffffff
je 0x1800887c1
mov rcx, qword [rbp + 0x10]
call fcn.180081b04
cmp eax, 0xfffffffe
je 0x1800887c1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180081b04
movsxd rdi, eax
lea rsi, [0x1800bcfa0]
mov rcx, rbx
sar rdi, 6
call fcn.180081b04
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1800887c8
lea rax, [0x1800bac00]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800887da
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x180088810
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x18008880c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x18008880c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1800886b3
jmp 0x180088680

Function at 0x180089800
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180089820
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18006db04
or eax, 0xffffffff
jmp 0x180089822
xor eax, eax
add rsp, 0x28
ret
Function at 0x18008df30
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x18008df50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18006db04
or eax, 0xffffffff
jmp 0x18008df52
xor eax, eax
add rsp, 0x28
ret