joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001e70
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, r8d
cmp rcx, 0xffffffffffffffff
je 0x180001ea8
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001ea8
cmp ebx, dword [rsp + 0x40]
jne 0x180001ea8
mov eax, 1
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180001ed0
Capabilities:
Allocate or change rwx memory
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r9
mov rbx, r8
mov rax, rdx
mov rdi, rcx
test rdx, rdx
je 0x180002050
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
je 0x180002050
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x18000203f
mov rcx, qword [rsp + 0x40]
mov edx, 0xfffffffe
lea rax, [rcx - 1]
cmp rax, rdx
ja 0x18000203f
test ecx, ecx
je 0x18000203f
test rsi, rsi
je 0x180001f6d
mov dword [rsi], ecx
test rdi, rdi
je 0x180001f7f
mov r8, rcx
mov rcx, rdi
call fcn.180002520
jmp 0x180001fa1
mov eax, 0xffffffff
cmp rcx, rax
ja 0x180002038
mov edx, ecx
mov r8d, 0x3000
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x18000203f
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
call fcn.180001e70
test eax, eax
je 0x180002013
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x180001fed
mov rax, qword [rsp + 0x68]
mov qword [rcx], rax
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x180001ffe
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rdi, rdi
je 0x180002025
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.1800026c0
jmp 0x18000203f
mov rcx, qword [rbx]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x18000203f
mov qword [rbx], 0
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x180002050
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180002290
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov ebx, r9d
xor r8d, r8d
lea r9, [rsp + 0x30]
mov rdi, rdx
lea edx, [r8 + 4]
call fcn.180001d80
test eax, eax
je 0x18000237d
test rdi, rdi
je 0x1800022ec
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x18000237d
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18000236c
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x18000237d
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000236c
cmp ebx, dword [rsp + 0x78]
jne 0x18000236c
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180002346
mov rax, qword [rsp + 0x30]
mov qword [rcx], rax
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x180002357
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x18000237d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180002b00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x180002bfb
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rsp + 0x54]
xor edx, edx
mov rax, rbx
div r8
lea ecx, [r8 - 1]
mov eax, r8d
not rcx
and rdi, rcx
sub eax, edx
je 0x180002b55
cmp eax, r8d
je 0x180002b55
add rbx, rax
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180002bfb
mov r8, qword [rsp + 0x20]
mov rax, r8
sub rax, rdi
add rax, rbx
cmp rax, 0x7fffffff
jg 0x180002bfb
cmp rax, 0xffffffff80000000
jl 0x180002bfb
cmp dword [rsp + 0x40], 0x10000
jne 0x180002bd9
mov ecx, dword [rsp + 0x78]
xor edx, edx
mov rax, r8
div rcx
sub rcx, rdx
mov rdx, qword [rsp + 0x38]
add rcx, r8
add rdx, r8
lea rax, [rcx + rbx]
cmp rax, rdx
ja 0x180002bd9
mov r9d, esi
mov r8d, 0x3000
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180002bfd
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x20]
add rcx, r8
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002b72
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180005c00
Capabilities:
Allocate or change rwx memory
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
cmp dword [rsp + 0x70], 0
mov rsi, r8
mov ebx, r9d
mov rdi, rcx
mov r14d, edx
je 0x180005c42
mov edx, ebx
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180005cab
cmp rdi, 0xffffffffffffffff
je 0x180005cab
mov rdx, r14
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180005cab
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180005cab
cmp ebx, dword [rsp + 0x34]
jne 0x180005cab
cmp dword [rsp + 0x70], 0
jne 0x180005c93
mov eax, 1
jmp 0x180005cad
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180005cad
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x180006600
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x38
movabs rax, 0xb5026f5aa96619e9
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
mov r9, rcx
mov eax, dword [rcx]
cmp eax, 0x138
jl 0x18000670d
cmp eax, 0x139
jne 0x180006638
call fcn.180006790
lea r8, [rcx + 8]
mov r10d, 0x9c
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 + 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 8]
mov rax, rdx
shr rdx, 1
and eax, 1
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, rdx
xor rcx, qword [r8 + 0x4d8]
mov qword [r8 - 8], rcx
sub r10, 1
jne 0x180006650
lea r8, [r9 + 0x4e8]
mov r10d, 0x9b
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 + 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 8]
mov rax, rdx
shr rdx, 1
and eax, 1
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, rdx
xor rcx, qword [r8 - 0x4e8]
mov qword [r8 - 8], rcx
sub r10, 1
jne 0x1800066a0
mov edx, dword [r9 + 0x9c0]
xor edx, dword [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 + 0x9c0]
mov rax, rdx
shr rdx, 1
and eax, 1
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, rdx
xor rcx, qword [r9 + 0x4e0]
mov qword [r9 + 0x9c0], rcx
mov dword [r9], r10d
movsxd rcx, dword [r9]
mov rdx, qword [r9 + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [r9], eax
movabs rcx, 0x555555555
mov rax, rdx
shr rax, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 0x38
ret

Function at 0x180006790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
movabs r10, 0x5851f42d4c957f2d
mov qword [rsp + 0x10], 0x1571
mov qword [rcx + 8], 0x1571
mov dword [rcx], 1
nop word [rax + rax]
movsxd r8, dword [rcx]
lea eax, [r8 - 1]
movsxd rdx, eax
mov rax, qword [rcx + rdx*8 + 8]
mov rdx, rax
shr rdx, 0x3e
xor rdx, rax
imul rdx, r10
add rdx, r8
mov qword [rcx + r8*8 + 8], rdx
inc dword [rcx]
cmp dword [rcx], 0x138
jl 0x1800067c0
ret
Function at 0x1800067f0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x20]
mov rbx, rcx
mov byte [rax + rcx + 0x24], 0x80
inc dword [rcx + 0x20]
mov ecx, dword [rcx + 0x20]
cmp ecx, 0x38
jbe 0x18000682d
mov eax, ecx
mov r8d, 0x40
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.180048510
mov rcx, rbx
call fcn.1800068b0
mov ecx, dword [rbx + 0x20]
cmp ecx, 0x38
jae 0x18000684e
mov eax, ecx
mov r8d, 0x38
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.180048510
movzx eax, byte [rbx + 0x1f]
mov rcx, rbx
mov byte [rbx + 0x5c], al
movzx eax, byte [rbx + 0x1e]
mov byte [rbx + 0x5d], al
mov rax, qword [rbx + 0x18]
shr rax, 0x28
mov byte [rbx + 0x5e], al
mov rax, qword [rbx + 0x18]
shr rax, 0x20
mov byte [rbx + 0x5f], al
mov eax, dword [rbx + 0x18]
shr rax, 0x18
mov byte [rbx + 0x60], al
mov eax, dword [rbx + 0x18]
shr rax, 0x10
mov byte [rbx + 0x61], al
mov eax, dword [rbx + 0x18]
shr rax, 8
mov byte [rbx + 0x62], al
movzx eax, byte [rbx + 0x18]
mov byte [rbx + 0x63], al
add rsp, 0x20
pop rbx
jmp fcn.1800068b0
Function at 0x1800068b0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rbx, rcx
lea r9, [rsp]
lea r8, [rcx + 0x26]
mov r10d, 0x10
movzx eax, byte [r8 - 1]
lea r9, [r9 + 4]
movzx edx, byte [r8 - 2]
lea r8, [r8 + 4]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 4]
shl edx, 8
or edx, eax
movzx eax, byte [r8 - 3]
shl edx, 8
or edx, eax
mov dword [r9 - 4], edx
sub r10, 1
jne 0x1800068e0
lea rdx, [rsp + 0x40]
lea rax, [rsp + 8]
lea r8d, [r10 + 0x40]
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rax + 0x2c]
lea rdx, [rdx + 4]
xor ecx, dword [rax + 0x18]
xor ecx, dword [rax - 8]
xor ecx, dword [rax]
lea rax, [rax + 4]
rol ecx, 1
mov dword [rdx - 4], ecx
sub r8, 1
jne 0x180006930
mov r12d, dword [rbx]
lea rbp, [rsp]
mov r13d, dword [rbx + 4]
mov r14d, 0x14
mov r9d, dword [rbx + 8]
mov r15d, r14d
mov r11d, dword [rbx + 0xc]
mov edi, r12d
mov esi, dword [rbx + 0x10]
mov r10d, r13d
mov eax, r9d
lea r8d, [rsi + 0x5a827999]
and eax, r10d
lea rbp, [rbp + 4]
mov ecx, r10d
mov edx, edi
rol edx, 5
not ecx
and ecx, r11d
mov esi, r11d
or ecx, eax
mov r11d, r9d
add edx, ecx
mov r9d, r10d
add edx, dword [rbp - 4]
mov r10d, edi
add r8d, edx
ror r9d, 2
mov edi, r8d
sub r15, 1
jne 0x180006973
lea rcx, [rsp + 0x50]
mov rdx, r14
nop dword [rax]
rol r8d, 5
lea rcx, [rcx + 4]
add esi, 0x6ed9eba1
mov eax, r11d
xor eax, r9d
xor eax, r10d
add r8d, eax
add r8d, dword [rcx - 4]
add r8d, esi
mov esi, r11d
mov r11d, r9d
mov r9d, r10d
ror r9d, 2
mov r10d, edi
mov edi, r8d
sub rdx, 1
jne 0x1800069c0
lea rdx, [rsp + 0xa0]
mov rbp, r14
nop word [rax + rax]
mov ecx, r9d
rol r8d, 5
or ecx, r10d
lea rdx, [rdx + 4]
and ecx, r11d
mov eax, r9d
add esi, 0x8f1bbcdc
and eax, r10d
add r8d, esi
or ecx, eax
add ecx, dword [rdx - 4]
mov esi, r11d
mov r11d, r9d
add r8d, ecx
mov r9d, r10d
mov r10d, edi
ror r9d, 2
mov edi, r8d
sub rbp, 1
jne 0x180006a10
lea rcx, [rsp + 0xf0]
nop dword [rax]
rol r8d, 5
lea rcx, [rcx + 4]
add r8d, 0xca62c1d6
mov eax, r11d
add r8d, dword [rcx - 4]
xor eax, r9d
xor eax, r10d
add eax, esi
mov esi, r11d
mov r11d, r9d
add r8d, eax
mov r9d, r10d
mov r10d, edi
ror r9d, 2
mov edi, r8d
sub r14, 1
jne 0x180006a60
add dword [rbx + 0xc], r11d
lea eax, [r12 + r8]
add dword [rbx + 8], r9d
lea r11, [rsp + 0x140]
add dword [rbx + 0x10], esi
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [rbx], eax
lea eax, [r10 + r13]
mov dword [rbx + 4], eax
mov dword [rbx + 0x20], r14d
mov rbx, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800073c0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r11d, r8d
mov rdi, rdx
mov rsi, rcx
mov ebx, ebp
mov rax, rdx
test rdx, rdx
je 0x1800075ed
movzx r9d, byte [rdx]
mov r10d, ebp
test r9b, r9b
je 0x1800075ed
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x180007403
test r10d, r10d
je 0x1800075ed
mov rcx, rdi
mov r8d, 0x811c9dc5
lea eax, [r9 - 0x41]
cmp al, 0x19
movsx eax, r9b
ja 0x18000742f
add eax, 0x20
movzx r9d, byte [rcx + 1]
inc rcx
movzx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
test r9b, r9b
jne 0x180007420
mov eax, 0xba2e8ba3
mul r8d
shr edx, 3
imul eax, edx, 0xb
sub r8d, eax
lea r14, [r8 + r8*2]
add r14, r14
mov rax, qword [rsi + r14*8 + 0x48]
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x1800074d1
nop
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x1800074c5
cmp rdi, r8
je 0x1800075ed
mov r9, rdi
sub r9, r8
nop dword [rax + rax]
movzx eax, byte [r9 + r8]
movzx edx, byte [r8]
lea r8, [r8 + 1]
cmp al, dl
je 0x1800074bc
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x1800074ab
add al, 0xe0
lea ecx, [rdx - 0x61]
cmp cl, 0x19
ja 0x1800074b6
add dl, 0xe0
cmp al, dl
jb 0x1800074c5
ja 0x1800074c5
test al, al
jne 0x180007490
jmp 0x1800075ed
mov rax, qword [rbx]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180007470
test r11d, r11d
je 0x1800075ed
mov rcx, qword [rsi]
xor edx, edx
mov r8d, 0x25c0
lea r9d, [rdx + 1]
call fcn.180002440
mov rbx, rax
test rax, rax
je 0x1800075ed
mov edx, ebp
mov rax, rdi
cmp byte [rdi], dl
je 0x18000750e
lea rax, [rax + 1]
inc edx
cmp byte [rax], bpl
jne 0x180007503
mov rcx, qword [rsi]
lea eax, [rdx + 1]
mov r8d, eax
mov rdx, rdi
mov r9d, eax
call fcn.180002590
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1800075d9
mov qword [rbx], rbp
lea rcx, [rbx + 0x40]
mov qword [rbx + 8], rbp
lea r8, [rbx + 0x18]
mov qword [rbx + 0x10], rbx
lea rax, [rcx + 0x18]
mov qword [r8], rbp
mov edx, 0xc7
mov qword [r8 + 8], rbp
mov qword [r8 + 0x10], rbx
mov qword [rbx + 0x30], rsi
mov qword [rcx], rax
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x20], rcx
mov qword [rcx + 0x28], rbp
lea rcx, [rbx + 0x70]
mov qword [rax], rbp
nop dword [rax]
nop dword [rax + rax]
lea rax, [rcx + 0x18]
mov qword [rcx + 8], rbp
mov qword [rcx], rax
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x20], rcx
mov qword [rcx + 0x28], rbp
add rcx, 0x30
mov qword [rax], rbp
add edx, 0xffffffff
jne 0x180007580
mov rcx, qword [rsi + r14*8 + 0x68]
mov rax, qword [rcx]
mov qword [rax + 8], rbx
mov rax, qword [rcx]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov qword [rax + 8], r8
mov rax, qword [rcx]
mov qword [r8], rax
mov qword [r8 + 8], rcx
mov qword [rcx], r8
inc dword [rsi + 8]
jmp 0x1800075ed
mov rcx, qword [rsi]
mov r8d, 1
mov rdx, rbx
call fcn.180002740
mov rbx, rbp
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180007610
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r11d, r8d
mov rdi, rdx
mov rbp, rcx
mov ebx, r15d
mov rax, rdx
test rdx, rdx
je 0x1800077e9
movzx r9d, byte [rdx]
mov r10d, r15d
test r9b, r9b
je 0x1800077e9
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x180007653
test r10d, r10d
je 0x1800077e9
mov rsi, qword [rcx + 0x30]
mov r8d, 0x811c9dc5
mov rcx, rdi
lea eax, [r9 - 0x41]
cmp al, 0x19
movsx eax, r9b
ja 0x180007683
add eax, 0x20
movzx r9d, byte [rcx + 1]
inc rcx
movzx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
test r9b, r9b
jne 0x180007674
mov eax, 0x5254e78f
mul r8d
shr edx, 6
imul eax, edx, 0xc7
sub r8d, eax
lea r14, [r8 + r8*2]
add r14, r14
mov rax, qword [rbp + r14*8 + 0x70]
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180007721
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x180007715
cmp rdi, r8
je 0x1800077e9
mov r9, rdi
sub r9, r8
nop
movzx eax, byte [r9 + r8]
movzx edx, byte [r8]
lea r8, [r8 + 1]
cmp al, dl
je 0x18000770c
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x1800076fb
add al, 0xe0
lea ecx, [rdx - 0x61]
cmp cl, 0x19
ja 0x180007706
add dl, 0xe0
cmp al, dl
jb 0x180007715
ja 0x180007715
test al, al
jne 0x1800076e0
jmp 0x1800077e9
mov rax, qword [rbx]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x1800076c6
test r11d, r11d
je 0x1800077e9
mov rcx, qword [rsi]
xor edx, edx
lea r9d, [rdx + 1]
lea r8d, [rdx + 0x48]
call fcn.180002440
mov rbx, rax
test rax, rax
je 0x1800077e9
mov edx, r15d
mov rax, rdi
cmp byte [rdi], dl
je 0x18000775d
lea rax, [rax + 1]
inc edx
cmp byte [rax], r15b
jne 0x180007752
mov rcx, qword [rsi]
lea eax, [rdx + 1]
mov r8d, eax
mov rdx, rdi
mov r9d, eax
call fcn.180002590
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1800077d5
mov qword [rbx], r15
lea rdx, [rbx + 0x18]
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rbx
mov qword [rdx], r15
mov qword [rdx + 8], r15
mov qword [rdx + 0x10], rbx
mov qword [rbx + 0x30], rbp
mov qword [rbx + 0x40], r15
mov rcx, qword [rbp + r14*8 + 0x90]
mov rax, qword [rcx]
mov qword [rax + 8], rbx
mov rax, qword [rcx]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
mov rax, qword [rcx]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov qword [rcx], rdx
inc dword [rsi + 8]
jmp 0x1800077e9
mov rcx, qword [rsi]
mov r8d, 1
mov rdx, rbx
call fcn.180002740
mov rbx, r15
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180007d70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15d, dword [r8]
xor edi, edi
mov r12, qword [rsp + 0x90]
mov r14, r9
mov rbp, rdx
mov rsi, rcx
lea eax, [r15 + 1]
mov dword [r8], eax
test r9, r9
je 0x180007dd0
mov r8, qword [rdx + 0x38]
mov r9d, r15d
mov qword [rsp + 0x38], r12
lea edx, [rdi + 1]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call r14
test eax, eax
je 0x180007f0c
cmp rsi, 0xffffffffffffffff
je 0x180007f0c
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, 1
lea rdx, [0x180064ae4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007f0c
cmp dword [rsp + 0x78], 1
jne 0x180007f0c
mov rdx, qword [rbp + 0x38]
mov ebx, edi
mov rax, rdx
test rdx, rdx
je 0x180007e2b
cmp byte [rdx], bl
je 0x180007e2b
nop
lea rax, [rax + 1]
inc ebx
cmp byte [rax], dil
jne 0x180007e20
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007f0c
cmp ebx, dword [rsp + 0x78]
jne 0x180007f0c
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rdi
mov r8d, 3
lea rdx, [0x180064ae8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180007f0c
cmp dword [rsp + 0x78], 3
jne 0x180007f0c
mov rax, qword [rbp + 0x40]
mov dword [rsp + 0x78], edi
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180007ed6
nop word [rax + rax]
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], r14
mov r9, rbx
mov r8d, r15d
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call fcn.180007f30
test eax, eax
je 0x180007ee1
mov rax, qword [rbx + 0x18]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180007ea0
test r14, r14
jne 0x180007ee5
lea edi, [r14 + 1]
jmp 0x180007f0c
xor eax, eax
jmp 0x180007f0e
mov r8, qword [rbp + 0x38]
mov r9d, r15d
mov qword [rsp + 0x38], r12
mov edx, 4
mov qword [rsp + 0x30], rdi
mov rcx, rsi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
call r14
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180007f30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x48
mov rdi, r9
xor ebx, ebx
mov r9, qword [r9 + 0x40]
mov r13, rdx
mov rsi, rcx
mov rax, r9
test r9, r9
je 0x180007f70
mov r10d, ebx
cmp byte [r9], bl
je 0x180007f70
nop dword [rax]
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x180007f60
test r10d, r10d
jne 0x180007f8d
mov rax, qword [rdi + 0x30]
mov rcx, qword [rax + 0x30]
test byte [rcx + 0xc], 0x20
je 0x180007f8d
mov eax, 1
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rsp + 0x90]
test r9, r9
mov qword [rsp + 0x70], rbp
mov rbp, qword [rsp + 0x98]
mov qword [rsp + 0x78], r12
mov r12, qword [rsp + 0xa0]
mov qword [rsp + 0x80], r14
lea r14, [0x180064aec]
mov qword [rsp + 0x40], r15
cmovne r14, r9
mov r15d, dword [rcx]
lea eax, [r15 + 1]
mov dword [rcx], eax
mov rax, qword [rdi + 0x38]
test rbp, rbp
je 0x180008009
mov qword [rsp + 0x38], r12
mov r9d, r8d
mov r8, qword [rdx + 0x38]
mov rcx, rsi
mov qword [rsp + 0x30], r14
mov edx, 2
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call rbp
test eax, eax
je 0x180008103
mov rdx, qword [rdi + 0x38]
mov edi, ebx
mov rax, rdx
test rdx, rdx
je 0x18000802a
cmp byte [rdx], bl
je 0x18000802a
nop dword [rax + rax]
lea rax, [rax + 1]
inc edi
cmp byte [rax], bl
jne 0x180008020
cmp rsi, 0xffffffffffffffff
je 0x180008103
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180008103
cmp edi, dword [rsp + 0x88]
jne 0x180008103
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov r8d, 3
lea rdx, [0x180064af0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180008103
cmp dword [rsp + 0x88], 3
jne 0x180008103
mov rdx, r14
mov rcx, rsi
call fcn.180008130
test eax, eax
je 0x180008103
lea r9, [rsp + 0x88]
mov qword [rsp + 0x20], rbx
mov r8d, 2
lea rdx, [0x180064af4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180008103
cmp dword [rsp + 0x88], 2
jne 0x180008103
test rbp, rbp
jne 0x1800080dd
lea ebx, [rbp + 1]
jmp 0x180008103
mov r8, qword [r13 + 0x38]
mov r9d, r15d
mov qword [rsp + 0x38], r12
mov edx, 4
mov qword [rsp + 0x30], rbx
mov rcx, rsi
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call rbp
mov ebx, eax
mov r15, qword [rsp + 0x40]
mov eax, ebx
mov r14, qword [rsp + 0x80]
mov r12, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x48
pop r13
pop rdi
pop rsi
pop rbx
ret