joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400036d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r12d, r12d
xor r13d, r13d
xor edi, edi
cmp r8, 0x201
jae 0x140003760
jmp 0x14000374f
jae 0x14000381e
cmp r8, 0x201
jae 0x140003760
mov r14d, 0x200
lea rbx, [rbp - 0x58]
mov rsi, r8
jmp 0x1400037b7
sub r8, rdi
sub r13, rdi
cmp r13, r8
jae 0x14000378f
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.140019b40
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov r12, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovb rdi, r12
mov qword [rbp + 0x3d8], rdi
mov r13, r12
mov r14, rdi
mov rbx, qword [rbp + 0x3e8]
mov rsi, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r15d, eax
test eax, eax
jne 0x1400037df
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140003886
mov r8d, r15d
cmp rsi, r8
jne 0x140003740
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400038a9
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r8, rsi
cmp r8, 0x201
jb 0x14000374f
jmp 0x140003760
cmp r14, r8
jb 0x1400038c3
lea rcx, [rbp + 0x3a8]
mov rdx, rbx
call fcn.140004790
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r12, r12
je 0x14000386f
add r12, r12
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r12
call fcn.1400011a0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r12, r12
jne 0x140003857
jmp 0x14000386f
lea rcx, [0x14001b69b]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001a520
jmp 0x1400038d8
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14001a780
ud2
Function at 0x140005090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x39]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x1400050c3
test ecx, ecx
jne 0x140005112
movzx r15d, byte [rdi + 0x38]
cmp al, 0xff
je 0x1400050d0
test ecx, ecx
jne 0x140005112
mov rcx, rdi
call fcn.140004f70
movzx r10d, al
test bl, bl
jne 0x140005119
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x140005106.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x14000528c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x140005106.2
xor r10d, r10d
test bl, bl
je 0x1400050e0
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14000526e
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x14000514b
xor edi, edi
jmp 0x1400051c8
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x140005190
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x1400051ab
inc rsi
dec rax
cmp rsi, 1
jne 0x140005170
jmp 0x1400051c8
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x1400051ab
cmp ebx, 0x5c
je 0x1400051ab
inc rsi
dec rax
cmp rsi, 1
jne 0x140005190
jmp 0x1400051c8
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x14000527c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x1400051f2
mov al, 9
cmp rdx, 2
je 0x1400051f6
cmp rdx, 1
jne 0x140005206
cmp byte [r9], 0x2e
jne 0x140005206
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x140005206
mov al, 0xa
jmp 0x140005206
cmp byte [r9], 0x2e
jne 0x140005206
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x140005106.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x140005106.2
mov esi, 2
jmp case.0x140005106.2
lea r8, str.library_std_srcpath.rs
call fcn.14001a770
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14001a770
ud2
Function at 0x1400179a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x140017a1a
mov r11, rdx
mov rdx, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rbx, r11
movzx edi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x140017a10
cmp r10, rax
jb 0x140017aad
cmp r10, rdx
ja 0x140017ac1
add rax, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140017a12
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x1400179f0
jmp 0x140017a82
ja 0x140017a1a
mov rax, r10
cmp r11, r8
jne 0x1400179c0
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140017a86
mov rsi, qword [rsp + 0x78]
add rdx, rsi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [rsi + 1]
movzx edi, byte [rsi]
test dil, dil
js 0x140017a60
mov rsi, rbx
sub ecx, edi
jns 0x140017a79
jmp 0x140017a88
cmp rbx, rdx
je 0x140017a93
movzx ebp, byte [rsi + 1]
add rsi, 2
and edi, 0x7f
shl edi, 8
or edi, ebp
sub ecx, edi
js 0x140017a88
xor al, 1
cmp rsi, rdx
jne 0x140017a40
jmp 0x140017a88
xor eax, eax
jmp 0x140017a88
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001a520
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.14001a790
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001a780
ud2
Function at 0x18003a790
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x18003a7b8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18003a7de
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18003a7e0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18003a839
test ecx, ecx
jle 0x18003a819
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18003a839
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18003a839
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x18003a860
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18003a882
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18003a898
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18003a8b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18003a8b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18003a8f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18003a98e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18003a92d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18003a96e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18003a98e
cmp rbx, rax
ja 0x18003a940
test rbx, rbx
je 0x18003a98e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x18003adf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800dd280]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18003ae1d
xor eax, eax
jmp 0x18003af89
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18003ae57
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18003ae57
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18003af89
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18003af7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18003ae9a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18003aec5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003af81
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18003af34
sub eax, 1
je 0x18003af34
cmp eax, 2
jne 0x18003af7c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18003af81
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18003af62
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18003af7c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18003af81
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180099f30
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18003c350
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800dd280]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18003c423
cmp byte [rcx + 0x71], 0
je 0x18003c423
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18003c41f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18003c3e4
sub eax, 1
je 0x18003c3e8
cmp eax, 2
jne 0x18003c41f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180099f30
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18003c416
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18003c41f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18003c3cc
xor al, al
jmp 0x18003c3cc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180099f30
add rsp, 0x60
pop rbx
ret
Function at 0x18004d7d0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18004d801
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800e41d8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800e41e8]
lea rdx, [rdi + rdi]
call fcn.18004c860
mov rax, qword [0x1800e41d8]
lea r9, [rdi - 1]
mov qword [0x1800e4200], r9
mov qword [0x1800e4208], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18004d974
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800e41e8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18004d8c0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18004d935
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18004d8fd
mov r10, qword [rdx]
cmp r10, rax
je 0x18004d8f7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18004d935
cmp r9, rdx
je 0x18004d911
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18004d949
cmp r9, rdx
jne 0x18004d902
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18004d96f
mov r9, qword [0x1800e4200]
jmp 0x18004d871
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004d935
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18004ff40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov qword [rsp + 0x40], r12
mov r14, rcx
lea rcx, [r8 - 1]
mov qword [rsp + 0x38], r13
mov r12, rcx
mov qword [rsp + 0x28], rcx
sar r12, 1
mov rax, r8
mov qword [rsp + 0x20], rax
mov r15, r9
mov r13, rdx
mov rbp, rdx
mov r10, rdx
cmp rdx, r12
jge 0x18004ffd8
nop dword [rax]
nop word [rax + rax]
lea rbx, [r10 + r10]
lea rsi, [r14 + 0x10]
lea rsi, [rsi + rbx*8]
lea rdi, [rsi - 8]
mov rdx, rsi
mov r8, rdi
call fcn.18004fe00
movzx r10d, al
xor r10, 1
inc r10
add r10, rbx
test al, al
cmove rdi, rsi
mov rax, qword [rdi]
mov qword [r14 + r13*8], rax
mov r13, r10
cmp r10, r12
jl 0x18004ff90
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r13, qword [rsp + 0x38]
cmp r10, r12
mov r12, qword [rsp + 0x40]
mov rdi, r10
jne 0x18004fffa
test al, 1
jne 0x18004fffa
mov rax, qword [r14 + rax*8 - 8]
mov rdi, rcx
mov qword [r14 + r10*8], rax
cmp rbp, rdi
jge 0x18005003d
nop
lea rbx, [rdi - 1]
mov r8, r15
sar rbx, 1
lea rsi, [r14 + rbx*8]
mov rdx, rsi
call fcn.18004fe00
test al, al
je 0x18005003d
mov rax, qword [rsi]
mov qword [r14 + rdi*8], rax
mov rdi, rbx
cmp rbp, rbx
jl 0x180050000
mov rax, qword [r15]
mov qword [r14 + rbx*8], rax
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [r15]
mov qword [r14 + rdi*8], rax
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180051020
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800dd280]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov ecx, 0x28
call fcn.180099f50
mov rdi, rax
mov qword [rsp + 0x40], rax
mov rdx, rbx
mov rcx, rax
call fcn.18003bf10
lea rax, [0x1800508a0]
mov qword [rdi + 0x20], rax
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1800514a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180051104
cmp dword [rsp + 0x38], 0
jne 0x1800510ac
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x38], eax
jne 0x1800510c4
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x1800510ec
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180099f30
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x180051120
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800dd280]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov ecx, 0x28
call fcn.180099f50
mov rdi, rax
mov qword [rsp + 0x40], rax
mov rdx, rbx
mov rcx, rax
call fcn.18003bf10
lea rax, [0x180050a80]
mov qword [rdi + 0x20], rax
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1800514a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180051204
cmp dword [rsp + 0x38], 0
jne 0x1800511ac
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x38], eax
jne 0x1800511c4
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x1800511ec
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180099f30
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x180051220
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800dd280]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov ecx, 0x28
call fcn.180099f50
mov rdi, rax
mov qword [rsp + 0x40], rax
mov rdx, rbx
mov rcx, rax
call fcn.18003bf10
lea rax, [0x180050c60]
mov qword [rdi + 0x20], rax
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1800514a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180051304
cmp dword [rsp + 0x38], 0
jne 0x1800512ac
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x38], eax
jne 0x1800512c4
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x1800512ec
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180099f30
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x180051320
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1800dd280]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov ecx, 0x28
call fcn.180099f50
mov rdi, rax
mov qword [rsp + 0x40], rax
mov rdx, rbx
mov rcx, rax
call fcn.18003bf10
lea rax, [0x180050e40]
mov qword [rdi + 0x20], rax
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1800514a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180051404
cmp dword [rsp + 0x38], 0
jne 0x1800513ac
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x38], eax
jne 0x1800513c4
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x1800513ec
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180099f30
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x180054500
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180054553
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
mov qword [0x1800de818], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x180053790]
mov r9, rbx
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180054582
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
test edx, edx
jne 0x180054582
cmp dword [0x1800dee4c], edx
je 0x180054582
xor ecx, ecx
call fcn.180098310
mov rcx, qword [0x1800df838]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [0x1800df838], rax
mov dword [0x1800dee4c], eax
mov eax, 1
add rsp, 0x30
pop rbx
ret