joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180045250
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
cmp qword [rsp + 0x70], 0
jg 0x180045272
xor eax, eax
jmp 0x18004541b
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x68], 0
je 0x180045298
mov r8, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x18004541b
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jbe 0x180045331
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.180017f50
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x28]
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1800193c0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov edx, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x60]
cmp qword [rax + 0x80], 0
je 0x18004540b
mov rcx, qword [rsp + 0x60]
call fcn.1800434d0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x20], 0xfff
jbe 0x1800453d2
mov rax, qword [rsp + 0x60]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x30], 0xfff
je 0x1800453d0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
jmp 0x18004541b
jmp 0x180045357
cmp qword [rsp + 0x20], 0
jbe 0x18004540b
mov rax, qword [rsp + 0x60]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x58
ret
Function at 0x180045420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x180045459
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x180045547
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x1800454ef
cmp qword [rsp + 0x20], 0
jle 0x1800454ef
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x180045499
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.1800193c0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x180045537
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x180045537
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x180081280
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov eax, 0x35
movaps xmmword [rsp + 0x30], xmm7
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm8
mov rbx, rcx
movsd xmm8, qword [0x1800ce4d8]
cvtsi2sd xmm6, rax
test rax, rax
jns 0x1800812b9
addsd xmm6, xmm8
movaps xmm0, xmm8
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_log2]
divsd xmm6, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_ceil
movsd xmm6, qword [0x1800ce4d0]
mov ecx, 1
cvttsd2si eax, xmm0
xorps xmm7, xmm7
cmp eax, ecx
cmovl eax, ecx
test eax, eax
jle 0x1800813f3
mov qword [rsp + 0x60], rbp
movabs rbp, 0x38eb3ffff6d3
mov qword [rsp + 0x68], rsi
movabs rsi, 0xb5026f5aa96619e9
mov qword [rsp + 0x70], rdi
mov edi, eax
mov eax, dword [rbx]
cmp eax, 0x138
jne 0x18008136c
lea r8, [rbx + 0x10]
mov r9d, eax
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rsi
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x180081330
jmp 0x18008137b
cmp eax, 0x270
jb 0x18008137b
mov rcx, rbx
call fcn.180082670
mov eax, dword [rbx]
xorps xmm1, xmm1
mov rcx, qword [rbx + rax*8 + 8]
inc eax
mov dword [rbx], eax
mov rax, rcx
shr rax, 0x1d
and rax, qword [rbx + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rbp
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rax, rcx
shr rax, 0x2b
xor rax, rcx
cvtsi2sd xmm1, rax
jns 0x1800813cd
addsd xmm1, xmm8
mulsd xmm1, xmm6
mulsd xmm6, xmm8
addsd xmm7, xmm1
sub rdi, 1
jne 0x180081315
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x20]
divsd xmm7, xmm6
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret

Function at 0x180082670
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rcx
lea r9, [rcx + 0x9c8]
movabs rbx, 0xb5026f5aa96619e9
mov r11d, 0x9c
nop
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 + 0x4d8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x180082690
lea r9, [r10 + 0xea8]
mov r11d, 0x9b
nop word [rax + rax]
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 - 0xea8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x1800826e0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], r11d
ret
Function at 0x180083100
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x1800feb80]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
or r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x20
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1800831af
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_opening_Steam_key_n
jmp 0x180083277
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.SteamExe
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x180083265
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x180083265
shr ecx, 1
je 0x180083223
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
nop
cmp word [rax], 0x2f
jne 0x180083219
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x180083210
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, str.__s__steam:__rungameid__s
lea rcx, [rsp + 0x2d0]
call fcn.180082f90
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.180082bf0
jmp 0x18008327f
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.1800832a0
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.1800803c0
add rsp, 0xae0
pop rbx
ret
Function at 0x180083340
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800feb80]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x1800ce730]
xor edi, edi
movups xmm0, xmmword [str._pipediscord_ipc_0]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x1800ce734]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x1800ce718]
mov word [rsp + 0x6c], ax
mov eax, 0x30
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x1800ce728]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x180083444
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1800833f8
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x180083467
inc ax
mov word [rsp + 0x6a], ax
jmp 0x180083413
cmp eax, 0xe7
jne 0x180083467
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x180083467
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1800833d8
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1800803c0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x180083449

Function at 0x180083470
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x180083490
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x180083486
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x180083486
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18008351b
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x180083530
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x180083504
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call fcn.1800832f0
mov rbp, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x180083540
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
jne 0x180083556
mov al, 1
add rsp, 0x30
pop rdi
ret
test rcx, rcx
jne 0x180083563
xor al, al
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x18008355b
test rdx, rdx
je 0x18008355b
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x50]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18008359a
cmp dword [rsp + 0x50], edi
jne 0x18008359a
mov ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140c9f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140c9f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c9f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c9f06f
add dl, dl
jne 0x140c9f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c9f0f6
xor eax, eax
add dl, dl
jne 0x140c9f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c9f1ad
add dl, dl
jne 0x140c9f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c9f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c9f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c9f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c9f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c9f07e
mov eax, 1
add dl, dl
jne 0x140c9f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c9f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c9f0fb
sub eax, ebx
mov ebx, 1
jne 0x140c9f14c
mov ecx, 1
add dl, dl
jne 0x140c9f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c9f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c9f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c9f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c9f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c9f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c9f15d
cmp eax, 0x7d00
jae 0x140c9f19b
cmp eax, 0x500
jb 0x140c9f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c9f07e
cmp eax, 0x7f
ja 0x140c9f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c9f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c9f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c9f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180039c84
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1802a9070]
xor rax, rsp
mov qword [rsp + 0x90], rax
movss xmm6, dword [0x180289780]
movss dword [rsp + 0x24], xmm6
mov rdx, qword [rcx]
cmp rdx, 2
jb 0x180039e66
mov ecx, 0x68
mov dword [rsp + 0x20], ecx
mov eax, dword [0x1802dbca4]
cmp eax, 0x9f3
jl 0x180039cee
mov ecx, 0x70
jmp 0x180039d00
add eax, 0xfffff766
mov r8d, 0x40
cmp eax, 0x45
cmovbe ecx, r8d
mov dword [rsp + 0x20], ecx
movsxd rax, ecx
mov rcx, qword [rax + rdx]
test rcx, rcx
jne 0x180039d18
movaps xmm0, xmm6
jmp 0x180039e69
mov r14d, dword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
test rsi, rsi
jne 0x180039d2d
movaps xmm0, xmm6
jmp 0x180039e69
xor ebx, ebx
movabs r15, 0xb54b2e4fc0792a6a
mov dword [rsp + 0x28], ebx
cmp ebx, r14d
jge 0x180039e5e
lea eax, [rbx*8]
movsxd rcx, eax
mov rdi, qword [rcx + rsi + 0x20]
and qword [rsp + 0x30], 0
mov qword [rsp + 0x30], rdi
test rdi, rdi
jne 0x180039d6a
jmp 0x180039e57
lea rcx, [rsp + 0x30]
call fcn.180039a40
movsd xmm0, qword [rax]
movsd qword [rsp + 0x38], xmm0
mov eax, dword [rax + 8]
mov dword [rsp + 0x40], eax
mov rax, qword [rdi]
cmp byte [rsp + 0x38], 0
je 0x180039e57
movabs rcx, 0x2c22df090760ed5b
mov qword [rsp + 0x50], rcx
movabs rcx, 0xc5fc86a0e88a647c
mov qword [rsp + 0x58], rcx
movabs rcx, 0x2c4a6382159617d8
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], r15
movabs rcx, 0x4556bc6c6d0f9f0b
mov qword [rsp + 0x70], rcx
movabs rcx, 0xab93f6c18ddd0110
mov qword [rsp + 0x78], rcx
movabs rcx, 0x2c4a638215f27895
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], r15
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x60], xmm1
lea rdx, [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call fcn.180195c70
test rax, rax
je 0x180039e57
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [0x180289744]
jb 0x180039e5e
comiss xmm6, xmm0
jb 0x180039e5e
mulss xmm6, xmm0
movss dword [rsp + 0x24], xmm6
jmp 0x180039e5e
inc ebx
jmp 0x180039d39
jmp 0x180039e66
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1801937d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
ret
Function at 0x180062148
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1802a9070]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 0x5a4d
mov r14, r9
mov rbp, r8
cmp word [rdx], ax
jne 0x1800621ed
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1800621ed
movzx esi, word [rcx + 0x14]
xor r11d, r11d
movzx ebx, word [rcx + 6]
add rsi, rcx
test rbx, rbx
je 0x1800621ed
xor r8d, r8d
lea rcx, [rsi + 0x18]
test dword [rcx + 0x24], 0x20000
jne 0x1800621de
mov rax, qword [rcx]
mov rdi, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
sub rdi, rax
mov byte [rsp + 0x38], 0
movzx r9d, byte [rax]
movzx r10d, byte [rax + rdi]
sub r9d, r10d
jne 0x1800621d9
inc rax
test r10d, r10d
jne 0x1800621c3
test r9d, r9d
je 0x180062211
inc r11d
inc r8
add rcx, 0x28
cmp r8, rbx
jl 0x1800621a2
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801937d0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
movsxd rax, r11d
mov r9, r14
lea rcx, [rax + rax*4]
mov ebx, dword [rsi + rcx*8 + 0x24]
mov r8d, dword [rsi + rcx*8 + 0x20]
add rbx, rdx
mov rdx, rbx
call fcn.180062050
cmp rax, 0xffffffffffffffff
je 0x1800621ed
add rax, rbx
jmp 0x1800621ef
Function at 0x180079a60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
test rax, rax
je 0x180079a9e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
add eax, 0xffffff80
test eax, 0xffffff7f
je 0x180079a9e
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180079b14
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180079b14
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x8f4ff7b9
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x180079b10
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x180079af0
cmp r11d, 0x4e0269f9
je 0x180079b19
test edx, edx
jne 0x180079ad3
mov rax, qword [rax]
jmp 0x180079aaf
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbx
add rax, r8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x180079fcc
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18007a01f
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rcx, rbx
call fcn.180078008
call fcn.180079a60
call fcn.180079b48
and qword [rsp + 0x28], 0
lea r8, [0x180079204]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18007a01f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x18007a3cc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18007a3f1
xor eax, eax
jmp 0x18007a4ee
cmp qword [rcx + 0x68], 0
je 0x18007a402
call fcn.18007c76c
jmp 0x18007a4ee
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x18007a419
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18007a41b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18007a450
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.180196160
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18007a4e8
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x18007a48b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x18007a4c3
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.18019fcbc
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x18007a4ff
cmp rbp, r15
ja 0x18007a499
mov r8, rbx
test rbx, rbx
je 0x18007a4e8
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.18019fcbc
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x18007a4eb