joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001eb10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1802ec038]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18001ebe3
cmp byte [rcx + 0x71], 0
je 0x18001ebe3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18001ebdf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18001eba4
sub eax, 1
je 0x18001eba8
cmp eax, 2
jne 0x18001ebdf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18011a030
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18001ebd6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18001ebdf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18001eb8c
xor al, al
jmp 0x18001eb8c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18011a030
add rsp, 0x60
pop rbx
ret
Function at 0x1800533b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800533ea
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [0x18032e128]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [0x18032e138]
call fcn.180052c20
lea rax, [rdi - 1]
mov qword [0x18032e150], rax
mov qword [0x18032e158], rdi
lea rax, [0x18032e120]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18032e128]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180053534
movabs rsi, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
mov rcx, qword [rcx]
movzx r11d, byte [rax + 0x10]
xor r11, rsi
imul r11, rdi
movzx edx, byte [rax + 0x11]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x12]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x13]
xor r11, rdx
imul r11, rdi
and r11, qword [0x18032e150]
shl r11, 4
add r11, qword [0x18032e138]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800534b3
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180053528
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800534f0
mov r10, qword [rdx]
cmp r10, rax
je 0x1800534ea
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180053528
cmp r9, rdx
je 0x180053504
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18005354d
cmp r9, rdx
jne 0x1800534f5
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180053460
mov qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180053528
Function at 0x180053850
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1800538b1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180053870
mov ecx, dword [r9]
jmp 0x180053998
cmp ecx, 0x4e0
jb 0x180053998
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800538d0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180053920
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x18005cd00
Capabilities:
Hide graphical window
Terminate process

Disassembly:
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rbx, rcx
add rcx, 0x578
lea rdx, [rbx + 0x4a0]
call fcn.18007adc0
lea rcx, [rbx + 0x5d0]
lea rdx, [rbx + 0x1b8]
call fcn.18007adc0
lea rcx, [rbx + 0x628]
lea rdx, [rbx + 0x248]
call fcn.18007adc0
lea rcx, [rbx + 0x680]
lea rdx, [rbx + 0x2d8]
call fcn.18007adc0
lea rcx, [rbx + 0x6d8]
call fcn.18007ad40
test al, al
je 0x18005cde0
cmp byte [rbx + 0x528], 0
je 0x18005cde0
cmp byte [rbx + 0x4e0], 0
jne 0x18005cde0
lea rcx, [rbx + 0x4e8]
call fcn.180037850
mov rbx, rax
lea rdx, str.enabled
lea rcx, [rsp + 0x40]
call fcn.18001e840
nop
lea rdx, str.functions:Settings:fastExit
lea rcx, [rsp + 0x20]
call fcn.18001e840
nop
mov r8, rbx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.1800401e0
nop
lea rcx, [rsp + 0x20]
call fcn.18001e7a0
nop
lea rcx, [rsp + 0x40]
call fcn.18001e7a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp byte [rbx + 0x318], 0
je 0x18005cdf6
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov edx, 5
jmp 0x18005cdfe
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
cmp byte [rbx + 0x1f8], 0
je 0x18005ce8d
movzx ebx, byte [rbx + 0x240]
mov rax, qword [0x1802f1640]
mov rcx, qword [rax + 0x38]
mov rcx, qword [rcx + 0x60]
mov rcx, qword [rcx + 8]
call fcn.180092d80
mov eax, 0x306b
mov r8d, 0x306f
test bl, bl
cmovne r8d, eax
xor edx, edx
lea rcx, str.FPS
call fcn.1800901e0
mov rax, qword [0x1802f1640]
movss xmm6, dword [rax + 0xd4]
cvtps2pd xmm6, xmm6
lea rcx, str.FPS_TITLE
call fcn.180076d10
movaps xmm2, xmm6
movq r8, xmm6
mov rdx, rax
lea rcx, str._s:__.1f
call fcn.1800b63d0
call fcn.180092e20
call fcn.180092620
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
ret
Function at 0x18005f260
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x18005f2c7
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x18005f282
mov ecx, dword [r10]
jmp 0x18005f3d6
cmp ecx, 0x270
jb 0x18005f3d6
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
lea rbx, [rbx + 8]
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, rdx
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x18005f300
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x18005f351
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x18005f910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1802ec038]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x180327a58]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x18005f9e7
mov rax, qword [rdi]
test rax, rax
je 0x18005f9a5
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x18005f9a5
test rsi, rsi
je 0x18005f9a5
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18005f9a5
cmp dword [rsp + 0x30], ebx
je 0x18005f9e7
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x18005f9c4
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x18005f9c4
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
jmp 0x18005f9e9
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18011a030
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1800632c0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1802ec038]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], r8
lea rbx, [rcx + 8]
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x180063309
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
jne 0x180063324
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsi + 0x58]
call fcn.1800638d0
test rax, rax
jne 0x180063356
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
lea rcx, [rsi + 0x58]
call fcn.180063d50
mov rcx, qword [rax]
add rcx, 0x18
call fcn.180063580
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
lea rcx, [rsi + 0x58]
call fcn.180063d50
mov rdi, qword [rax]
mov r8, qword [rsp + 0x48]
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x49]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4a]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4b]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4c]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4d]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4e]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x4f]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rdi + 0x48]
and rcx, rdx
shl rcx, 4
add rcx, qword [rdi + 0x30]
mov rax, qword [rcx + 8]
cmp rax, qword [rdi + 0x20]
je 0x180063417
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x180063419
cmp rax, rcx
je 0x180063417
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x180063406
jmp 0x180063419
xor eax, eax
test rax, rax
jne 0x180063440
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [rdi + 0x18]
call fcn.180063ae0
mov rdx, qword [rax]
mov byte [rdx + 0x18], 0
mov qword [rdx + 0x20], 0
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x38]
lea rcx, [rdi + 0x18]
call fcn.180063ae0
mov rdi, qword [rax]
call qword [0x1802f1a50]
mov r14, rax
mov ecx, dword [rsi]
add rcx, qword [rdi + 0x20]
cmp rcx, rax
jbe 0x180063470
movzx ebp, byte [rdi + 0x18]
jmp 0x18006348f
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x50]
call qword [rax + 8]
movzx ebp, al
mov ecx, dword [rsi]
add rcx, r14
mov byte [rdi + 0x18], al
mov qword [rdi + 0x20], rcx
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
movzx eax, bpl
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18011a030
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800638d0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
xor r8d, r8d
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x18006398a
mov rcx, qword [r10]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x18006398d
nop word [rax + rax]
cmp rax, rdx
je 0x18006398a
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180063970
test rax, rax
setne r8b
mov rax, r8
ret
mov rax, r8
test rax, rax
setne r8b
mov rax, r8
ret

Function at 0x1800639a0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
mov r10, rdx
mov r9, rcx
movzx r8d, byte [rdx]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rdx + 1]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 2]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 3]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 4]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 5]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 6]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 7]
xor r8, rax
imul r8, rcx
mov rdx, qword [r9 + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rbx, qword [rdx + 8]
mov r8, qword [r9 + 8]
cmp rbx, r8
je 0x180063a51
mov rcx, qword [rdx]
mov rax, qword [r10]
cmp rax, qword [rbx + 0x10]
je 0x180063a53
cmp rbx, rcx
je 0x180063a51
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x180063a40
jmp 0x180063a53
xor ebx, ebx
test rbx, rbx
je 0x180063ac9
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x180063a79
cmp rax, rbx
jne 0x180063a6f
mov qword [rdx], r8
mov qword [rdx + 8], r8
jmp 0x180063a84
mov r8, qword [rbx + 8]
mov qword [rdx + 8], r8
jmp 0x180063a84
cmp rax, rbx
jne 0x180063a84
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rax, [rbx + 0x10]
mov qword [rsp + 0x20], rax
lea rcx, [rax + 8]
mov qword [rsp + 0x28], rcx
call fcn.1800489c0
mov edx, 0x58
mov rcx, rbx
call fcn.18011a050
mov eax, 1
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x180064400
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180064440
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.180052c20
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x20], rsi
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18006459f
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
mov rcx, qword [rcx]
movzx r9d, byte [rax + 0x10]
xor r9, rbp
imul r9, rdi
movzx edx, byte [rax + 0x11]
xor r9, rdx
imul r9, rdi
movzx edx, byte [rax + 0x12]
xor r9, rdx
imul r9, rdi
movzx edx, byte [rax + 0x13]
xor r9, rdx
imul r9, rdi
movzx edx, byte [rax + 0x14]
xor r9, rdx
imul r9, rdi
movzx edx, byte [rax + 0x15]
xor r9, rdx
imul r9, rdi
movzx edx, byte [rax + 0x16]
xor r9, rdx
imul r9, rdi
movzx edx, byte [rax + 0x17]
xor r9, rdx
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18006451c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180064593
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180064559
mov r10, qword [rdx]
cmp r10, rax
je 0x180064553
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180064593
cmp r9, rdx
je 0x18006456f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1800645bb
cmp r9, rdx
jne 0x180064560
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1800644a0
mov qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180064593
Function at 0x180068aa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov edx, 0x12d
lea r8d, [rbp + 0xa]
mov rcx, qword [0x18032c198]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x180068b3a
mov rdx, rax
mov rcx, qword [0x18032c198]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x180068b3a
mov rdx, rdi
mov rcx, qword [0x18032c198]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LockResource]
test edi, edi
je 0x180068b3a
test rax, rax
je 0x180068b3a
mov r8d, edi
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov rdx, rax
mov rcx, rbx
call fcn.180022b00
jmp 0x180068b4f
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
mov byte [rbx], bpl
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180068df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x180068f83
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x180068f83
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x180068e89
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x180068fa7
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x180068e9f
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x180068e9f
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x180068eb2
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x180068efd
mov r9d, eax
cmp eax, 0x800
jae 0x180068ecc
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x180068efd
cmp eax, 0x10000
jae 0x180068ee6
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x180068efd
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x180068f83
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x180068f21
cmp r10d, 3
jae 0x180068f2d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x180068f5e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x180068f40
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x180068e3e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x180068f92
Function at 0x18007c270
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdx, qword [0x1802f1640]
mov rdi, rcx
test r8b, r8b
je 0x18007c29c
movss xmm1, dword [rdx + 0x3944]
xorps xmm0, xmm0
call fcn.180096100
add rdx, 0x39e8
xor ecx, ecx
call fcn.180086b20
mov rcx, rdi
call fcn.1800b63d0
mov r8, qword [0x1802f1640]
movsxd rax, dword [r8 + 0x4a68]
cmp eax, 1
jl 0x18007c2ed
mov rcx, qword [r8 + 0x4a70]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4 - 0x14]
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
add rax, rax
movups xmmword [r8 + rax*8 + 0x39d8], xmm0
dec dword [r8 + 0x4a68]
xor ecx, ecx
call fcn.1800899e0
test al, al
je 0x18007c3d0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180093e70
test al, al
je 0x18007c32d
mov dword [rsp + 0x28], 5
xor r9d, r9d
mov r8, rbx
mov qword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r8, qword [0x1802f1640]
lea rcx, [rsp + 0x40]
movups xmm0, xmmword [r8 + 0x39e8]
mov rax, qword [r8 + 0x4010]
movsd xmm1, qword [r8 + 0x49ac]
movaps xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [r8 + 0x49b4]
movaps xmm2, xmm0
movsd qword [rsp + 0x30], xmm1
shufps xmm2, xmm2, 0x55
movss dword [rsp + 0x34], xmm2
movsd qword [rsp + 0x38], xmm0
mov byte [rax + 0xc0], 1
call fcn.1800863d0
mov rcx, qword [r8 + 0x4010]
lea rdx, [rsp + 0x30]
movss xmm0, dword [0x1802bf3ec]
lea r8, [rsp + 0x38]
mov r9d, eax
movss dword [rsp + 0x20], xmm0
mov rcx, qword [rcx + 0x2a8]
call fcn.1800aac90
lea rcx, str.OPEN_IN_BROWSER
call fcn.180076d10
mov rdx, rax
lea rcx, str._s_n_s
mov r8, rbx
call fcn.180097250
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret