joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011645
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001fc90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001fcb0
xor al, al
jmp 0x14001fd31
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001fcc3
xor al, al
jmp 0x14001fd31
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001fced
xor al, al
jmp 0x14001fd31
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001fd01
xor al, al
jmp 0x14001fd31
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001fd13
xor al, al
jmp 0x14001fd31
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001fd2f
xor al, al
jmp 0x14001fd31
mov al, 1
add rsp, 0x38
ret
Function at 0x1400118c0
Capabilities:
Write file on windows

Disassembly:
jmp 0x140018060
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x14002d040]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x140034066]
call fcn.1400118d9
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x1400180c6
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400180cd
mov al, 1
jmp 0x14001821d
call fcn.140011294
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.140011294
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.140011712
movzx eax, al
test eax, eax
je 0x14001811e
xor al, al
jmp 0x14001821d
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x140018183
cmp dword [rbp + 0x154], 1
je 0x14001818e
cmp dword [rbp + 0x154], 3
je 0x14001820c
jmp 0x14001821b
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1400181de
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1400181de
xor al, al
jmp 0x14001821d
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400181f9
mov dword [rbp + 0x154], 1
jmp 0x140018203
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14001821d
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14001821d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140027890]
call fcn.140011762
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140011456
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1800093f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2050
call fcn.1800548c0
sub rsp, rax
mov ebp, edx
mov rsi, r9
add edx, 0xfffffff8
mov r14, r8
mov dword [rsp + 0x2098], edx
mov rdi, rcx
mov ebx, dword [rsp + 0x2098]
cmp ebp, edx
jbe case.0x180009472.0
mov r12, qword [rsp + 0x20b8]
lea r15d, [rbp - 0xa4]
mov r13, qword [rsp + 0x30]
mov r11d, 0xffffffff
lea r9, [0x180000000]
mov r8d, 0x2000
cmp r15d, 0x11
ja case.0x180009472.2
mov ecx, dword [r9 + r15*4 + 0x96a0]
add rcx, r9
jmp rcx
mov eax, dword [r14]
mov r13d, dword [rdi]
imul r13, rax
mov rax, qword [rsp + 0x20b0]
mov eax, dword [rax]
imul r13, rax
jmp case.0x180009472.2
mov r9d, 0xff
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.18004f9b0
mov qword [r12 + 8], rax
jmp 0x180009643
mov rax, qword [rdi]
test rax, rax
jle case.0x180009472.7
nop word [rax + rax]
cmp rax, r8
lea rcx, [rsp + 0x50]
mov r9, rsi
mov edx, 1
cmova rax, r8
mov r8, rax
mov rbx, rax
call fcn.18005f73c
cmp rax, rbx
jne 0x180009686
mov r9, r12
lea rcx, [rsp + 0x50]
mov r8, rbx
mov edx, 1
call fcn.18006018c
cmp rax, rbx
jne 0x18000967b
mov rax, qword [rdi]
mov r8d, 0x2000
sub rax, rbx
mov qword [rdi], rax
test rax, rax
jg 0x1800094c0
mov edx, dword [rsp + 0x2098]
mov r11d, 0xffffffff
mov ebx, 1
jmp case.0x180009472.2
xor r8d, r8d
mov edx, 0x94
mov rcx, rsi
call fcn.180022b80
mov dword [r12], eax
jmp 0x180009643
mov rax, qword [rsp + 0x20b0]
xor edx, edx
mov r9d, dword [rdi]
mov r8d, dword [rax]
mov rax, r11
div r8
cmp r9, rax
ja 0x18000968d
mov r10d, dword [r14]
xor edx, edx
mov rax, r11
mov ecx, r8d
div r10
imul rcx, r9
cmp rcx, rax
ja 0x18000968d
lea r14, [rsi + 0x58]
cmp qword [rsi + 0x60], r13
jae 0x1800095ee
mov rdx, qword [r14]
lea rcx, [rsp + 0x30]
mov r8d, 0xc0
mov qword [rsp + 0x30], r13
call fcn.180045d60
mov qword [r14], rax
test rax, rax
jne 0x1800095d1
xor r9d, r9d
mov qword [rsp + 0x30], r13
lea r8, [rsp + 0x30]
xor ecx, ecx
lea edx, [rax + 0x27]
call fcn.180016f60
mov qword [r14], rax
test rax, rax
je 0x180009691
mov rax, qword [rsp + 0x20b0]
mov r10, qword [rsp + 0x20a0]
mov qword [rsi + 0x60], r13
mov r9d, dword [rdi]
mov r8d, dword [rax]
mov r10d, dword [r10]
mov dword [rsp + 0x30], r8d
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x38], r9d
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], r14
mov r8d, 0x107
mov dword [rsp + 0x40], r10d
mov qword [rsp + 0x20], r12
call fcn.180039100
mov rcx, qword [r14]
lea r9, [rsp + 0x30]
mov r8, rsi
mov dword [rsp + 0x30], r13d
mov edx, 0x22
call fcn.180014610
mov r14, qword [rsp + 0x20a0]
mov edx, dword [rsp + 0x2098]
mov r11d, 0xffffffff
add ebp, r11d
add r15d, r11d
cmp ebp, edx
ja 0x180009450
mov eax, ebx
mov rbx, qword [rsp + 0x2090]
add rsp, 0x2050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [r14], 8
xor eax, eax
jmp 0x180009660
mov dword [r14], 6
xor eax, eax
jmp 0x180009660
mov qword [rsi + 0x60], 0
xor eax, eax
jmp 0x180009660
Function at 0x18000a030
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
lea esi, [r9 + 7]
mov qword [rax - 0x38], 0
mov qword [rax - 0x30], 0xf
mov r15, r8
mov byte [rax - 0x48], 0
mov rdi, rdx
mov r14, rcx
cmp r9d, esi
jae 0x18000a253
mov qword [rax + 8], rbx
lea ebx, [r9 - 0x5c]
mov qword [rax + 0x10], rbp
movzx ebp, byte [rsp + 0xb8]
mov qword [rax - 0x28], r12
lea r12, [0x180000000]
cmp ebx, 9
ja case.0x18000a09a.4
mov ecx, dword [r12 + rbx*4 + 0xa26c]
add rcx, r12
jmp rcx
movzx eax, word [rdi + 0x1c]
mov word [rsp + 0xb8], ax
jmp case.0x18000a09a.4
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x48]
mov r9d, 0x68
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.180042920
mov byte [rsp + 0xb8], bpl
jmp case.0x18000a09a.4
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x18000a0f1
mov rdx, qword [rdi]
movzx eax, word [rdi + 0x60]
lea r8, [rsp + 0x30]
mov r9d, 0x64
mov word [rsp + 0x30], ax
mov rcx, r14
call fcn.1800062f0
test al, al
je 0x18000a1fd
mov r9, rdi
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0xb5
call fcn.180007620
jmp case.0x18000a09a.4
mov rax, qword [r14]
lea r9, [rsp + 0x40]
mov r8d, 0xb1
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.180014180
test al, al
je 0x18000a1fd
mov rax, qword [r14]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov r8, r15
mov edx, 0xe1
mov qword [rsp + 0x20], rax
call fcn.18002c600
movzx ebp, al
jmp case.0x18000a09a.4
mov r10d, dword [rdi + 0x18]
test r10d, r10d
je case.0x18000a09a.4
mov ecx, dword [rdi + 0x14]
mov rax, qword [rdi]
mov r8d, dword [rdi + 0x20]
mov r11, qword [rax + rcx*8]
cmp r8d, r10d
jae case.0x18000a09a.4
mov r9d, dword [rdi + 0x1c]
nop word [rax + rax]
mov eax, r9d
mov ecx, 0x38
sub ecx, r8d
shr rax, 8
add r8d, 8
mov rdx, r11
shr rdx, cl
movzx ecx, dl
xor rcx, rax
movzx eax, r9b
shl eax, 8
mov r9d, dword [r12 + rcx*4 + 0x80530]
xor r9d, eax
mov dword [rdi + 0x20], r8d
mov dword [rdi + 0x1c], r9d
cmp r8d, r10d
jb 0x18000a1b0
inc ebx
lea eax, [rbx + 0x5c]
cmp eax, esi
jb 0x18000a086
jmp case.0x18000a09a.3
mov byte [rsp + 0xb8], 0
mov rdx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
cmp rdx, 0x10
jb 0x18000a253
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a24e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000a266
call fcn.180054514
movzx eax, word [rsp + 0xb8]
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
ret
call fcn.180058754
int3
Function at 0x18000dc20
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
lea r10d, [rcx + 7]
cmp ecx, r10d
jae 0x18000dcdf
lea r9d, [rcx - 0x3d]
xor ebx, ebx
lea r11, [0x180000000]
cmp r9d, 0x10
ja case.0x18000dc55.2
mov ecx, dword [r11 + r9*4 + 0xdd18]
add rcx, r11
jmp rcx
mov rax, qword [rdx]
inc dword [rax + 0x20]
jmp case.0x18000dc55.2
mov qword [rdx + 0x58], rbx
mov qword [rdx + 0x60], rbx
jmp case.0x18000dc55.2
mov dword [rdx + 0x54], ebx
jmp case.0x18000dc55.2
mov dword [rdx + 0x40], 0x67452301
mov dword [rdx + 0x44], 0xefcdab89
mov dword [rdx + 0x48], 0x98badcfe
mov qword [rdx + 0x4c], 0x10325476
jmp case.0x18000dc55.2
mov rax, qword [r8]
mov dword [rax + 4], ebx
mov rax, qword [rdx + 8]
mov rcx, qword [rax + 8]
mov qword [r8 + 8], rcx
mov rax, qword [rdx + 8]
mov qword [r8 + 0x10], rax
test rcx, rcx
jne 0x18000dcbd
mov rax, qword [rdx]
mov qword [rax + 0x10], r8
mov rax, qword [rdx + 8]
mov qword [rax + 8], r8
jmp case.0x18000dc55.2
mov qword [rcx + 0x10], r8
mov rax, qword [rdx + 8]
mov qword [rax + 8], r8
jmp case.0x18000dc55.2
cmp dword [rdx], ebx
je 0x18000dce9
inc r9d
lea eax, [r9 + 0x3d]
cmp eax, r10d
jb 0x18000dc40
mov eax, dword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov eax, 0x20
add rsp, 0x20
pop rbx
ret
mov eax, dword [rdx]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov r8d, 0xf3
xor ecx, ecx
call fcn.1800459c0
add rsp, 0x20
pop rbx
ret
Function at 0x180022570
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
imul r15d, ecx, 0x402
mov r14, r8
mov rdi, rdx
mov ebp, ecx
mov esi, ecx
cmp ecx, r15d
ja 0x180022793
mov r12, qword [rsp + 0xb8]
xor r13d, r13d
nop dword [rax]
cmp esi, 0x587f
ja 0x1800226f7
je 0x1800226d1
mov eax, esi
sub eax, 0x2c
je 0x1800226ba
sub eax, 0x99
je 0x18002266d
sub eax, 0x16
je 0x1800225ef
cmp eax, 0x12e9
jne 0x180022785
mov eax, dword [rdi]
jmp 0x18002279a
mov rcx, qword [0x18009dfc0]
mov ebx, 0xee
nop dword [rax + rax]
mov eax, ebx
sub eax, 0xec
je 0x180022793
sub eax, 1
je 0x18002264f
cmp eax, 1
jne 0x18002265a
mov qword [0x18009dfb8], rdi
lea r8, [0x18002c850]
mov qword [rsp + 0x28], r13
mov r9, rdi
xor edx, edx
mov qword [rdi + 0x80], r14
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov qword [0x18009dfc0], rax
jmp 0x18002265a
test rcx, rcx
setne byte [rsp + 0xa0]
dec ebx
cmp ebx, 0xeb
ja 0x180022600
mov dword [rdi + 8], r13d
jmp 0x180022785
mov r8d, 5
lea rdx, [0x180082dd6]
lea rcx, [rsp + 0x30]
call fcn.1800591c0
mov eax, dword [0x180082e0e]
lea rdx, [0x180082e2e]
mov dword [rsp + 0x35], eax
lea rcx, [rsp + 0x3a]
movzx eax, byte [0x180082e12]
mov r8d, 1
mov byte [rsp + 0x39], al
mov byte [rsp + 0x3a], r13b
call fcn.1800591c0
jmp 0x180022785
xor edx, edx
mov r8, rdi
lea ecx, [rdx + 0x59]
call fcn.180016a80
mov eax, dword [r14]
add dword [rdi], eax
jmp 0x180022785
mov eax, dword [0x180082d78]
mov dword [rsp + 0x40], eax
movzx eax, word [0x180082d7c]
mov word [rsp + 0x44], ax
mov byte [rsp + 0x3b], r13b
mov word [rsp + 0x46], r13w
jmp 0x180022785
cmp esi, 0xb039
je 0x18002275d
cmp esi, 0x107f3
je 0x180022743
cmp esi, 0x15fad
je 0x18002271d
cmp esi, 0x1b767
jne 0x180022785
mov dword [rdi + 8], r13d
jmp 0x180022785
mov r9d, 0x30
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.180005bc0
test al, al
je 0x180022793
mov rcx, qword [rdi]
call r12
mov qword [rdi], 0xffffffffffffffff
jmp 0x180022785
mov r8d, 0xd4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.180006430
mov r12, rax
jmp 0x180022785
movsd xmm0, qword [0x180082dba]
movzx eax, word [0x180082dc2]
movsd qword [rsp + 0x46], xmm0
mov word [rsp + 0x4e], ax
mov dword [rsp + 0x50], 0x6c006c
mov word [rsp + 0x54], r13w
imul eax, ebp, 0x72
add esi, eax
cmp esi, r15d
jbe 0x1800225b0
mov eax, dword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180036910
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2030
call fcn.1800548c0
sub rsp, rax
mov ebx, dword [rsp + 0x2060]
lea r15d, [rcx + 4]
mov r14, r9
mov rdi, r8
mov r12, rdx
mov ebp, ecx
cmp ecx, r15d
jae 0x180036a9a
xor r13d, r13d
nop word [rax + rax]
mov eax, ebp
sub eax, 0x123
je 0x180036a22
sub eax, 1
je 0x180036a1b
sub eax, 1
je 0x180036a9a
cmp eax, 2
jne 0x180036a8f
cmp byte [rdi + 0x121], r13b
jne 0x180036ae7
movzx eax, byte [rdi + 0x122]
test al, al
jne 0x180036ad1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x11e
call fcn.180006a00
test al, al
je 0x180036abd
xor edx, edx
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x22]
call fcn.180015020
cmp rax, 2
je 0x180036abd
xor r8d, r8d
mov rdx, rdi
lea ecx, [r8 + 0x44]
call fcn.180024a40
xor r9d, r9d
test al, al
je 0x180036a07
xor r8d, r8d
lea ecx, [r9 + 0x19]
mov rdx, rdi
call fcn.18001fb70
jmp 0x180036a8f
xor edx, edx
mov qword [rsp + 0x20], r13
mov r8, rdi
lea ecx, [rdx + 0x21]
call fcn.18002bf00
jmp 0x180036a8f
mov ebx, 1
jmp 0x180036a8f
mov rcx, rdi
call fcn.18005f244
test eax, eax
jne 0x180036a8f
nop
mov r9, rdi
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8d, 0x2000
call fcn.18005f73c
mov rsi, rax
test rax, rax
jne 0x180036a69
mov rcx, rdi
call fcn.18005f244
test eax, eax
jne 0x180036a83
mov dword [r12], 6
mov eax, r13d
jmp 0x180036a9c
mov r9, r14
lea rcx, [rsp + 0x30]
mov r8, rsi
mov edx, 1
call fcn.18006018c
cmp rax, rsi
jne 0x180036b02
mov rcx, rdi
call fcn.18005f244
test eax, eax
je 0x180036a30
inc ebp
cmp ebp, r15d
jb 0x180036960
mov eax, ebx
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea ecx, [r9 + 0x19]
call fcn.18001fb70
jmp 0x180036a9a
mov edx, 0x125
mov rcx, rdi
call fcn.1800487e0
mov byte [rdi + 0x122], r13b
jmp 0x180036a9a
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
lea ecx, [r9 + 0x19]
call fcn.18001fb70
mov byte [rdi + 0x121], r13b
jmp 0x180036a9a
mov dword [r12], 8
mov eax, r13d
jmp 0x180036a9c

Function at 0x180036fc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180036ff4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180036fe0
ret
Function at 0x180037bb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x50]
mov r14, r9
imul r15d, ecx, 0x2bc
mov rsi, r8
mov ebp, ecx
mov edi, ecx
cmp ecx, r15d
ja 0x180037c06
mov r12, qword [rsp + 0x70]
cmp edi, 0x2b
je 0x180037c81
cmp edi, 0x49ce
je 0x180037c23
cmp edi, 0x9316
je 0x180037c1f
cmp edi, 0xdc5e
jne 0x180037c6e
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
xor ebx, ebx
jmp 0x180037c6e
mov r9, qword [rsi + 8]
mov edx, 1
mov r8, qword [r14]
mov rcx, r12
mov r9, qword [r9 + 0x2278]
call fcn.18005f73c
mov qword [r14], rax
test rax, rax
jne 0x180037c6e
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x2278]
call fcn.18005f244
test eax, eax
jne 0x180037cb8
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x2278]
call fcn.18005f270
test eax, eax
jne 0x180037cc9
imul eax, ebp, 0x8c
add edi, eax
cmp edi, r15d
jbe 0x180037be5
jmp 0x180037c06
mov r8, qword [r14]
test r8, r8
je 0x180037cc9
mov r9, qword [rsi + 8]
mov edx, 1
mov rcx, r12
mov r9, qword [r9 + 0x68]
call fcn.18005f73c
mov qword [r14], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + 0x68]
call fcn.18005f270
test eax, eax
jne 0x180037cc9
cmp qword [r14], 0
jne 0x180037cc2
mov eax, 1
jmp 0x180037c08
xor eax, eax
jmp 0x180037c08
mov eax, 2
jmp 0x180037c08
Function at 0x180038d10
Capabilities:
Move file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
imul eax, ecx, 0x1c4
mov r15, r9
mov r13d, ecx
mov ebp, ecx
mov dword [rsp + 0x30], eax
cmp ecx, eax
ja 0x180038d86
mov r12, qword [r11 + 0x28]
mov rsi, qword [r11 - 0x50]
mov rdi, qword [r11 - 0x48]
mov r14d, dword [r11 - 0x60]
nop dword [rax + rax]
mov eax, ebp
sub eax, 0x35
je 0x180038e37
sub eax, 0xa7
je 0x180038da3
sub eax, 0x33
je 0x180038e71
cmp eax, 0x168b
jne 0x180038e5c
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp dword [0x18009e000], 0
je 0x180038f01
mov ebx, 0x61
mov eax, ebx
sub eax, 0x61
je 0x180038de4
sub eax, 1
je 0x180038e26
sub eax, 1
je 0x180038dd2
cmp eax, 1
jne 0x180038e2e
mov dword [rsp + 0x40], r14d
jmp 0x180038d86
mov rcx, rsi
call fcn.18005932c
mov rcx, rdi
call fcn.18005932c
jmp 0x180038e2e
xor edi, edi
mov rdx, r12
xor ecx, ecx
lea r8d, [rdi + 0x57]
lea r14d, [rdi - 1]
call fcn.180050d80
mov rsi, rax
test rax, rax
je 0x180038e26
lea r8d, [rdi + 0x57]
mov rdx, r15
xor ecx, ecx
call fcn.180050d80
mov rdi, rax
test rax, rax
je 0x180038e26
mov rdx, rax
mov rcx, rsi
call fcn.18005e3c0
mov r14d, eax
jmp 0x180038e2e
mov ebx, 0x62
lea ebp, [rbx + 0x7a]
inc ebx
cmp ebx, 0x65
jb 0x180038db5
jmp 0x180038e5c
mov r9, r15
mov dword [rsp + 0x20], 0x116
mov r8, r12
xor edx, edx
xor ecx, ecx
call fcn.180016020
test rax, rax
je 0x180038f15
mov qword [rsp + 0x40], rax
imul eax, r13d, 0x71
add ebp, eax
cmp ebp, dword [rsp + 0x30]
ja 0x180038d86
jmp 0x180038d60
mov r10, qword [r15]
mov rsi, qword [r15 + 8]
cmp r10, rsi
je 0x180038eed
mov r11, qword [r12 + 8]
mov rbp, qword [r12]
mov r8, rbp
cmp rbp, r11
je 0x180038edf
mov rbx, qword [r10 + 0x18]
mov rdi, qword [r10 + 0x10]
mov rax, r10
cmp rbx, 8
jb 0x180038ea2
mov rax, qword [r10]
cmp qword [r8 + 0x18], 8
mov r9, r8
jb 0x180038eaf
mov r9, qword [r8]
mov rdx, qword [r8 + 0x10]
cmp rdx, rdi
jne 0x180038ed6
test rdx, rdx
je 0x180038edf
sub r9, rax
movzx ecx, word [rax]
cmp word [r9 + rax], cx
jne 0x180038ed6
add rax, 2
sub rdx, 1
je 0x180038edf
jmp 0x180038ec0
add r8, 0x20
cmp r8, r11
jne 0x180038e96
cmp r8, r11
jne 0x180038ef7
add r10, 0x20
cmp r10, rsi
jne 0x180038e86
mov byte [rsp + 0x40], 0
jmp 0x180038d86
mov byte [rsp + 0x40], 1
jmp 0x180038d86
mov rdx, r15
mov rcx, r12
call fcn.180060210
mov dword [rsp + 0x40], eax
jmp 0x180038d86
lea rcx, [0x18009e010]
mov rdx, rsp
call fcn.18007dc10
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa8]
test eax, eax
jne 0x180038f3c
mov ecx, dword [rdi]
call qword [rsi]
mov rbx, qword [rsp + 0xb8]
mov ecx, 0xcf
mov rdx, rbx
call fcn.18004e830
mov eax, dword [rdi]
lea rdx, [rsp + 0x30]
mov r8, qword [rbx]
mov r9d, 0x93
mov rcx, qword [rsi + 0x10]
mov dword [rsp + 0x30], eax
call fcn.180019cb0
jmp 0x180038d8b
Function at 0x18004c580
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebx, dword [rsp + 0xa8]
lea ebp, [r9 + 8]
mov rsi, r8
mov r15, rdx
mov r14, rcx
cmp r9d, ebp
jae case.0x18004c5e3.17
mov r12, qword [rsp + 0xb0]
lea edi, [r9 - 0x1e]
lea rdx, [0x180000000]
xor r13d, r13d
nop
cmp edi, 0x11
ja case.0x18004c5e3.2
mov ecx, dword [rdx + rdi*4 + 0x4c7d0]
add rcx, rdx
jmp rcx
cmp dword [rsi + 0x98], 2
jne 0x18004c7ac
mov r9, qword [rsi]
mov edx, 1
mov rcx, r14
lea r8d, [rdx + 3]
call fcn.18005f73c
cmp rax, 4
jne 0x18004c7a0
mov rcx, qword [rsi]
lea rdx, [rax - 8]
lea r8d, [rax - 3]
call fcn.18005fa78
test eax, eax
jne 0x18004c794
lea ebx, [rax + 1]
lea rdx, [0x180000000]
jmp case.0x18004c5e3.2
mov eax, dword [r15]
xor edx, edx
mov qword [rsp + 0x58], r13
xor r9d, r9d
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r12
lea ecx, [rdx + 0x6d]
mov dword [rsp + 0xa8], eax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
call fcn.18004b440
lea rdx, [0x180000000]
jmp case.0x18004c5e3.2
mov rdx, qword [rsi + 0x10]
mov r8d, 0xa9
mov rcx, r14
call fcn.18003d130
mov rax, qword [rsi + 8]
lea rdx, [0x180000000]
inc dword [rax]
jmp case.0x18004c5e3.2
test r12, r12
jne 0x18004c6c5
lea rcx, str.USE_ITRAITS
call fcn.18005e2e4
mov r12, rax
test r14, r14
jne 0x18004c6d9
lea rcx, str._vmGroupName
call fcn.18005e2e4
mov r14, rax
test rsi, rsi
je case.0x18004c5e3.17
mov r9d, dword [r15]
cmp r9d, 5
jge 0x18004c7b8
lea rdx, [0x180000000]
jmp case.0x18004c5e3.2
mov eax, dword [r15]
lea rcx, [rsp + 0xa8]
mov r8d, 0x46
mov dword [rsp + 0xa8], eax
mov rdx, rsi
call fcn.180006430
lea rdx, [0x180000000]
jmp case.0x18004c5e3.2
mov eax, dword [r15]
lea rcx, [rsp + 0xa8]
mov r8d, 0xf7
mov dword [rsp + 0xa8], eax
mov rdx, rsi
call fcn.18004c820
lea rdx, [0x180000000]
jmp case.0x18004c5e3.2
mov eax, dword [r14]
cmp eax, 2
jne 0x18004c75b
mov rax, qword [rsi + 8]
inc dword [rax + 4]
jmp case.0x18004c5e3.2
cmp eax, 3
jne case.0x18004c5e3.2
mov rax, qword [rsi + 8]
inc dword [rax + 8]
inc edi
lea eax, [rdi + 0x1e]
cmp eax, ebp
jb 0x18004c5d0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov dword [rsi + 0x58], 7
mov eax, r13d
jmp 0x18004c776
mov dword [rsi + 0x58], 6
mov eax, r13d
jmp 0x18004c776
mov dword [rsi + 0x58], 1
mov eax, r13d
jmp 0x18004c776
xor r8d, r8d
lea rdx, [0x180081054]
lea rcx, str.no_overloads_of__n1_match_the_signature_of__n2
call fcn.180037360
int3