joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003b60c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140048cc8], rbx
je 0x14003b673
cmp rax, rbx
jne 0x14003b666
mov ebx, 1
mov esi, ebx
jmp 0x14003b678
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14003b64b
mov ebx, 1
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b690
mov edi, 0x1f
mov ecx, edi
call fcn.1401a1000
jmp 0x14003b6fc
mov eax, dword [0x140048cd0]
test eax, eax
jne 0x14003b6f1
mov dword [0x140048cd0], ebx
lea r15, [0x14003e288]
lea rdi, [0x14003e270]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14003b6e3
test eax, eax
jne 0x14003b6e7
cmp qword [rdi], r14
je 0x14003b6d8
mov rax, qword [rdi]
mov rcx, qword [0x14003e230]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14003b6ba
test eax, eax
je 0x14003b6f7
mov eax, 0xff
jmp 0x14003b852
mov dword [0x140048284], ebx
mov edi, 0x1f
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b723
lea rdx, [0x14003e268]
lea rcx, [0x14003e238]
call sub.msvcrt.dll__initterm
mov dword [0x140048cd0], 2
test esi, esi
jne 0x14003b731
mov rax, r14
xchg qword [0x140048cc8], rax
cmp qword [0x140048ce8], r14
je 0x14003b764
lea rcx, [0x140048ce8]
call fcn.14003bbf0
test eax, eax
je 0x14003b764
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140048ce8]
mov r9, qword [0x14003e230]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14003b77d
mov eax, 0xff
jmp 0x14003b852
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14003b803
test ax, ax
je 0x14003b798
test edx, edx
jne 0x14003b803
sub ax, bx
cmp ax, di
ja 0x14003b7ae
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14003b798
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001fc0
mov dword [0x140048280], eax
cmp dword [0x1400482a0], r14d
jne 0x14003b7ec
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140048284], r14d
jne 0x14003b801
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140048280]
jmp 0x14003b852
cmp ax, 0x22
jne 0x14003b817
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14003b786
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14003bc70
add rsp, 0x28
jmp 0x14003b60c
Function at 0x14003bb00
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14003bb4c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003bb44
cmp dword [rcx + 0x3c], edx
jl 0x14003bb44
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14003bb44
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14003bb4c
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1401a1000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
push rbp
mov rbp, rsp
sub rsp, 0x20
and rsp, 0xfffffffffffffff0
lea rbx, [0x140114000]
movabs rdi, 0
push rbx
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140014f20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011258
Capabilities:
Create process on windows

Disassembly:
jmp 0x140014c60
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x14002109f]
call fcn.140011357
xor eax, eax
cmp eax, 1
je 0x140014d15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, str.__incognito_https:__www.pornhub.com
lea r8, str.chrome.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, str.__incognito_https:__www.xvideos.com
lea r8, str.chrome.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
lea r9, str.__incognito_https:__www.sex.com
lea r8, str.chrome.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x140014c7b
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x140011262
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012c50
xor al, al
jmp 0x140012cd1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012c63
xor al, al
jmp 0x140012cd1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012c8d
xor al, al
jmp 0x140012cd1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012ca1
xor al, al
jmp 0x140012cd1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012cb3
xor al, al
jmp 0x140012cd1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012ccf
xor al, al
jmp 0x140012cd1
mov al, 1
add rsp, 0x38
ret
Function at 0x180003030
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
xor r12d, r12d
call fcn.180002690
mov rbp, qword [0x180051128]
mov rsi, qword [rbp]
cmp rsi, rbp
je 0x180003138
mov rdx, qword [0x180051038]
nop dword [rax]
mov r15, qword [rsi + 0x20]
mov rdi, qword [r15]
cmp rdi, r15
je 0x180003129
mov r14, qword [rdi + 0x20]
mov rbx, qword [r14]
cmp rbx, r14
je 0x18000311a
lea rax, [rbx + 0x18]
mov qword [rsp + 0x30], rax
movd xmm2, dword [rbx + 0x10]
cvtdq2ps xmm2, xmm2
movd xmm1, dword [rdi + 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, dword [rsi + 0x10]
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x38], xmm0
movss dword [rsp + 0x3c], xmm1
movss dword [rsp + 0x40], xmm2
cmp rdx, qword [0x180051040]
je 0x1800030f3
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdx], xmm0
movsd xmm1, qword [rsp + 0x40]
movsd qword [rdx + 0x10], xmm1
mov rdx, qword [0x180051038]
add rdx, 0x18
mov qword [0x180051038], rdx
jmp 0x18000310b
lea r8, [rsp + 0x30]
lea rcx, [0x180051030]
call fcn.1800045c0
mov rdx, qword [0x180051038]
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r14
jne 0x180003090
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r15
jne 0x180003080
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
jne 0x180003070
mov byte [0x180050d80], 1
mov ebx, r12d
lea rsi, [0x180002fb0]
lea rdi, [0x180051090]
mov ecx, 0x10
call fcn.180036d00
mov dword [rax], ebx
mov qword [rax + 8], rsi
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x1800050d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800031db
movsxd rax, ebx
add rax, rax
cmp dword [rdi + rax*8 + 8], 0
jne 0x1800031d4
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rdi + rax*8], xmm1
inc ebx
cmp ebx, 4
jl 0x180003150
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov dword [rsp + 0x38], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x180004160
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180051130]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180051158]
js 0x180004184
cvtsi2ss xmm0, rcx
jmp 0x180004199
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180051120]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180047d74]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800041cb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800041cb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800041fd
cmp rbx, 0x200
jae 0x1800041fa
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800041fd
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180004410
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180004441
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180051128]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180051138]
lea rdx, [rdi + rdi]
call fcn.180003640
mov rax, qword [0x180051128]
lea r9, [rdi - 1]
mov qword [0x180051150], r9
mov qword [0x180051158], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800045b4
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180051138]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180004500
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180004575
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000453d
mov r10, qword [rdx]
cmp r10, rax
je 0x180004537
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180004575
cmp r9, rdx
je 0x180004551
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180004589
cmp r9, rdx
jne 0x180004542
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800045af
mov r9, qword [0x180051150]
jmp 0x1800044b1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180004575
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180004410
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180051130]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180051158]
js 0x180004184
cvtsi2ss xmm0, rcx
jmp 0x180004199
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180051120]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180047d74]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800041cb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800041cb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800041fd
cmp rbx, 0x200
jae 0x1800041fa
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800041fd
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180004410
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180004441
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180051128]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180051138]
lea rdx, [rdi + rdi]
call fcn.180003640
mov rax, qword [0x180051128]
lea r9, [rdi - 1]
mov qword [0x180051150], r9
mov qword [0x180051158], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800045b4
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180051138]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180004500
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180004575
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000453d
mov r10, qword [rdx]
cmp r10, rax
je 0x180004537
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180004575
cmp r9, rdx
je 0x180004551
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180004589
cmp r9, rdx
jne 0x180004542
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800045af
mov r9, qword [0x180051150]
jmp 0x1800044b1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180004575
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800065c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x180051224], 0
lea rdi, [0x180051220]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x180006698
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1800065f0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x1800066ce
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x1800066b0
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x18000670f
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1800066f3
cmp byte [r8], r9b
jne 0x1800066f3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x1800066e0
not eax
pop rdi
ret
Function at 0x1800068f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x180006909
mov qword [r8], 0
lea rdx, [0x180045c10]
call fcn.180006720
mov rbx, rax
test rax, rax
jne 0x180006928
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800069e8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1800069e8
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800069e8
mov rax, qword [0x180050d90]
mov rbp, rsi
test rax, rax
je 0x180006985
inc dword [rax + 0x3e0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1800069e8
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1800069d5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180050d90]
test rax, rax
je 0x1800069ca
dec dword [rax + 0x3e0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800069f1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1800069e3
mov qword [rdi], rbp
mov rax, rsi
jmp 0x1800069f3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180015ec0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x180050d90]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2db4], esi
test rcx, rcx
je 0x180015fda
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2db8]
mov dword [rdi + 0x2db4], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x180015f1a
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.1800170e0
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x180015f2e
mov edx, 8
mov rcx, rbx
call fcn.1800170e0
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2dc8], esi
jle 0x180015f7a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2dd0]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2dc8]
jl 0x180015f50
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x180015f89
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2dc0]
lea rdx, [0x180045c14]
test rax, rax
movsxd rsi, esi
lea rdi, [0x180050d81]
mov rcx, r15
cmovne rdi, rax
call fcn.180006720
mov rbx, rax
test rax, rax
je 0x180015fd5
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x1800219e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x180021b97
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x180021a76
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.1800213b0
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.1800209f0
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x180021a67
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.180016cb0
mov dword [rbx + 0x80], 0
jmp 0x180021b83
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.18001f820
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret