joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180050530
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov esi, edx
mov ebx, r15d
xor eax, eax
mov rdi, rcx
mov ebp, 1
lock cmpxchg dword [0x1801794a8], ebp
je 0x180050587
cmp rbx, 0x20
jae 0x180050570
xor ecx, ecx
jmp 0x180050572
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1801794a8], ebp
jne 0x180050566
cmp qword [0x1801794b0], r15
je 0x180050683
test rdi, rdi
jne 0x1800505a7
mov ecx, esi
call fcn.18004fef0
mov ebp, eax
jmp 0x180050688
mov ecx, dword [0x180179f2c]
mov ebx, r15d
test ecx, ecx
je 0x1800505cf
mov r8, qword [0x180179f20]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x1800505d9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800505c0
mov ebp, 4
jmp 0x180050688
cmp ebx, 0xffffffff
je 0x1800505cf
mov eax, ebx
imul rdx, rax, 0x38
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
and eax, ebp
cmp eax, esi
je 0x18005067a
mov r8d, ebp
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.18004fc30
mov edx, esi
mov ecx, ebx
call fcn.18004fde0
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180050688
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180050664
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x18005065a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180050630
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1801794b0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180050688
neg esi
sbb ebp, ebp
add ebp, 6
jmp 0x180050688
mov ebp, 2
xchg dword [0x1801794a8], r15d
mov rbx, qword [rsp + 0x40]
mov eax, ebp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180053670
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180177040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, r8
mov edi, edx
mov rbx, rcx
test edx, edx
jne 0x180053698
call fcn.180053490
mov r8, rsi
mov edx, edi
mov rcx, rbx
call fcn.1800d9804
test eax, eax
je 0x180053760
cmp edi, 1
jne 0x1800537a4
xor ecx, ecx
call fcn.180075560
mov qword [0x180179750], rax
test rax, rax
je 0x180053760
movabs rax, 0xcd4fe9e2f7ed4775
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rax
movabs rax, 0xab6733d145a6cf4d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
movabs rax, 0x7cf93a325de77fb8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
movabs rax, 0x2cdd8aa76880c61a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
call fcn.1800537b0
mov rcx, rax
call fcn.180075560
test rax, rax
je 0x180053760
mov rcx, rbx
mov qword [0x180179758], rbx
call fcn.1800510e0
test al, al
jne 0x180053777
call fcn.180053490
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800d9270
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
lea r8, [0x180053620]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800537a4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x180053762
Function at 0x180058290
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rcx, qword [0x1801798c0]
mov rbx, rdx
movzx eax, word [rcx + 0x50]
cmp eax, 0xffff
je 0x180058336
mov rdi, qword [rcx + 0x40]
movabs rbp, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
mov r11d, eax
add r11, r11
mov r10, qword [rdi + r11*8]
test r10, r10
je 0x180058329
mov r9, qword [r10]
mov r8, rbp
mov rax, r9
cmp byte [r9], 0
je 0x1800582f8
nop
inc rax
cmp byte [rax], 0
jne 0x1800582f0
mov edx, 0
sub rax, r9
je 0x180058324
nop dword [rax]
nop word [rax + rax]
movsx rcx, byte [r9 + rdx]
inc rdx
xor r8, rcx
imul r8, rsi
cmp rdx, rax
jb 0x180058310
cmp r8, rbx
je 0x18005834d
movzx eax, word [rdi + r11*8 + 0xa]
cmp eax, 0xffff
jne 0x1800582d1
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
mov rax, r10
jmp 0x180058338
Function at 0x18005f4e0
Capabilities:
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x180177040]
xor rax, rsp
mov qword [rbp + 0x47], rax
call fcn.180075560
mov rcx, rax
test rax, rax
je 0x18005f717
movabs rax, 0xa3758ce096e93558
mov qword [rsp + 0xe8], rbx
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x29]
mov rax, qword [rbp - 0x49]
movabs rbx, 0xcd3ce994f78c471b
mov qword [rbp - 0x29], rax
movabs rax, 0xab6750c423a7aa40
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x49], rbx
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x39], rax
mov qword [rsp + 0xf0], rdi
movabs rdi, 0xab0233a545d5cf34
mov qword [rbp - 0x49], rdi
mov rax, qword [rbp - 0x49]
movdqa xmm0, xmmword [rbp - 0x29]
mov qword [rbp - 0x31], rax
xorps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x29], xmm0
call fcn.180075830
mov rcx, rax
test rax, rax
jne 0x18005f6ff
mov dl, 3
call fcn.180073ee0
movabs rax, 0xb91c8df19be5267d
lea rdx, [rbp - 0x19]
mov qword [rbp - 0x49], rax
movabs rcx, 0xe268d6816a28a468
mov rax, qword [rbp - 0x49]
mov r8d, edx
mov qword [rbp - 0x19], rax
movabs rax, 0xe82013d120b2ef5b
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 0x11], rax
movabs rax, 0x8fb733329a81aa7
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 9], rax
movabs rax, 0xcffefc409e6b413
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp - 1], rax
movabs rax, 0x6b79956591286cae
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 7], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x49], rbx
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x49], rdi
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x1f], rax
movabs rax, 0x7c953a565dc97fd5
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x27], rax
movabs rax, 0x2cdd8aa76880c676
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x2f], rax
movabs rax, 0x6b0ae600e34c08cf
mov qword [rbp - 0x49], rax
mov rax, qword [rbp - 0x49]
mov qword [rbp + 0x37], rax
mov qword [rbp - 0x49], rcx
mov rax, qword [rbp - 0x49]
movdqa xmm2, xmmword [rbp - 0x19]
xorps xmm2, xmmword [rbp + 0x17]
movdqa xmm0, xmmword [rbp - 9]
movq rcx, xmm2
movdqa xmm1, xmmword [rbp + 7]
xorps xmm0, xmmword [rbp + 0x27]
mov qword [rbp + 0x3f], rax
lea rax, [rbp - 0x19]
xorps xmm1, xmmword [rbp + 0x37]
movdqa xmmword [rbp - 0x19], xmm2
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp + 7], xmm1
test cl, cl
je 0x18005f6db
nop word [rax + rax]
inc rax
mov r8, rax
cmp byte [rax], 0
jne 0x18005f6d0
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x20], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
jmp 0x18005f707
mov eax, dword [rax + 3]
mov rax, qword [rax + rcx + 7]
mov rbx, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xf0]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1800d9270
add rsp, 0xd0
pop rbp
ret
Function at 0x180069d10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x180177040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword [0x1801796e8]
mov rbx, rcx
mov rcx, qword [0x1801796f0]
cmp rax, rcx
je 0x180069d5c
cmp qword [rax], rbx
je 0x180069d4f
add rax, 0x10
cmp rax, rcx
jne 0x180069d41
cmp rax, rcx
je 0x180069d5c
mov eax, dword [rax + 8]
jmp 0x180069f3b
mov dl, 3
mov qword [rsp + 0xc8], rdi
call fcn.180073ee0
mov rdi, rax
lea rdx, [rsp + 0x40]
movabs rax, 0xb91c8df19be5267d
mov r8d, edx
mov qword [rsp + 0x30], rax
movabs rax, 0xc42257cb2cb3ef5b
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rax
movabs rax, 0x13f31a2238ba19b3
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x30], rax
movabs rax, 0xcb9e6c201e6e604
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x58], rax
movabs rax, 0x186b8e208b3861b8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
movabs rax, 0xe268d6816a089e00
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x68], rax
movabs rax, 0xcd3ce994f78c471b
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x70], rax
movabs rax, 0xab0233a545d5cf34
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
movabs rax, 0x7c953a565dc97fd5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x80], rax
movabs rax, 0x2cdd8aa76880c676
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x88], rax
movabs rax, 0x6b0ae600e34c08cf
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x90], rax
movabs rax, 0xe268d6816a28a468
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movdqa xmm2, xmmword [rsp + 0x40]
xorps xmm2, xmmword [rsp + 0x70]
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rsp + 0x80]
mov qword [rsp + 0x98], rax
movq rax, xmm2
xorps xmm1, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
test al, al
je 0x180069f00
inc rcx
mov r8, rcx
cmp byte [rcx], 0
jne 0x180069ef5
mov rcx, qword [0x180177ed8]
sub r8d, edx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], 0
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
or word [rdi + 8], 6
mov rdx, rbx
mov rcx, rdi
call fcn.180069fa0
mov rdi, qword [rsp + 0xc8]
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800d9270
add rsp, 0xb0
pop rbx
ret
Function at 0x180069fa0
Capabilities:
Encrypt data using rc4 ksa
Write file on windows

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x180177040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r9, rdx
xor r11d, r11d
movzx edx, word [rcx + 8]
mov rbx, rcx
mov eax, 0xa
test dl, 4
je 0x180069fe1
mov r8d, 0x10
lea r11, [0x180160580]
jmp 0x18006a003
test dl, 0x10
je 0x180069fee
mov r8d, 8
jmp 0x18006a003
mov r8, rax
test dl, 0x20
je 0x18006a006
mov r8d, 2
lea r11, [0x180160584]
mov eax, r8d
mov byte [rsp + 0x72], 0
lea rcx, [rsp + 0x72]
test r9, r9
jne 0x18006a024
lea rcx, [rsp + 0x71]
mov byte [rsp + 0x71], 0x30
jmp 0x18006a16f
lea r10, [0x180000000]
cmp eax, 0xa
jne 0x18006a0d3
cmp r9, 0x64
jb 0x18006a099
mov qword [rsp + 0xa0], rdi
movabs rdi, 0x47ae147ae147ae15
nop dword [rax]
mov r8, r9
mov rax, rdi
mul r9
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 6
imul rax, r8, 0x64
sub r9, rax
movzx eax, byte [r10 + r9*2 + 0x12ab31]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [r10 + r9*2 + 0x12ab30]
mov r9, r8
mov byte [rcx], al
cmp r8, 0x64
jae 0x18006a050
mov rdi, qword [rsp + 0xa0]
dec rcx
mov rdx, rcx
cmp r9, 0xa
jae 0x18006a0b5
movzx eax, byte [r9 + r10 + 0x1601d8]
mov byte [rcx], al
jmp 0x18006a16f
movzx eax, byte [r10 + r9*2 + 0x12ab30]
dec rcx
mov byte [rcx], al
movzx eax, byte [r10 + r9*2 + 0x12ab31]
mov byte [rdx], al
jmp 0x18006a16f
cmp eax, 0x10
jne 0x18006a151
cmp r9, 0x100
jb 0x18006a11d
nop dword [rax]
nop word [rax + rax]
movzx eax, r9b
shr r9, 8
lea rdx, [rax*2 + 0x12a920]
movzx eax, byte [rdx + r10 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [rdx + r10]
mov byte [rcx], al
cmp r9, 0x100
jae 0x18006a0f0
dec rcx
mov rdx, rcx
cmp r9, 0x10
jae 0x18006a136
movzx eax, byte [r9 + r10 + 0x1601d8]
mov byte [rcx], al
jmp 0x18006a16f
movzx eax, byte [r10 + r9*2 + 0x12a920]
dec rcx
mov byte [rcx], al
movzx eax, byte [r10 + r9*2 + 0x12a921]
mov byte [rdx], al
jmp 0x18006a16f
xor edx, edx
mov rax, r9
div r8
dec rcx
mov r9, rax
movzx eax, byte [rdx + r10 + 0x1601d8]
mov byte [rcx], al
test r9, r9
jne 0x18006a151
test r11, r11
je 0x18006a18c
test byte [rbx + 8], 2
je 0x18006a18c
movzx eax, byte [r11 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [r11]
mov byte [rcx], al
lea r8, [rsp + 0x72]
mov qword [rsp + 0x20], 0
sub r8d, ecx
mov rdx, rcx
mov rcx, qword [0x180177ed8]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800d9270
add rsp, 0x90
pop rbx
ret
Function at 0x18006a1d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r8d, ecx
test r9d, r9d
je 0x18006a1e5
lea eax, [r9 - 2]
cmp eax, 0x22
jbe 0x18006a1e5
mov rax, rdx
ret
mov r11d, r8d
mov byte [rdx + 0x40], 0
mov eax, r8d
shr r11d, 0x1f
neg eax
lea rcx, [rdx + 0x40]
test r11b, r11b
cmovne r8d, eax
test r8d, r8d
jne 0x18006a20f
dec rcx
mov rax, rcx
mov byte [rcx], 0x30
ret
cmp r9d, 0xa
jne 0x18006a2a5
lea r9, [0x18012ab30]
cmp r8d, 0x64
jb 0x18006a260
nop word [rax + rax]
mov eax, 0x51eb851f
mul r8d
shr edx, 5
imul eax, edx, 0x64
sub r8d, eax
add r8d, r8d
movzx eax, byte [r8 + r9 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [r8 + r9]
mov r8d, edx
mov byte [rcx], al
cmp edx, 0x64
jae 0x18006a230
dec rcx
cmp r8d, 0xa
jae 0x18006a27a
mov eax, r8d
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
movzx eax, byte [rax + r10]
jmp 0x18006a290
lea eax, [r8 + r8]
mov edx, eax
movzx eax, byte [rax + r9 + 1]
mov byte [rcx], al
dec rcx
movzx eax, byte [rdx + r9]
mov byte [rcx], al
test r11b, r11b
je 0x18006a349
dec rcx
mov rax, rcx
mov byte [rcx], 0x2d
ret
cmp r9d, 0x10
jne 0x18006a320
lea r9, [0x18012a920]
cmp r8d, 0x100
jb 0x18006a2e9
nop dword [rax + rax]
movzx eax, r8b
add eax, eax
shr r8d, 8
mov edx, eax
movzx eax, byte [rax + r9 + 1]
mov byte [rcx - 1], al
sub rcx, 2
movzx eax, byte [rdx + r9]
mov byte [rcx], al
cmp r8d, 0x100
jae 0x18006a2c0
dec rcx
cmp r8d, 0x10
jae 0x18006a304
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
movzx eax, byte [r8 + r10]
mov byte [rcx], al
mov rax, rcx
ret
lea eax, [r8 + r8]
mov edx, eax
movzx eax, byte [rax + r9 + 1]
mov byte [rcx], al
dec rcx
movzx eax, byte [rdx + r9]
mov byte [rcx], al
mov rax, rcx
ret
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ
nop word [rax + rax]
xor edx, edx
mov eax, r8d
div r9d
dec rcx
mov r8d, eax
movzx edx, byte [rdx + r10]
mov byte [rcx], dl
test eax, eax
jne 0x18006a330
mov rax, rcx
ret
Function at 0x180070000
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x18
movsxd rsi, dword [rsp + 0x58]
mov r11, rdx
mov qword [rsp + 0x30], rbx
mov r10, rcx
mov qword [rsp + 0x38], rdi
mov rbp, rdx
lea rdi, [r8 - 1]
mov qword [rsp + 0x40], r12
sar rdi, 1
mov rbx, rdx
mov qword [rsp + 8], r14
mov r14, r8
cmp rdx, rdi
jge 0x1800700b1
mov qword [rsp + 0x10], r13
mov r13d, 0x30
mov qword [rsp], r15
nop word [rax + rax]
lea rdx, [rbx + rbx]
lea rax, [rdx + rdx*2]
lea r8, [r10 + rax*8]
movss xmm0, dword [rsi + r8 + 0x30]
lea rax, [r11 + r11*2]
comiss xmm0, dword [rsi + r8 + 0x18]
seta cl
movzx ebx, cl
xor rbx, 1
inc rbx
add rbx, rdx
mov edx, 0x18
test cl, cl
mov r11, rbx
cmove rdx, r13
movups xmm0, xmmword [rdx + r8]
movups xmmword [r10 + rax*8], xmm0
movsd xmm1, qword [rdx + r8 + 0x10]
movsd qword [r10 + rax*8 + 0x10], xmm1
cmp rbx, rdi
jl 0x180070050
mov r15, qword [rsp]
mov r13, qword [rsp + 0x10]
cmp rbx, rdi
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
jne 0x1800700eb
test r14b, 1
jne 0x1800700eb
lea rax, [r11 + r11*2]
lea rcx, [r14 + r14*2]
movups xmm0, xmmword [r10 + rcx*8 - 0x18]
lea r11, [r14 - 1]
movups xmmword [r10 + rax*8], xmm0
movsd xmm1, qword [r10 + rcx*8 - 8]
movsd qword [r10 + rax*8 + 0x10], xmm1
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x40]
cmp rbp, r11
jge 0x180070140
movsxd r8, dword [rsp + 0x60]
nop
lea rcx, [r11 - 1]
sar rcx, 1
lea rdx, [rcx + rcx*2]
lea rax, [rsi + rdx*8]
movss xmm0, dword [rax + r10]
comiss xmm0, dword [r8 + r9]
jbe 0x180070140
lea rax, [r11 + r11*2]
mov r11, rcx
movups xmm0, xmmword [r10 + rdx*8]
movups xmmword [r10 + rax*8], xmm0
movsd xmm1, qword [r10 + rdx*8 + 0x10]
movsd qword [r10 + rax*8 + 0x10], xmm1
cmp rbp, rcx
jl 0x180070100
movups xmm0, xmmword [r9]
lea rax, [r11 + r11*2]
movups xmmword [r10 + rax*8], xmm0
movsd xmm1, qword [r9 + 0x10]
movsd qword [r10 + rax*8 + 0x10], xmm1
add rsp, 0x18
pop rsi
pop rbp
ret
Function at 0x180073ee0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x180177040]
xor rax, rsp
mov qword [rsp + 0x190], rax
xor esi, esi
movzx ecx, dl
mov word [0x180178038], si
mov edi, esi
sub ecx, 1
je 0x180073f33
sub ecx, 1
je 0x180073f2a
cmp ecx, 1
jne 0x180073f3a
lea rdi, str._error_
jmp 0x180073f3a
lea rdi, str._warning_
jmp 0x180073f3a
lea rdi, str._info_
xor ecx, ecx
call fcn.1800e5440
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x38]
call fcn.1800e5438
movzx ebx, byte [0x180178030]
lea r9, [rsp + 0x38]
lea r8, str._n__d__m__Y__T_
mov edx, 0x20
lea rcx, [rsp + 0x60]
call fcn.1800597d0
mov rcx, qword [0x180177ed8]
lea rdx, [rsp + 0x60]
sub rax, rbx
mov qword [rsp + 0x20], rsi
add rdx, rbx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x104
call fcn.1800feda0
lea r8, [rsp + 0x80]
test rdi, rdi
je 0x180073fe2
movzx eax, byte [rdi]
lea r8, [rsp + 0x80]
test al, al
je 0x180073fdf
sub rdi, r8
nop
mov byte [r8], al
inc r8
movzx eax, byte [rdi + r8]
test al, al
jne 0x180073fd0
mov byte [r8], sil
cmp byte [rsp + 0x80], sil
je 0x180074014
mov rcx, qword [0x180177ed8]
lea rax, [rsp + 0x80]
sub r8d, eax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [0x180178030], sil
lea rax, [0x180178030]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1800d9270
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180074050
Capabilities:
Write file on windows

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rsi
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], r14
mov rax, qword [0x180177040]
xor rax, rbp
mov qword [rbp], rax
movzx eax, word [rdx]
xor ebx, ebx
mov rdi, rdx
mov r14, rcx
test ax, ax
je 0x1800740b7
mov ecx, 0x80
mov r8d, 0x800
lea rdx, [rdx + 2]
cmp ax, cx
jae 0x1800740a4
mov eax, 1
jmp 0x1800740ad
cmp ax, r8w
sbb eax, eax
add eax, 3
add ebx, eax
movzx eax, word [rdx]
test ax, ax
jne 0x180074094
xor edx, edx
movsxd rsi, ebx
lea rax, [rsi + 1]
lea rcx, [rax + 0x10]
cmp rcx, rax
cmova rdx, rcx
test rdx, rdx
je 0x18007412b
cmp rdx, 0x400
ja 0x18007410f
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1800740ec
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800d9bb0
sub rsp, rax
lea r10, [rsp + 0x30]
test r10, r10
je 0x18007412e
mov dword [r10], 0xcccc
add r10, 0x10
jmp 0x18007412e
mov rcx, rdx
call fcn.1800e5130
mov r10, rax
test rax, rax
je 0x18007412e
mov dword [rax], 0xdddd
add r10, 0x10
jmp 0x18007412e
xor r10d, r10d
lea r9, [r10 + rsi]
mov rcx, r10
cmp r10, r9
jae 0x180074166
nop word [rax + rax]
movzx eax, word [rdi]
test ax, ax
je 0x180074166
lea rdx, [r9 + 1]
mov r8d, eax
sub rdx, rcx
add rdi, 2
dec rdx
call fcn.180062000
add rcx, rax
cmp rcx, r9
jb 0x180074140
mov byte [rcx], 0
xor r9d, r9d
mov rcx, qword [0x180177ed8]
mov r8d, ebx
mov rdx, r10
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, r14
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1800d9270
mov rbx, qword [rbp + 0x20]
mov rsi, qword [rbp + 0x28]
mov rdi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x38]
lea rsp, [rbp + 0x10]
pop rbp
ret
Function at 0x180089090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2d8]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.180077c90
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x1800890e6
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x18008913d
mov ebp, 0x4b0000
jmp 0x18008914b
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.18007a1d0
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x180089161
mov eax, r12d
jmp 0x18008916a
mov edx, edi
mov ecx, ebp
call fcn.18007a1d0
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x180089186
shl esi, 0x10
mov ecx, esi
jmp 0x180089275
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x1800891e4
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.180077c90
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x1800891d4
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.18007a0a0
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.180077c90
add ebx, eax
jmp 0x18008927e
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x1800891f1
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x180089230
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.180077c90
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x180089235
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.18007a0a0
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.180077c90
add ebx, eax
jmp 0x18008927e
cmp eax, r12d
jge 0x18008926e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.180077c90
sub ebp, eax
sub r15d, esi
je 0x18008926e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.18007a0a0
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.180077c90
add ebx, eax
jmp 0x18008927e
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.180077c90
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
call fcn.180077c90
mov r15, qword [rsp + 0x30]
add eax, 0x8000
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
shr eax, 0x10
cwde
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret