joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180071450
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rbp, r9
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0x58], r8
xor ebx, ebx
lea r9, [rcx + 0x40]
lea r8, [0x18028ef90]
call fcn.180011550
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x38], ax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 0x82000000
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call fcn.180071640
mov qword [rsi + 8], rax
test rax, rax
je 0x180071627
mov ecx, 0xc0
call fcn.1801cd4e0
mov rdi, rax
mov qword [rsp + 0x80], rax
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call fcn.1801cf320
mov qword [rdi + 8], rbx
call fcn.180083f00
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x90], rcx
mov qword [rcx + 0x18], rbx
mov qword [rdi + 0x30], rbx
mov dword [rdi + 0x38], ebx
mov rax, qword [sym.imp.USER32.dll_DefWindowProcW]
mov qword [rdi + 0x40], rax
movups xmm0, xmmword [0x180204460]
movups xmmword [rdi + 0x50], xmm0
movups xmm0, xmmword [0x180204460]
movups xmmword [rdi + 0x60], xmm0
mov dword [rdi + 0x70], ebx
mov dword [rdi + 0x74], 0xfefefefe
movups xmm0, xmmword [0x180204460]
movups xmmword [rdi + 0x50], xmm0
movups xmm1, xmmword [0x180204460]
movups xmmword [rdi + 0x60], xmm1
lea rax, vtable.RC::IERenderView.2.0
mov qword [rdi], rax
lea rax, vtable.RC::IERenderView.0
mov qword [rdi + 0x48], rax
lea rax, vtable.RC::IERenderView.1.0
mov qword [rdi + 0x78], rax
mov qword [rdi + 0x80], rbx
mov qword [rdi + 0x88], rbx
mov qword [rdi + 0x90], rbx
mov qword [rdi + 0x98], rbx
mov qword [rdi + 0xa0], rbx
mov word [rdi + 0xa8], bx
mov byte [rdi + 0xaa], bl
mov qword [rdi + 0xb0], rbp
mov qword [rdi + 0xb8], rbx
mov qword [rsi + 0x50], rdi
mov rax, qword [rsi + 8]
mov qword [rdi + 0x80], rax
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x180086980]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x90], rax
lea ecx, [rbx + 0x38]
call fcn.1801cd4e0
mov rcx, rax
mov qword [rsp + 0x80], rax
xor eax, eax
mov qword [rcx + 8], rax
mov qword [rcx + 0x30], rax
lea rax, vtable.RC::IEExternal.0
mov qword [rcx], rax
mov dword [rcx + 8], ebx
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x20], rbx
mov qword [rcx + 0x28], rbx
mov qword [rcx + 0x30], rbx
mov qword [rdi + 0xa0], rcx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800772e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
mov rdx, qword [rcx + 0xe8]
test rdx, rdx
jne 0x180077336
mov rcx, qword [0x160]
mov rax, qword [rcx + 0x60]
cmp qword [rcx + 0x58], rax
je 0x1800774d3
mov rax, qword [rdx + 0x160]
mov rcx, qword [rax + 0x58]
cmp rcx, qword [rax + 0x60]
je 0x180077356
cmp byte [rcx + 4], 0
je 0x180077356
mov rsi, qword [rbx + 0xf8]
jmp 0x18007735d
mov rsi, qword [rbx + 0x100]
test rsi, rsi
je 0x1800774d3
mov edi, dword [r8 + 0xc]
sub edi, dword [r8 + 4]
mov rax, qword [rsi]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call qword [rax + 0x30]
mov ecx, dword [rax]
mov edx, dword [r15 + 4]
mov eax, dword [r15 + 8]
mov dword [rbp - 0x20], eax
add eax, ecx
mov dword [rbp - 0x18], eax
mov dword [rbp - 0x1c], edx
lea eax, [rdx + rdi]
mov dword [rbp - 0x14], eax
mov rax, qword [rsi]
lea rdx, [rbp - 0x28]
mov rcx, rsi
call qword [rax + 0x30]
mov r8, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x38]
call fcn.180077200
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_CopyRect]
xor edi, edi
mov rax, rbx
nop dword [rax]
cmp byte [rax + 0x99], dil
jne 0x1800773ea
mov rax, qword [rax + 0xa8]
test rax, rax
jne 0x1800773d0
jmp 0x18007748d
test rax, rax
je 0x18007748d
mov rax, qword [rax + 0xe0]
mov r15, qword [rax]
test r15, r15
je 0x18007748d
mov qword [rbp - 0x28], rdi
lea rcx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [r15]
mov rcx, r15
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rax
lea rdx, [rbp - 0x28]
call qword [sym.imp.USER32.dll_ScreenToClient]
lea rcx, [rbp - 0x28]
call fcn.18005e600
mov qword [rbp - 0x28], rax
xor ecx, ecx
xor edx, edx
nop dword [rax + rax]
add ecx, dword [rbx + 0xb4]
add edx, dword [rbx + 0xb8]
mov rbx, qword [rbx + 0xa8]
test rbx, rbx
jne 0x180077440
sub dword [rbp - 0x24], edx
sub dword [rbp - 0x28], ecx
mov rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x18007748d
mov edi, 1
mov ecx, edi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov eax, 2
cmovne edi, eax
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x28], r14
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800774ae
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x48]
nop
mov rax, qword [rsi]
mov r9d, edi
lea r8, [rbp - 0x20]
mov rdx, r14
mov rcx, rsi
call qword [rax + 0x28]
nop
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800774d3
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1801ccd30
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18009b3e0
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, edx
mov rbx, rcx
and edi, 0xffffb1af
cmp qword [rcx + 0x18], 8
jb 0x18009b41d
mov rcx, qword [rcx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x18009b430
mov al, 1
jmp 0x18009b4d7
xor esi, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18009ba20
test al, al
je 0x18009b481
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x18009b481
mov bl, 1
jmp 0x18009b483
xor bl, bl
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18009b4c1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009b4bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009b4f4
call fcn.1801ccd54
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801ccd30
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.1801d1a6c
int3

Function at 0x18009b500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x18009b535
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18009b5df
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x18023b300]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18009ba20
test al, al
je 0x18009b58e
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x18009b5cc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009b5c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009b5fe
call fcn.1801ccd54
movdqa xmm0, xmmword [0x18023b300]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
mov eax, edi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801ccd30
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.1801d1a6c
int3
Function at 0x1801062b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
sub rsp, 0x60
cmp dword [rcx + 0x4c], 0
movzx r10d, r8b
mov rdi, rcx
jle 0x18010644e
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x50], rsi
test dl, dl
je 0x180106387
movzx eax, byte [rcx + 0x50]
lea rdx, [rcx + 0x24]
movss xmm0, dword [rcx + 4]
lea r9, [rcx + 0x3c]
movss xmm1, dword [rcx]
lea r8, [rcx + 0x2c]
mov byte [rsp + 0x40], r10b
mov byte [rsp + 0x38], al
movss dword [rsp + 0x30], xmm0
movss dword [rsp + 0x28], xmm1
mov qword [rsp + 0x20], rdx
lea rdx, [rcx + 0x68]
add rcx, 0x78
call qword [rdi + 0x60]
lea rcx, [rdi + 0x78]
call fcn.1800ac630
mov rax, qword [rdi + 0x68]
movsxd rcx, dword [rax + 0x3c]
test ecx, ecx
jle 0x18010634b
mov rax, qword [rax + 0x28]
movsd xmm0, qword [rax + rcx*8 - 8]
movaps xmm1, xmm0
movsd qword [rsp + 0x70], xmm0
movss xmm3, dword [rsp + 0x70]
shufps xmm1, xmm1, 0x55
jmp 0x18010635d
xorps xmm3, xmm3
xorps xmm1, xmm1
movss dword [rsp + 0x70], xmm3
movss dword [rsp + 0x74], xmm1
movaps xmm2, xmm1
lea rcx, [rdi + 0x78]
movaps xmm1, xmm3
call fcn.1800ac090
lea rdx, [rdi + 0x68]
lea rcx, [rdi + 0x78]
call fcn.1800adc40
lea rcx, [rdi + 0x78]
call fcn.1800ac630
jmp 0x180106444
mov rax, qword [rcx + 0x68]
lea rsi, [rcx + 0x68]
mov qword [rsp + 0x58], rbp
movsxd rcx, dword [rax + 0x3c]
test ecx, ecx
jle 0x1801063ae
mov rax, qword [rax + 0x28]
movsd xmm0, qword [rax + rcx*8 - 8]
movsd qword [rsp + 0x70], xmm0
jmp 0x1801063b7
mov qword [rsp + 0x70], 0
xor ebp, ebp
lea r8, [rdi + 0x1c]
test r10b, r10b
lea rdx, [rdi + 0x3c]
mov rax, rsi
lea r9, [rsp + 0x70]
cmove rax, rbp
lea rcx, [rdi + 0x78]
mov qword [rsp + 0x20], rax
call qword [rdi + 0x58]
mov rdx, rsi
lea rcx, [rdi + 0x78]
call fcn.1800adc40
movss xmm0, dword [rdi + 0x14]
lea r9, [rdi + 0x44]
xorps xmm0, xmmword [0x18023b6e0]
lea rdx, [rdi + 0x34]
cmp byte [rdi + 0x50], bpl
lea r8, [rsp + 0x88]
movss dword [rsp + 0x88], xmm0
lea rcx, [rdi + 0x78]
movss xmm0, dword [rdi + 0x18]
cmove rsi, rbp
xorps xmm0, xmmword [0x18023b6e0]
movss dword [rsp + 0x8c], xmm0
mov qword [rsp + 0x20], rsi
call qword [rdi + 0x58]
lea rcx, [rdi + 0x78]
call fcn.1800ac630
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x50]
lea rcx, [rdi + 0x68]
call fcn.1800abb70
mov dword [rdi + 0x4c], 0xffffffff
add rsp, 0x60
pop rdi
ret
Function at 0x18010ea30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push r14
sub rsp, 0x98
mov rax, qword [0x18028e088]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov eax, dword [rcx + 0xa0]
lea r14, [rcx + 0x10]
mov rdx, qword [rcx]
mov rbx, rcx
mov r8d, dword [rcx + 0x9c]
mov r10d, dword [rcx + 0x98]
mov ecx, dword [rdx + 0x18]
lea r11d, [rax + r8]
lea r9d, [rax + r10]
mov eax, dword [rdx + 0x1c]
test ecx, ecx
jle 0x18010ec77
test eax, eax
jle 0x18010ec77
cmp r10d, r9d
jge 0x18010ec77
cmp r8d, r11d
jge 0x18010ec77
test r9d, r9d
jle 0x18010ec77
cmp r10d, ecx
jge 0x18010ec77
test r11d, r11d
jle 0x18010ec77
cmp r8d, eax
jge 0x18010ec77
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xc0], rsi
mov rsi, qword [rdx + 0x10]
mov qword [rsp + 0xc8], rdi
xor edi, edi
test r10d, r10d
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r13
mov r12d, r8d
mov r13, qword [rdx]
mov qword [rsp + 0x80], r15
mov r15d, r10d
cmovle r15d, edi
test r8d, r8d
cmovle r12d, edi
cmp ecx, r9d
cmovle r9d, ecx
cmp eax, r11d
cmovle r11d, eax
test r13, r13
je 0x18010eb42
movsxd rbp, dword [rdx + 0x20]
lea rcx, [0x180222590]
movsxd rax, r15d
movsxd rdi, r12d
imul rdi, rsi
movzx ecx, byte [rbp + rcx]
imul rax, rcx
add rax, r13
add rdi, rax
jmp 0x18010eb45
mov ebp, dword [rdx + 0x20]
mov eax, dword [rdx + 0x24]
sub r9d, r15d
mov ecx, dword [rdx + 0x28]
sub r11d, r12d
mov dword [rsp + 0x40], r9d
neg r10d
mov dword [rsp + 0x4c], eax
lea r9, [rbx + 0x40]
mov rax, qword [rdx + 8]
neg r8d
mov dword [rsp + 0x44], r11d
mov edx, r10d
mov qword [r14], rdi
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rsi
mov dword [rsp + 0x48], ebp
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14 + 0x18], xmm0
mov dword [r14 + 0x28], ecx
mov rcx, qword [rbx + 8]
call fcn.1800e3040
mov r9d, dword [rbx + 0xa0]
xor eax, eax
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x3c], r9d
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
cmp byte [rbx + 0x71], al
je 0x18010ec46
mov rax, qword [rsp + 0x38]
lea rcx, [rsp + 0x60]
mov r8, qword [rsp + 0x30]
mov rdi, 0xffffffffffffffff
shr rax, 0x20
xor edx, edx
shr r8, 0x20
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x70], rdi
call fcn.1800bfe10
lea r9, [rbx + 0x40]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x60]
lea rcx, [rbx + 0x40]
call fcn.1800c08b0
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18010ec5a
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x18010ec5a
mov rcx, qword [rsp + 0x70]
call fcn.1801d1bbc
jmp 0x18010ec5a
lea rcx, [rbx + 0x58]
mov r8d, 1
lea rdx, [rsp + 0x40]
call fcn.1800e5990
mov dl, 1
lea rcx, [rbx + 0x40]
call fcn.1800e21a0
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
jmp 0x18010ec80
lea rcx, [rbx + 0x40]
call fcn.1800e23f0
lea rax, [rbx + 0x40]
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x80], rax
cmp byte [rax + 0x32], 0
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1801ccd30
add rsp, 0x98
pop r14
pop rbx
ret
Function at 0x1801572f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov esi, dword [reloc.gdiplus.dll_Ordinal_1]
xor r10d, r10d
movaps xmmword [rax - 0x28], xmm6
mov r11, rcx
movaps xmmword [rax - 0x38], xmm7
mov r14, r8
movsd xmm7, qword [0x18023b6c0]
mov rbp, rdx
movaps xmmword [rax - 0x48], xmm8
lea r15d, [r10 + 2]
movsd xmm8, qword [0x18023ae50]
lea r12d, [r10 + 4]
movaps xmmword [rax - 0x58], xmm9
mov dil, 1
movaps xmmword [rax - 0x68], xmm10
mov rbx, rcx
movaps xmmword [rax - 0x78], xmm11
movq xmm10, r11
movsd xmm11, qword [0x18023aea0]
xorps xmm9, xmm9
movaps xmmword [rsp + 0x10], xmm12
movdqa xmm12, xmmword [0x18023b7a0]
punpcklqdq xmm10, xmm10
nop dword [rax]
nop word [rax + rax]
movd xmm1, r10d
mov r8d, 1
pshufd xmm1, xmm1, 0
cmp esi, r15d
jl 0x1801573fa
movdqa xmm3, xmmword [0x18023b3b0]
movq xmm0, xmm1
paddd xmm3, xmmword [0x18023b380]
movq xmm1, xmm1
pxor xmm3, xmm0
movd xmm0, r15d
psubd xmm3, xmm1
movdqa xmm1, xmm3
psrad xmm1, xmm0
pmovsxdq xmm0, xmm3
pandn xmm1, xmm12
pmovsxdq xmm2, xmm1
pand xmm2, xmm0
movd xmm0, r12d
psllq xmm2, xmm0
paddq xmm2, xmm10
movdqu xmmword [rsp], xmm2
jmp 0x180157431
lea r9, [rsp]
nop
mov edx, r8d
lea r9, [r9 + 8]
xor edx, r10d
inc r8d
sub edx, r10d
mov eax, edx
sar eax, 2
not eax
movsxd rcx, eax
movsxd rax, edx
and rcx, rax
shl rcx, 4
add rcx, r11
mov qword [r9 - 8], rcx
cmp r8d, 3
jl 0x180157400
mov rax, qword [rsp]
movsd xmm2, qword [rbx + 8]
movsd xmm0, qword [rbx]
movsd xmm5, qword [rax]
movsd xmm6, qword [rax + 8]
subsd xmm0, xmm5
mov rax, qword [rsp + 8]
subsd xmm2, xmm6
movsd xmm3, qword [rax]
movsd xmm4, qword [rax + 8]
subsd xmm3, xmm5
subsd xmm4, xmm6
mulsd xmm2, xmm3
mulsd xmm0, xmm4
subsd xmm2, xmm0
movaps xmm0, xmm2
andps xmm0, xmm7
comisd xmm11, xmm0
ja 0x1801574d6
xor dil, dil
mov rax, rbp
xor ecx, ecx
nop word [rax + rax]
movsd xmm1, qword [rax + 8]
movsd xmm0, qword [rax]
subsd xmm1, xmm6
subsd xmm0, xmm5
mulsd xmm1, xmm3
mulsd xmm0, xmm4
subsd xmm1, xmm0
movaps xmm0, xmm1
mulsd xmm0, xmm2
comisd xmm0, xmm9
jbe 0x1801574c5
andps xmm1, xmm7
comisd xmm8, xmm1
jbe 0x1801574d6
inc rcx
add rax, 0x10
cmp rcx, 3
jl 0x180157490
xor al, al
jmp 0x1801574ec
inc r10d
add rbx, 0x10
cmp r10d, 3
jl 0x180157390
mov byte [r14], dil
mov al, 1
movaps xmm6, xmmword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm7, xmmword [rsp + 0x60]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180157540
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [reloc.gdiplus.dll_Ordinal_1], 2
mov r10d, edx
mov r11, rcx
mov r9, r8
mov eax, 1
movd xmm1, r10d
movq xmm4, r11
pshufd xmm1, xmm1, 0
punpcklqdq xmm4, xmm4
jl 0x1801575d0
movdqa xmm3, xmmword [0x18023b3b0]
movq xmm0, xmm1
paddd xmm3, xmmword [0x18023b380]
movq xmm1, xmm1
pxor xmm3, xmm0
mov eax, 2
psubd xmm3, xmm1
movdqa xmm1, xmm3
movd xmm0, eax
mov eax, 4
psrad xmm1, xmm0
pmovsxdq xmm0, xmm3
pandn xmm1, xmmword [0x18023b7a0]
pmovsxdq xmm2, xmm1
pand xmm2, xmm0
movd xmm0, eax
psllq xmm2, xmm0
paddq xmm2, xmm4
movdqu xmmword [r8], xmm2
ret
mov r8d, eax
lea r9, [r9 + 8]
xor r8d, r10d
inc eax
sub r8d, r10d
mov ecx, r8d
sar ecx, 2
not ecx
movsxd rdx, ecx
movsxd rcx, r8d
and rdx, rcx
shl rdx, 4
add rdx, r11
mov qword [r9 - 8], rdx
cmp eax, 3
jl 0x1801575d0
ret

Function at 0x180159340
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp byte [0x18029d6f8], 0
jne 0x1801593c1
mov eax, 0xffffffff
lock xadd dword [0x18028f608], eax
test eax, eax
jg 0x180159378
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39c0
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x18029d6f8], 0
jne 0x180159394
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18029d578], eax
mov byte [0x18029d6f8], 1
mov eax, 1
lock xadd dword [0x18028f608], eax
test eax, eax
jns 0x1801593c1
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39c0
xor r8d, r8d
mov rcx, qword [rax]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov ecx, dword [0x18029d578]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x18017e220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov r14, rdx
mov rsi, rcx
mov eax, 0xffffffff
lock xadd dword [0x18028f5e0], eax
test eax, eax
jg 0x18017e25a
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39c0
mov edx, 0xffffffff
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.180104030
cmp qword [rax + 0x18], 0
mov rbx, qword [rax + 0x38]
jne 0x18017e27d
mov rax, qword [rax + 0x30]
test rbx, rbx
je 0x18017e27a
cmp rbx, rax
cmovb rax, rbx
mov rbx, rax
mov eax, 1
lock xadd dword [0x18028f5e0], eax
test eax, eax
jns 0x18017e2aa
lea rcx, reloc.gdiplus.dll_Ordinal_1
call fcn.1800c39c0
xor r8d, r8d
mov rcx, qword [rax]
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test rbx, rbx
jne 0x18017e2ba
mov al, 1
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rcx, qword [rsi + 0x48]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
xor edi, edi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], r15
lea ebp, [rdi + 5]
test rcx, rcx
je 0x18017e2f3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x48]
mov eax, ebp
mov edx, dword [rcx + 0x10]
jmp 0x18017e307
movups xmm0, xmmword [rsi + 0x28]
mov rcx, rdi
movups xmmword [rsp + 0x34], xmm0
mov eax, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x34]
cdqe
lea r12, [0x180222590]
movzx r15d, byte [rax + r12]
movsxd rax, edx
imul r15, rax
test rcx, rcx
je 0x18017e33b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [rsi + 0x48]
mov edx, dword [rax + 0x10]
mov eax, dword [rax + 0x14]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x20], edx
jmp 0x18017e34c
movups xmm0, xmmword [rsi + 0x28]
movups xmmword [rsp + 0x20], xmm0
mov ebp, dword [rsp + 0x28]
mov edx, dword [rsp + 0x20]
mov r8, qword [rsp + 0x20]
shr r8, 0x20
test r8d, r8d
jne 0x18017e35f
mov rdx, rdi
jmp 0x18017e37b
movsxd rax, ebp
movzx ecx, byte [rax + r12]
lea eax, [r8 - 1]
imul ecx, edx
movsxd rdx, ecx
movsxd rcx, eax
imul rcx, r15
add rdx, rcx
movss xmm2, dword [0x18023b1fc]
xorps xmm1, xmm1
mov r15, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
movsxd rax, edx
cmp rax, rdx
cmove rdi, rax
test rdi, rdi
cvtsi2ss xmm1, rdi
mov rdi, qword [rsp + 0x78]
jns 0x18017e3b8
addss xmm1, xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, rbx
test rbx, rbx
jns 0x18017e3c9
addss xmm0, xmm2
mulss xmm0, dword [r14]
mulss xmm0, dword [r14 + 0x10]
comiss xmm0, xmm1
seta al
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
Function at 0x1801e3e24
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1801e3cc4
call fcn.1801d1b9c
mov dword [rax], 0x16
call fcn.1801d1a4c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1801e3cac
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1801e3cac
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1801e3cf6
lock or dword [rax + 0x14], 0x10
jmp 0x1801e3cac
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1801e3d13
mov rcx, qword [rbp + 0x10]
call fcn.1801e578c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1801dfed0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1801e36fc
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1801e3d6a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1801e3cac
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1801e3dd6
mov rcx, qword [rbp + 0x10]
call fcn.1801dfed0
cmp eax, 0xffffffff
je 0x1801e3dbd
mov rcx, qword [rbp + 0x10]
call fcn.1801dfed0
cmp eax, 0xfffffffe
je 0x1801e3dbd
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1801dfed0
movsxd rdi, eax
lea rsi, [0x180295c20]
mov rcx, rbx
sar rdi, 6
call fcn.1801dfed0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1801e3dc4
lea rax, [0x18028e410]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1801e3dd6
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1801e3e0c
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1801e3e08
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1801e3e08
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1801e3caf
jmp 0x1801e3c7c