joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180064fb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180064fd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180064fd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x180096250
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x3c], r8d
mov rdx, rcx
mov qword [rbp - 0x48], rdx
xor ecx, ecx
mov qword [rbp - 0x50], rcx
mov r9d, 2
mov dword [rbp - 0x40], r9d
lea rcx, [rbp - 0x78]
call fcn.180003560
mov r8d, dword [rbp - 0x3c]
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x50]
mov r9d, dword [rbp - 0x40]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x78]
call fcn.1800035b0
test ebx, ebx
jne 0x1800962c4
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
jne 0x1800962eb
lea rcx, [0x18016e630]
call fcn.1800028d0
mov rbx, rax
mov rcx, rbx
call fcn.1800a84b0
mov rcx, rbx
call fcn.180002e50
lea rcx, [0x18016dea8]
call fcn.1800028d0
mov rbx, rax
mov rcx, rbx
call fcn.1800a42a0
mov rcx, rbx
call fcn.180002e50
int3

Function at 0x180096770
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x50]
mov rbx, rcx
mov eax, dword [rbx + 0x38]
cmp eax, 0xffffffff
je 0x18009678d
add rsp, 0x48
pop rbx
pop rbp
ret
mov dword [rsp + 0x20], 0x10
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov rcx, rbx
mov r9d, 4
call fcn.1800e8070
mov ecx, eax
test ecx, ecx
jne 0x18009681a
xor eax, eax
mov ecx, 0x40000000
test byte [rbp - 0x10], 0x30
cmove eax, ecx
mov ecx, eax
or ecx, 0x80000000
test byte [rbp - 0x10], 2
cmovne eax, ecx
mov ecx, eax
or ecx, 0x10000000
test dword [rbp - 0x10], 0x800
cmovne eax, ecx
mov ecx, eax
or ecx, 0x8000000
test byte [rbp - 0x10], 4
cmovne eax, ecx
mov ecx, eax
or ecx, 0x4000000
test dword [rbp - 0x10], 0x1000
cmovne eax, ecx
mov ecx, eax
or ecx, 0x20000000
test byte [rbp - 0x10], 8
cmovne eax, ecx
mov dword [rbx + 0x38], eax
add rsp, 0x48
pop rbx
pop rbp
ret
call fcn.1800e7f40
mov ecx, eax
lea rdx, [0x18014dd48]
call fcn.1800ce940
mov rcx, rax
call fcn.180002e50
int3
Function at 0x180099e40
Capabilities:
Get session user name

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rcx
xor ecx, ecx
mov dword [rbp - 0x3c], ecx
jmp 0x180099e97
cmp dword [rax + 0xa0], 0xea
jne 0x180099f1d
mov edx, dword [rbp - 0x3c]
test edx, edx
jl 0x180099f37
mov rbx, qword [rbp + 0x10]
cmp edx, dword [rbx + 0x18]
jbe 0x180099e97
sub edx, dword [rbx + 8]
mov rcx, rbx
call fcn.1800c80b0
mov qword [rbp + 0x10], rbx
mov rsi, qword [rbx + 0x10]
lea rdi, [rbp - 0x3c]
mov qword [rbp - 0x48], rsi
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r8, rdi
mov qword [rbp - 0x54], r8
mov rdx, rsi
mov qword [rbp - 0x5c], rdx
mov ecx, 2
mov dword [rbp - 0x4c], ecx
lea rcx, [rbp - 0x88]
call fcn.180003560
mov r8, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov ecx, dword [rbp - 0x4c]
call sub.Secur32.dll_GetUserNameExW
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.1800035b0
movzx ebx, bl
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x48], rax
call fcn.180001f04
mov dword [rax + 0xa0], esi
test ebx, ebx
je 0x180099e68
mov eax, dword [rbp - 0x3c]
mov rbx, qword [rbp + 0x10]
mov dword [rbx + 8], eax
jmp 0x180099f26
xor eax, eax
mov rbx, qword [rbp + 0x10]
mov dword [rbx + 8], eax
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1800e53b0
int3

Function at 0x1800e5850
Capabilities:
Copy file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0xd0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, r8
mov rsi, r9
mov rdi, qword [rbp + 0x30]
mov qword [rbp - 0x40], rdi
test rdx, rdx
je 0x1800e5891
add rdx, 0xc
jmp 0x1800e5893
xor edx, edx
mov qword [rbp - 0x48], rdx
mov r14, rdx
test rcx, rcx
je 0x1800e58a8
add rcx, 0xc
mov r15, rcx
jmp 0x1800e58ab
xor r15d, r15d
mov qword [rbp - 0x50], r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov qword [rsp + 0x20], rdi
mov edi, dword [rbp + 0x38]
mov dword [rsp + 0x28], edi
mov rcx, r15
mov qword [rbp - 0x58], rcx
mov rdx, r14
mov qword [rbp - 0x60], rdx
mov r8, rbx
mov qword [rbp - 0x68], r8
mov r9, rsi
mov qword [rbp - 0x70], r9
lea rcx, [rbp - 0x98]
call fcn.180003560
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x68]
mov r9, qword [rbp - 0x70]
call sub.KERNEL32.dll_CopyFileExW
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.1800035b0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
test ebx, ebx
setne bl
movzx ebx, bl
call fcn.180001f04
mov dword [rax + 0xa0], esi
movzx eax, bl
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1800e5e60
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
test rcx, rcx
je 0x1800e5e8c
add rcx, 0xc
mov rbx, rcx
jmp 0x1800e5e8e
xor ebx, ebx
mov qword [rbp - 0x40], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rbx
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.180003560
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_DeleteFileW
mov ebx, eax
lea rcx, [rbp - 0x70]
call fcn.1800035b0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
test ebx, ebx
setne bl
movzx ebx, bl
call fcn.180001f04
mov dword [rax + 0xa0], esi
movzx eax, bl
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1800e6ad0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov qword [rbp - 0x48], rax
mov rbx, rdx
mov esi, r8d
mov rdi, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1800d83e0
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x54], rcx
mov rdx, rbx
mov qword [rbp - 0x5c], rdx
mov r8d, esi
mov dword [rbp - 0x4c], r8d
mov r9, rdi
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.180003560
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
lea rcx, [rbp - 0x90]
call fcn.1800035b0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
cmp byte [rbp - 0x40], 0
je 0x1800e6b8d
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1800d8420
call fcn.180001f04
mov dword [rax + 0xa0], esi
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1800e6bf0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xorps xmm4, xmm4
movaps xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov rsi, rdx
mov edi, r8d
mov rbx, r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x48], rcx
lea rdx, [rbp - 0x40]
cmp dword [rcx], ecx
call fcn.1800d83e0
nop
mov qword [rbp - 0x50], rbx
mov rcx, qword [rbp - 0x48]
mov r14, qword [rcx + 8]
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, r14
mov qword [rbp - 0x5c], rcx
mov rdx, rsi
mov qword [rbp - 0x64], rdx
mov r8d, edi
mov dword [rbp - 0x54], r8d
mov r9, rbx
mov qword [rbp - 0x6c], r9
lea rcx, [rbp - 0x98]
call fcn.180003560
mov rcx, qword [rbp - 0x5c]
mov rdx, qword [rbp - 0x64]
mov r8d, dword [rbp - 0x54]
mov r9, qword [rbp - 0x6c]
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
lea rcx, [rbp - 0x98]
call fcn.1800035b0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor ecx, ecx
mov qword [rbp - 0x50], rcx
cmp byte [rbp - 0x40], 0
je 0x1800e6cbf
mov rcx, qword [rbp - 0x48]
cmp byte [rcx], cl
xor edx, edx
call fcn.1800d8420
call fcn.180001f04
mov dword [rax + 0xa0], esi
mov eax, ebx
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1800e73c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov qword [rbp - 0x40], rax
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
mov qword [rbp - 0x40], r9
mov r14, r9
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov r15, qword [rbp + 0x30]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov qword [rbp - 0x4c], rcx
mov rdx, rsi
mov qword [rbp - 0x54], rdx
mov r8d, edi
mov dword [rbp - 0x44], r8d
mov r9, r14
mov qword [rbp - 0x5c], r9
lea rcx, [rbp - 0x88]
call fcn.180003560
mov rcx, qword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
mov r8d, dword [rbp - 0x44]
mov r9, qword [rbp - 0x5c]
call sub.KERNEL32.dll_WriteFile
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.1800035b0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
xor eax, eax
mov qword [rbp - 0x40], rax
call fcn.180001f04
mov dword [rax + 0xa0], esi
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x18000fbd0
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
test rdx, rdx
je 0x18000fc7f
mov ebp, r8d
mov rbx, rdx
mov rsi, rcx
mov r9, rdx
shr r9, 0x20
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test rax, rax
je 0x18000fc86
mov rdi, rax
mov eax, ebp
and eax, 4
lea edx, [rax*8 + 4]
mov qword [rsp + 0x20], rbx
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r14, rax
test rax, rax
je 0x18000fc8d
xor eax, eax
test bpl, 2
sete al
lea edx, [rax*2 + 2]
mov qword [rsp + 0x20], rbx
xor ebx, ebx
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x18000fc96
mov qword [rsi], r14
mov qword [rsi + 8], rax
jmp 0x18000fc9b
mov ebx, 2
jmp 0x18000fca4
mov ebx, 1
jmp 0x18000fca4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x18000fd10
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
cmp dword [0x18065c1d0], 0
jne 0x18000fd6f
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x2c]
mov ecx, dword [rsp + 0x50]
dec eax
mov edx, eax
shr edx, 1
or edx, eax
mov eax, edx
shr eax, 2
or eax, edx
mov edx, eax
shr edx, 4
or edx, eax
mov eax, edx
shr eax, 8
or eax, edx
mov edx, eax
shr edx, 0x10
or edx, eax
inc edx
shl rcx, 0x20
or rdx, rcx
mov qword [0x18065c1d8], rdx
mov eax, 1
xchg dword [0x18065c1d0], eax
mov rax, qword [0x18065c1d8]
add rsp, 0x58
ret
Function at 0x18001bc30
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret
Function at 0x180028730
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1804ccc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edx, 8
lea rcx, [rsp + 0x40]
call fcn.1800186f0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.180033be0
lea rax, [0x1800270d0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
add rax, 8
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
call fcn.18001b560
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rsp + 0x38]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0
je 0x1800287d3
lea rcx, [rsp + 0x40]
call fcn.18005af10
nop
jmp 0x1800287ea
mov rax, qword [rsp + 0x60]
mov dword [rax + 8], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
lea rcx, [rsp + 0x40]
call fcn.18003c670
nop
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c5020
add rsp, 0x58
ret

Function at 0x18002f160
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1804ccc80]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.180019cc0
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180019c10
nop
lea rcx, [rsp + 0x38]
call fcn.180019d90
movzx eax, al
test eax, eax
je 0x18002f1f9
lea rcx, [rsp + 0x38]
call fcn.18001bc50
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x18002f1f9
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001b610
mov rcx, rax
call fcn.1800198d0
cmp eax, 0xfaba0065
jne 0x18002f1f7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001ae10
jmp 0x18002f210
jmp 0x18002f1b1
lea rcx, [rsp + 0x28]
call fcn.18001b650
movzx eax, al
test eax, eax
jne 0x18002f17e
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800c5020
add rsp, 0x68
ret
Function at 0x18002f230
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1804ccc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.18003bb90
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180019c10
nop
lea rcx, [rsp + 0x30]
call fcn.180019d90
movzx eax, al
test eax, eax
je 0x18002f2c9
lea rcx, [rsp + 0x30]
call fcn.18001bc50
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x18002f2c9
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18001b610
mov rcx, rax
call fcn.1800198d0
cmp eax, 0xfaba0065
jne 0x18002f2c7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18001ae10
jmp 0x18002f2e0
jmp 0x18002f281
lea rcx, [rsp + 0x28]
call fcn.180058fb0
movzx eax, al
test eax, eax
jne 0x18002f24e
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c5020
add rsp, 0x58
ret

Function at 0x1800300d0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1804ccc80]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.180019cc0
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180019c10
nop
lea rcx, [rsp + 0x38]
call fcn.180019d90
movzx eax, al
test eax, eax
je 0x180030169
lea rcx, [rsp + 0x38]
call fcn.18001bc50
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x180030169
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001b610
mov rcx, rax
call fcn.1800198d0
cmp eax, 0xf8f45725
jne 0x180030167
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001ae10
jmp 0x180030180
jmp 0x180030121
lea rcx, [rsp + 0x28]
call fcn.18001b650
movzx eax, al
test eax, eax
jne 0x1800300ee
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800c5020
add rsp, 0x68
ret

Function at 0x180030410
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1804ccc80]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.180019cc0
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180019c10
nop
lea rcx, [rsp + 0x38]
call fcn.180019d90
movzx eax, al
test eax, eax
je 0x1800304a9
lea rcx, [rsp + 0x38]
call fcn.18001bc50
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1800304a9
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001b610
mov rcx, rax
call fcn.1800198d0
cmp eax, 0x53b2070f
jne 0x1800304a7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001ae10
jmp 0x1800304c0
jmp 0x180030461
lea rcx, [rsp + 0x28]
call fcn.18001b650
movzx eax, al
test eax, eax
jne 0x18003042e
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800c5020
add rsp, 0x68
ret
Function at 0x180030d00
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1804ccc80]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.180019cc0
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180019c10
nop
lea rcx, [rsp + 0x38]
call fcn.180019d90
movzx eax, al
test eax, eax
je 0x180030d99
lea rcx, [rsp + 0x38]
call fcn.18001bc50
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x180030d99
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001b610
mov rcx, rax
call fcn.1800198d0
cmp eax, 0x3285501
jne 0x180030d97
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001ae10
jmp 0x180030db0
jmp 0x180030d51
lea rcx, [rsp + 0x28]
call fcn.18001b650
movzx eax, al
test eax, eax
jne 0x180030d1e
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800c5020
add rsp, 0x68
ret

Function at 0x180030dd0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1804ccc80]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call fcn.180019cc0
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180019c10
nop
lea rcx, [rsp + 0x38]
call fcn.180019d90
movzx eax, al
test eax, eax
je 0x180030e69
lea rcx, [rsp + 0x38]
call fcn.18001bc50
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x180030e69
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001b610
mov rcx, rax
call fcn.1800198d0
cmp eax, 0xafcab3c4
jne 0x180030e67
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18001ae10
jmp 0x180030e80
jmp 0x180030e21
lea rcx, [rsp + 0x28]
call fcn.18001b650
movzx eax, al
test eax, eax
jne 0x180030dee
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800c5020
add rsp, 0x68
ret

Function at 0x180031040
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1804ccc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.18003bb90
nop
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180019c10
nop
lea rcx, [rsp + 0x30]
call fcn.180019d90
movzx eax, al
test eax, eax
je 0x1800310d9
lea rcx, [rsp + 0x30]
call fcn.18001bc50
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1800310d9
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18001b610
mov rcx, rax
call fcn.1800198d0
cmp eax, 0x2fa62ca8
jne 0x1800310d7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18001ae10
jmp 0x1800310f0
jmp 0x180031091
lea rcx, [rsp + 0x28]
call fcn.180058fb0
movzx eax, al
test eax, eax
jne 0x18003105e
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c5020
add rsp, 0x58
ret
Function at 0x1800398d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.180039880
nop
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x18003ee10
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x18003ee33
mov rcx, qword [rsp + 0x40]
call fcn.1800490c0
nop
jmp 0x18003ee4b
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x18003ee4b
mov rcx, qword [rsp + 0x40]
call fcn.180048ec0
nop
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x180040830
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jl 0x180040871
mov al, 1
jmp 0x180040873
xor al, al
add rsp, 0x48
ret