joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b430
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x18005c010]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x90]
call fcn.18001b290
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x18000b657
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
lea rax, [rsp + 0x90]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bp
jne 0x18000b4c1
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.18000c180
nop
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x18000b52d
lea rdi, [rcx + 0x16]
mov qword [rsp + 0x40], rdi
lea rbx, [rsp + 0x30]
cmp rdx, 8
cmovae rbx, qword [rsp + 0x30]
lea rcx, [rbx + rcx*2]
mov r8d, 0x2c
lea rdx, str.PerfmonBarconfig.xml
call fcn.18001abe0
mov word [rbx + rdi*2], bp
lea rax, [rsp + 0x30]
jmp 0x18000b54c
mov qword [rsp + 0x20], 0x16
lea r9, str.PerfmonBarconfig.xml
mov edx, 0x16
lea rcx, [rsp + 0x30]
call fcn.18000d980
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x80], xmm1
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], 7
mov word [rax], bp
lea rax, [rsp + 0x50]
cmp rsi, rax
je 0x18000b5d8
mov rdx, qword [rsi + 0x18]
cmp rdx, 8
jb 0x18000b5cf
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18000b5bd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000b686
mov rcx, r8
call fcn.180015f40
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x18000b617
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000b617
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b611
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b686
call fcn.180015f40
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000b655
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b650
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000b680
call fcn.180015f40
xor eax, eax
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.180015f20
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18001f374
nop
call fcn.18001f374
nop
int3
Function at 0x18000c700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov rbp, rcx
mov r8, qword [r8 + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x18000c72e
mov rdx, qword [rdi]
movabs rbx, 0xcbf29ce484222325
xor r13d, r13d
mov ecx, r13d
add r8, r8
je 0x18000c763
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x18000c750
mov r9, rbx
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.18000d6d0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x18000c78c
mov qword [r14], rax
mov byte [r14 + 8], r13b
jmp 0x18000c94c
movabs rax, 0x249249249249249
cmp qword [rbp + 0x10], rax
je 0x18000c967
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov ecx, 0x70
call fcn.180015f74
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rdi
lea rcx, [rax + 0x10]
call fcn.18000d150
mov qword [rsi + 0x38], r13
mov qword [rsi + 0x58], r13
mov qword [rsi + 0x30], r13
mov qword [rsi + 0x40], r13
mov qword [rsi + 0x48], 7
mov qword [rsi + 0x50], r13
mov qword [rsi + 0x60], r13
mov qword [rsi + 0x68], 7
mov r9, qword [rbp + 0x10]
lea rcx, [r9 + 1]
movss xmm3, dword [rbp]
xorps xmm0, xmm0
test rcx, rcx
js 0x18000c810
cvtsi2ss xmm0, rcx
jmp 0x18000c825
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [rbp + 0x38]
xorps xmm2, xmm2
test rdi, rdi
js 0x18000c838
cvtsi2ss xmm2, rdi
jmp 0x18000c850
mov rcx, rdi
shr rcx, 1
mov rax, rdi
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, xmm3
seta al
test al, al
je 0x18000c8f0
divss xmm0, xmm3
call fcn.1800417b4
xor ecx, ecx
movss xmm1, dword [0x180052eb8]
comiss xmm0, xmm1
jb 0x18000c893
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000c893
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x18000c8c5
cmp rdi, 0x200
jae 0x18000c8c2
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x18000c8c5
mov rdi, rcx
mov rdx, rdi
mov rcx, rbp
call fcn.18000d2b0
mov r9, rbx
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.18000d6d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [rbp + 0x10]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
lea rax, [r9 + 1]
mov qword [rbp + 0x10], rax
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x18000c92d
mov qword [rcx + rax*8], rsi
jmp 0x18000c93f
cmp r9, rdx
jne 0x18000c938
mov qword [rcx + rax*8], rsi
jmp 0x18000c944
cmp qword [rcx + rax*8 + 8], r8
jne 0x18000c944
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1800171bc
int3
Function at 0x18000e290
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18005c010]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 7
call fcn.18000b430
mov ebx, eax
test eax, eax
js 0x18000e306
cmp qword [rsp + 0x48], 8
lea r8, [rsp + 0x30]
mov dword [rsp + 0x28], 1
lea rdx, str.edit
cmovae r8, qword [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ebx, ebx
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18000e344
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000e33f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e359
call fcn.180015f40
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180015f20
add rsp, 0x60
pop rbx
ret
call fcn.18001f374
int3
Function at 0x180012530
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x18005c010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov qword [rsp + 0x40], rbp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x40]
call fcn.180012430
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x18001264c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x180012621
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.180012530
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x18001264c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1800125d0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180012636
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov dword [rsp + 0x48], ebp
mov rcx, rdi
call fcn.180012740
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x180012657
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180015f20
mov rbx, qword [rsp + 0x2b0]
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x180012740
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1800127f6
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x1800127c2
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800127e1
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800127e1
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x1800127e1
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x18005f4f0], 0
jne 0x180012841
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180012831
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18005f4e8], rax
mov byte [0x18005f4f0], 1
jmp 0x180012848
mov rax, qword [0x18005f4e8]
mov byte [0x18005f4f0], 1
jmp 0x180012848
mov rax, qword [0x18005f4e8]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x1800127cb
xor r9d, r9d
mov r8d, dword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180013d20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x18005c010]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], r14
xor edx, edx
mov r8d, 0x408
lea rcx, [rsp + 0x60]
call fcn.18001b290
mov qword [rsp + 0x60], r14
xor edx, edx
lea r8d, [r14 + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180013db7
xor edx, edx
lea r8d, [r14 + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x180013db7
call fcn.180011780
mov ebx, eax
jmp 0x180013edc
mov r8, r15
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180013dd8
call fcn.180011780
jmp 0x180013ecb
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x180013dfb
call fcn.180011780
jmp 0x180013ecb
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x30], eax
inc eax
cmp eax, ebx
jae 0x180013e1d
mov ebx, 0x8007000e
jmp 0x180013ecd
mov ecx, eax
test eax, eax
je 0x180013e52
xor edx, edx
mov rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x180013f14
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x180013e52
lea rcx, [rsp + 0x60]
call fcn.180011750
jmp 0x180013e5c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
jmp 0x180013e6f
cmp qword [rsp + 0x60], 0
jne 0x180013e7e
mov ebx, 0x8007000e
jmp 0x180013ecd
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, rsi
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180013ea8
call fcn.180011780
jmp 0x180013ecb
mov ecx, eax
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
mov r8d, dword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
call fcn.180013830
mov ebx, eax
test rdi, rdi
je 0x180013edc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x60], rax
je 0x180013ef3
lea rcx, [rsp + 0x60]
call fcn.180011730
nop
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180015f20
add rsp, 0x480
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80070216
call fcn.18000dc80
int3
Function at 0x180015460
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov rbp, rcx
mov r8, qword [r8 + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x180015489
mov rdx, qword [rdi]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
add r8, r8
je 0x1800154c3
movabs r9, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x1800154b0
mov r9, rbx
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.18000d6d0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1800154ed
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x180015691
movabs rax, 0x492492492492492
cmp qword [rbp + 0x10], rax
je 0x1800156a3
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0
mov ecx, 0x38
call fcn.180015f74
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rdi
lea rcx, [rax + 0x10]
call fcn.18000d150
mov qword [rsi + 0x30], 0
mov r9, qword [rbp + 0x10]
lea rcx, [r9 + 1]
movss xmm3, dword [rbp]
xorps xmm0, xmm0
test rcx, rcx
js 0x180015555
cvtsi2ss xmm0, rcx
jmp 0x18001556a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [rbp + 0x38]
xorps xmm2, xmm2
test rdi, rdi
js 0x18001557d
cvtsi2ss xmm2, rdi
jmp 0x180015595
mov rcx, rdi
shr rcx, 1
mov rax, rdi
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, xmm3
seta al
test al, al
je 0x180015635
divss xmm0, xmm3
call fcn.1800417b4
xor ecx, ecx
movss xmm1, dword [0x180052eb8]
comiss xmm0, xmm1
jb 0x1800155d8
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800155d8
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x18001560a
cmp rdi, 0x200
jae 0x180015607
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x18001560a
mov rdi, rcx
mov rdx, rdi
mov rcx, rbp
call fcn.18000d2b0
mov r9, rbx
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.18000d6d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [rbp + 0x10]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
lea rax, [r9 + 1]
mov qword [rbp + 0x10], rax
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x180015672
mov qword [rcx + rax*8], rsi
jmp 0x180015684
cmp r9, rdx
jne 0x18001567d
mov qword [rcx + rax*8], rsi
jmp 0x180015689
cmp qword [rcx + rax*8 + 8], r8
jne 0x180015689
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1800171bc
int3
Function at 0x140333b20
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140333b2d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140333b3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140333b25
lea eax, [rcx + 1]
jmp 0x140333b4b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140333b5e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140333b44
sub eax, 3
jb 0x140333b7e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140333bcd
sar eax, 1
movsxd rbp, eax
jb 0x140333bb4
jmp 0x140333b8c
add ebx, ebx
jne 0x140333b8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140333bb4
inc ecx
add ebx, ebx
jne 0x140333b9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140333bb4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140333bad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140333b9c
add ecx, 2
jmp 0x140333bb9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140333ae2
jmp 0x140333b2d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xd1800
mov dl, 0x1a
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140333c19
cmp rsi, rcx
jae 0x140333c21
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140333c00
cmp al, 0x8f
ja 0x140333c00
cmp byte [rsi - 2], 0xf
je 0x140333c06
sub al, 0xe8
cmp al, 1
ja 0x140333bea
cmp rsi, rcx
jae 0x140333c21
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140333bf0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140333c21
lodsb al, byte [rsi]
jmp 0x140333c00
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x32f000]
mov eax, dword [rdi]
or eax, eax
je 0x140333c8a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x3440c8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140333c2e
jns 0x140333c63
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140333c6d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140333c84
mov qword [rbx], rax
add rbx, 8
jmp 0x140333c4e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140333ce2
sub rsp, 0xffffffffffffff80
jmp section.UPX0
Function at 0x14006f950
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14006f95d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14006f96d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14006f955
lea eax, [rcx + 1]
jmp 0x14006f97b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14006f98e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14006f974
sub eax, 3
jb 0x14006f9ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14006f9fd
sar eax, 1
movsxd rbp, eax
jb 0x14006f9e4
jmp 0x14006f9bc
add ebx, ebx
jne 0x14006f9ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14006f9e4
inc ecx
add ebx, ebx
jne 0x14006f9ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14006f9e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14006f9dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14006f9cc
add ecx, 2
jmp 0x14006f9e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14006f912
jmp 0x14006f95d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3cc00
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14006fa4d
cmp rsi, rcx
jae 0x14006fa55
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14006fa34
cmp al, 0x8f
ja 0x14006fa34
cmp byte [rsi - 2], 0xf
je 0x14006fa3a
sub al, 0xe8
cmp al, 1
ja 0x14006fa1e
cmp rsi, rcx
jae 0x14006fa55
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14006fa24
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14006fa55
lodsb al, byte [rsi]
jmp 0x14006fa34
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x6c000]
mov eax, dword [rdi]
or eax, eax
je 0x14006fab2
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6f578]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14006fa62
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14006faac
mov qword [rbx], rax
add rbx, 8
jmp 0x14006fa82
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14006faec
cmp al, 0xef
ja 0x14006fade
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14006fabe
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14006facd
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14006fb40
sub rsp, 0xffffffffffffff80
jmp 0x140017120
Function at 0x14000a690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov dword [rsp + 0x34], eax
mov rbx, rdx
mov dword [rsp + 0x30], esi
mov rdi, rcx
mov qword [rsp + 0x20], rsi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x14000a6dc
mov rdx, qword [rbx]
mov r8d, dword [rbx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000a72a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000a725
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a749
mov rcx, r8
call fcn.14002eb60
mov qword [rbx + 0x10], rsi
mov byte [rbx], sil
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140035a5c
int3

Function at 0x14000a750
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
lea r9, [rsp + 0x30]
xor esi, esi
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x30], esi
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
add eax, eax
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [rbx + 0x18], 7
mov rdx, rbx
mov r8, qword [rbx + 0x10]
jbe 0x14000a7a2
mov rdx, qword [rbx]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
add r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14000a7f4
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000a7ef
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000a813
mov rcx, r8
call fcn.14002eb60
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.140035a5c
int3