joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800211c0
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov rax, qword [0x1800a72c0]
test rax, rax
jne 0x180021214
mov ecx, 0x1a8
call fcn.18002fd78
mov qword [rsp + 0x38], rax
test rax, rax
je 0x18002120a
mov rcx, rax
call fcn.1800205c0
jmp 0x18002120d
mov rax, rbx
mov qword [0x1800a72c0], rax
mov rcx, rax
call fcn.1800206f0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rax], 0
jne 0x18002123a
mov r8, rbx
jmp 0x18002124b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180021240
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000ae80
nop
mov r8d, 0xb
lea rdx, str.TGDmhlp.exe
lea rcx, [rsp + 0x40]
call fcn.1800102b0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1800212b4
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ff2aa7
call fcn.18001d490
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1800212d1
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000afd0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002fe60
add rsp, 0x70
pop rbx
ret
Function at 0x1800212f0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x198]
sub rsp, 0x290
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rdi, rdx
xor ebx, ebx
mov rax, qword [0x1800a72c0]
test rax, rax
jne 0x18002135d
mov ecx, 0x1a8
call fcn.18002fd78
mov qword [rsp + 0x28], rax
test rax, rax
je 0x180021353
mov rcx, rax
call fcn.1800205c0
jmp 0x180021356
mov rax, rbx
mov qword [0x1800a72c0], rax
mov rcx, rax
call fcn.1800206f0
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp word [rax], 0
jne 0x180021383
mov r8, rbx
jmp 0x18002139b
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180021390
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.18000ae80
nop
mov r8d, 0xc
lea rdx, str.GDVCDbus.exe
lea rcx, [rsp + 0x50]
call fcn.1800102b0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180021536
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.18004fb10
lea r8, str.1b6545
lea rdx, [0x18006e9d8]
lea rcx, [rsp + 0x70]
call fcn.180010750
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
xor r8d, r8d
lea rdx, [0x18006de50]
lea rcx, [rsp + 0x30]
call fcn.18000ae80
nop
mov r8d, 1
lea rdx, [0x18006e9e0]
lea rcx, [rsp + 0x30]
call fcn.18000ae80
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180010180
mov r8d, 2
lea rdx, [0x18006e9e4]
lea rcx, [rsp + 0x30]
call fcn.1800102b0
cmp word [rsp + 0x70], 0
jne 0x180021482
mov r8, rbx
jmp 0x18002149b
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180021490
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.1800102b0
mov r8d, 2
lea rdx, [0x180072d78]
lea rcx, [rsp + 0x30]
call fcn.1800102b0
cmp word [rdi], 0
je 0x1800214da
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1800214d0
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1800102b0
mov r8d, 1
lea rdx, [0x18006e9e0]
lea rcx, [rsp + 0x30]
call fcn.1800102b0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
call fcn.18001d720
nop
mov r8, qword [rsp + 0x48]
cmp r8, 8
jb 0x180021536
inc r8
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call fcn.18000afd0
nop
mov r8, qword [rsp + 0x68]
cmp r8, 8
jb 0x180021553
inc r8
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.18000afd0
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.18002fe60
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180021580
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
mov rax, qword [0x1800a72c0]
test rax, rax
jne 0x1800215d4
mov ecx, 0x1a8
call fcn.18002fd78
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800215ca
mov rcx, rax
call fcn.1800205c0
jmp 0x1800215cd
mov rax, rbx
mov qword [0x1800a72c0], rax
mov rcx, rax
call fcn.1800206f0
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rbx
mov word [rsp + 0x40], bx
cmp word [rax], 0
jne 0x1800215fa
mov r8, rbx
jmp 0x18002160b
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180021600
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18000ae80
nop
mov r8d, 0xb
lea rdx, str.TGDmhlp.exe
lea rcx, [rsp + 0x40]
call fcn.1800102b0
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180021674
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.2c3504
call fcn.18001d490
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x180021691
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.18000afd0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002fe60
add rsp, 0x70
pop rbx
ret
Function at 0x180026000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x40
mov rax, r8
mov rbx, rdx
mov rdx, rax
mov rcx, rbx
mov r8, r9
mov ebp, 0x8007000e
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x180026242
mov rdx, rax
mov qword [rsp + 0x60], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x18002623d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x18002623d
mov edx, esi
mov qword [rsp + 0x70], r14
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x180026238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x18002622f
mov r8d, esi
mov qword [rsp + 0x68], r12
mov rdx, rdi
mov rcx, rax
call fcn.18004f5f0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor r12d, r12d
lea r8, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x30], r12
mov rcx, r14
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x18002622a
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.1800232b0
mov rsi, rax
test rax, rax
je 0x18002621f
mov eax, dword [rax + 0x10]
mov qword [rsp + 0x78], r15
mov dword [rsi + 0x10], r12d
test eax, eax
jne 0x18002620c
cmp byte [rsp + 0x90], r12b
je 0x1800261c3
lea ecx, [rax + 0x18]
call sub.gdiplus.dll_GdipAlloc
mov edi, dword [rsp + 0x88]
mov rbx, rax
mov r15d, dword [rsp + 0x80]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x180026152
mov rcx, rsi
call fcn.180023500
mov r9d, eax
mov r8d, edi
mov edx, r15d
mov rcx, rbx
call fcn.180022430
mov rcx, rax
jmp 0x180026155
mov rcx, r12
mov rax, qword [rsp + 0x98]
mov qword [rax], rcx
test rcx, rcx
je 0x18002620c
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], r12
call sub.gdiplus.dll_GdipGetImageGraphicsContext
mov rbx, qword [rsp + 0x38]
mov edx, 4
mov rcx, rbx
call sub.gdiplus.dll_GdipSetSmoothingMode
mov edx, 7
mov rcx, rbx
call sub.gdiplus.dll_GdipSetInterpolationMode
mov rdx, qword [rsi + 8]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov rcx, rbx
mov dword [rsp + 0x20], r15d
call sub.gdiplus.dll_GdipDrawImageRectI
mov rcx, rbx
mov ebp, r12d
call sub.gdiplus.dll_GdipDeleteGraphics
jmp 0x18002620c
mov rcx, rsi
call fcn.180023500
mov rcx, rsi
mov edi, eax
call fcn.1800234d0
mov rcx, rsi
mov ebx, eax
call fcn.1800236f0
mov r9d, eax
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov rcx, rsi
call fcn.180023190
mov rcx, rax
mov rax, qword [rsp + 0x98]
test rcx, rcx
cmovne ebp, r12d
mov qword [rax], rcx
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [r8]
mov r15, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov r12, qword [rsp + 0x68]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r14, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x60]
mov eax, ebp
add rsp, 0x40
pop rdi
pop rbp
pop rbx
ret
Function at 0x180029bc0
Capabilities:
Check if file exists
Copy file
Read .ini file

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1800a82c0]
test rax, rax
jne 0x180029bfd
mov ecx, 0x178
call fcn.18002fd78
mov qword [rsp + 0x48], rax
test rax, rax
je 0x180029bf6
mov rcx, rax
call fcn.18002a0d0
nop
mov qword [0x1800a82c0], rax
mov rcx, rax
add rsp, 0x38
jmp fcn.18002c610
Function at 0x18002cc50
Capabilities:
Read .ini file

Disassembly:
push rbx
push r14
sub rsp, 0x468
mov rax, qword [0x1800a4830]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x240]
mov r8d, 0x208
call fcn.18004fb10
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.18004fb10
mov rax, qword [r14 + 0x48]
mov rax, qword [rax]
mov rbx, qword [rax]
cmp rbx, rax
je 0x18002ce8b
mov qword [rsp + 0x488], rbp
mov qword [rsp + 0x490], rsi
mov qword [rsp + 0x460], r15
lea r15, str.nothing
mov qword [rsp + 0x498], rdi
mov rbp, qword [rbx + 0x28]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rbp + rax*2 + 0x18], 0
jne 0x18002cce0
test eax, eax
jle 0x18002ce13
lea r8, [rbp + 0x18]
lea rdx, str.Is_s
lea rcx, [rsp + 0x240]
call fcn.180010750
lea rdi, [r14 + 0xf8]
cmp qword [rdi + 0x18], 8
jb 0x18002cd1e
mov rax, qword [rdi]
jmp 0x18002cd21
mov rax, rdi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x1800747b8]
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movzx eax, word [rsp + 0x30]
cmp ax, word [0x1800747b8]
jne 0x18002cd79
movzx eax, word [rsp + 0x32]
cmp ax, word [0x1800747ba]
jne 0x18002cd79
movzx eax, word [rsp + 0x34]
cmp ax, word [0x1800747bc]
je 0x18002cd89
lea rcx, [rsp + 0x30]
call fcn.180056ab0
mov rcx, qword [rbp + 8]
mov byte [rcx], al
lea r8, [rbp + 0x18]
lea rdx, str.Use_s
lea rcx, [rsp + 0x240]
call fcn.180010750
cmp qword [rdi + 0x18], 8
jb 0x18002cdab
mov rdi, qword [rdi]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
mov r8, r15
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x240]
lea rcx, str.HotKey
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
lea rdx, [rsp + 0x30]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r15 + rcx*2 - 2]
jne 0x18002cdf7
cmp rcx, 8
jne 0x18002cde0
jmp 0x18002ce13
mov rdx, qword [rbp + 0x10]
lea rcx, [rsp + 0x30]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x18002ce00
cmp byte [rbx + 0x19], 0
jne 0x18002ce5e
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x18002ce3e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x18002ce5e
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x18002ce30
jmp 0x18002ce5e
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18002ce5b
cmp rbx, qword [rax + 0x10]
jne 0x18002ce5b
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18002ce48
mov rbx, rax
mov rax, qword [r14 + 0x48]
cmp rbx, qword [rax]
jne 0x18002ccd1
mov r15, qword [rsp + 0x460]
mov rdi, qword [rsp + 0x498]
mov rsi, qword [rsp + 0x490]
mov rbp, qword [rsp + 0x488]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.18002fe60
add rsp, 0x468
pop r14
pop rbx
ret
Function at 0x180033b7c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180033b8f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1800341f4
lea rdx, [0x1800931a0]
lea rcx, [rsp + 0x20]
call fcn.18004fa28
int3

Function at 0x18003e72c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1800a9520]
xor edx, edx
jmp fcn.180033b7c

Function at 0x18003f11c
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1800a9520]
jmp fcn.180033b7c
Function at 0x180001720
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18002b3c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x18000175d
xor al, al
jmp 0x1800017ac
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x18000176e
xor al, al
jmp 0x1800017ac
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x180001795
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x180001795
mov al, 1
jmp 0x1800017ac
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18001af60
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18001af60
add rsp, 0x60
pop rbx
ret

Function at 0x180001a20
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x18002b3c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x180001a51
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x180001b0a
nop word [rax + rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x180001a7b
add rbx, 0x8000000
jmp 0x180001b01
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180001b0a
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180001ae6
cmp rcx, 0x10000
jb 0x180001ae6
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180001b0c
add rbx, 0x10000
jmp 0x180001b01
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x180001b01
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x180001a60
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18001af60
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x180001b30
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x18002b3c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x180001c18
nop dword [rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x180001b8b
sub rbx, 0x8000000
jmp 0x180001c0f
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180001c18
cmp dword [rsp + 0x40], 0x10000
jne 0x180001bf3
cmp qword [rsp + 0x38], 0x10000
jb 0x180001bf3
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180001c1a
sub rbx, 0x10000
jmp 0x180001c0f
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x180001b70
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18001af60
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x180001d20
Capabilities:
Hook routines via microsoft detours

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [rcx - 0x7ff80000]
mov r9, rcx
cmp rcx, 0x7ff80000
ja 0x180001d3e
mov ebx, 0x80000
mov qword [rsp + 0x30], rdi
lea rdi, [rcx + 0x7ff80000]
cmp r9, 0xffffffff80000000
jb 0x180001d5a
mov rdi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x180001d71
cmp byte [rcx + 1], 0x25
jne 0x180001db5
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x180001d7d
cmp al, 0xe9
jne 0x180001db5
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, r9
cmp rcx, r9
jae 0x180001da0
cmp rcx, 0xffffffff80000000
jae 0x180001d97
lea rdi, [rcx + 0x7ff80000]
jmp 0x180001db5
mov rdi, 0xfffffffffff80000
jmp 0x180001db5
lea rbx, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x180001db5
mov ebx, 0x80000
mov rax, qword [0x18002c3b0]
mov rcx, qword [0x18002c3c0]
test rax, rax
jne 0x180001dd7
test rcx, rcx
je 0x180001dee
mov rax, rcx
mov qword [0x18002c3b0], rcx
mov rdx, qword [rax + 0x10]
test rdx, rdx
je 0x180001dee
cmp rdx, rbx
jb 0x180001dee
cmp rdx, rdi
jbe 0x180001ea8
mov qword [0x18002c3b0], rcx
mov rax, rcx
test rcx, rcx
je 0x180001e32
mov rdx, rcx
test rcx, rcx
je 0x180001e1c
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x180001e1c
cmp rcx, rbx
jb 0x180001e1c
cmp rcx, rdi
jbe 0x180001ea8
mov rax, qword [rax + 8]
mov qword [0x18002c3b0], rax
mov rdx, rax
mov rcx, rax
test rax, rax
jne 0x180001e00
movzx eax, r9w
mov r8, rdi
sub r9, rax
mov rdx, rbx
mov rcx, r9
call fcn.180001c40
test rax, rax
je 0x180001eeb
mov dword [rax], 0x52727464
lea rdx, [rax + 0xffa8]
xor r8d, r8d
mov qword [0x18002c3b0], rax
mov qword [rax + 0x10], r8
mov r9d, 0x2a7
mov rcx, qword [0x18002c3c0]
mov qword [rax + 8], rcx
lea rcx, [rax + 0xff60]
mov qword [0x18002c3c0], rax
nop word [rax + rax]
mov qword [rdx], r8
lea rdx, [rdx - 0x60]
mov r8, rcx
sub rcx, 0x60
sub r9, 1
jne 0x180001e90
mov qword [rax + 0x10], r8
mov rdx, qword [rax + 0x10]
cmp rdx, rbx
jb 0x180001eeb
cmp rdx, rdi
ja 0x180001eeb
mov rcx, qword [rdx + 0x48]
movdqa xmm0, xmmword [0x1800258c0]
mov qword [rax + 0x10], rcx
mov rax, rdx
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
movups xmmword [rdx + 0x40], xmm0
movups xmmword [rdx + 0x50], xmm0
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180001fb0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18002b3c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x18002c3ac], 0
jne 0x180002074
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x18002c3ac], ecx
jne 0x180002074
mov qword [rsp + 0x40], rbx
mov rbx, qword [0x18002c3c0]
mov qword [rsp + 0x30], rdi
xor edi, edi
mov qword [0x18002c3d0], rdi
mov qword [0x18002c3c8], rdi
mov qword [0x18002c3b8], rdi
test rbx, rbx
je 0x180002050
nop word [rax + rax]
lea r9, [rsp + 0x20]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180002048
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x180002020
jmp 0x180002050
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov dword [0x18002c3a8], edi
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18001af60
add rsp, 0x38
ret
mov eax, 0x10dd
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18001af60
add rsp, 0x38
ret
Function at 0x180002620
Capabilities:
Suspend thread

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x18002c3a8]
mov rbx, rcx
test eax, eax
jne 0x1800026b9
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rbx, rax
jne 0x18000264a
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rdi
call fcn.18001af80
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x18000269d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 0x10
mov rcx, rdi
call fcn.18001afbc
mov rdi, qword [rsp + 0x30]
mov eax, ebx
mov dword [0x18002c3a8], ebx
mov qword [0x18002c3b8], 0
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x18002c3c8]
mov qword [rdi], rax
xor eax, eax
mov qword [rdi + 8], rbx
mov qword [0x18002c3c8], rdi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x180002a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbp
push rsi
sub rsp, 0x38
mov rax, qword [0x18002b3c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x18002c3ac], eax
je 0x180002aa4
mov eax, 0x10dd
jmp 0x180002bb9
mov eax, dword [0x18002c3a8]
test eax, eax
jne 0x180002bb9
test rbp, rbp
jne 0x180002ac1
mov eax, 0x57
jmp 0x180002bb9
test rsi, rsi
je 0x180002add
cmp qword [rsi], 0
jne 0x180002ae7
mov dword [0x18002c3a8], 6
mov qword [0x18002c3b8], rsi
mov eax, 6
jmp 0x180002bb9
mov qword [rsp + 0x60], rbx
mov ecx, 0x30
mov qword [rsp + 0x30], rdi
call fcn.18001af80
mov rcx, qword [rsi]
mov rbx, rax
call fcn.180001f00
mov rcx, rbp
mov rdi, rax
call fcn.180001f00
movzx edx, byte [rdi + 0x3e]
mov rbp, qword [rdi + 0x48]
sub rbp, rdx
test dl, dl
je 0x180002b85
cmp rdx, 0x1e
ja 0x180002b85
cmp qword [rdi + 0x50], rax
jne 0x180002b85
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov r8d, 0x40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180002b56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x180002b93
mov dword [rbx + 8], 1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x18], rbp
mov eax, dword [rsp + 0x20]
mov dword [rbx + 0x28], eax
mov rax, qword [0x18002c3d0]
mov qword [rbx], rax
xor eax, eax
mov qword [0x18002c3d0], rbx
jmp 0x180002baf
cmp dword [0x18002bdd0], 0
mov edi, 9
jne 0x180002b99
mov dword [0x18002c3a8], edi
mov edx, 0x30
mov rcx, rbx
call fcn.18001afbc
mov eax, edi
mov qword [0x18002c3b8], rsi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18001af60
add rsp, 0x38
pop rsi
pop rbp
ret
Function at 0x180007e60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, 0xffffffff
mov r10, rdx
mov eax, ebx
mov r8, rcx
test rdx, rdx
je 0x180007ece
lea r11, [0x18001fd20]
nop
movzx r9d, byte [r8]
lea r8, [r8 + 1]
dec r10
cmp r9b, 0x23
jne 0x180007eb4
cmp r10, 2
jb 0x180007eb4
cmp byte [r8], r9b
jne 0x180007eb4
cmp byte [r8 + 1], r9b
jne 0x180007eb4
not r9b
movzx eax, r9b
mov eax, dword [r11 + rax*4]
xor eax, 0xffffff
jmp 0x180007e80
movzx edx, al
xor rdx, r9
shr eax, 8
xor eax, dword [r11 + rdx*4]
test r10, r10
jne 0x180007e80
not eax
mov rbx, qword [rsp + 8]
ret
movzx r9d, byte [rcx]
inc r8
test r9b, r9b
je 0x180007f10
lea r11, [0x18001fd20]
cmp r9b, 0x23
jne 0x180007ef3
cmp byte [r8], r9b
jne 0x180007ef3
cmp byte [r8 + 1], r9b
cmove eax, ebx
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180007ee1
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180009270
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push r15
sub rsp, 0x20
mov rbx, qword [0x18002c018]
xor r15d, r15d
mov rbp, rcx
mov dword [rbx + 0x53ac], r15d
test rcx, rcx
je 0x18000936c
mov qword [rsp + 0x48], rsi
lea rcx, [rbx + 0x53b0]
mov qword [rsp + 0x50], rdi
xor edx, edx
mov qword [rsp + 0x58], r14
mov dword [rbx + 0x53ac], r15d
call fcn.1800056f0
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x40], r15b
lea rcx, [rbx + 0x53b0]
call fcn.180009f20
mov esi, r15d
cmp dword [rbx + 0x53c0], r15d
jle 0x180009309
mov edi, r15d
nop
mov r9, qword [rbx + 0x53c8]
lea r8, [rbx + 0x53b0]
add r9, rdi
mov rcx, rbx
mov rdx, r9
call qword [r9 + 0x38]
inc esi
add rdi, 0x48
cmp esi, dword [rbx + 0x53c0]
jl 0x1800092e0
mov eax, dword [rbx + 0x53b0]
lea rdi, [0x18002bde7]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x53b8]
cmove ecx, r15d
test rax, rax
movsxd rsi, ecx
mov rcx, rbp
cmovne rdi, rax
call fcn.180007f20
mov r14, qword [rsp + 0x58]
mov rbx, rax
test rax, rax
je 0x180009362
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rbp
pop rbx
ret