joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180038fa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov ebx, dword [rsp + 0x68]
lea r12d, [rdx - 3]
mov r15, r8
mov ebp, edx
mov r14, rcx
cmp edx, r12d
jbe 0x1800390f4
nop
mov eax, ebp
sub eax, 0xe6
je 0x180039071
sub eax, 2
je 0x1800390cb
cmp eax, 1
jne 0x1800390e9
mov rcx, qword [r14 + 0x10]
cmp rcx, 8
jb 0x180039017
mov qword [r14 + 0x10], 8
mov rax, r14
cmp qword [r14 + 0x18], 0x10
jb 0x18003900e
mov rax, qword [r14]
mov byte [rax + 8], 0
jmp 0x1800390e9
mov rdx, qword [r14 + 0x18]
mov esi, 8
mov rax, rdx
sub rsi, rcx
sub rax, rcx
cmp rsi, rax
ja 0x18003905c
mov qword [r14 + 0x10], 8
mov rax, r14
cmp rdx, 0x10
jb 0x180039042
mov rax, qword [r14]
lea rdi, [rax + rcx]
mov r8, rsi
mov rcx, rdi
xor edx, edx
call fcn.1800746e0
mov byte [rdi + rsi], 0
jmp 0x1800390e9
mov r9, rsi
mov byte [rsp + 0x20], 0
mov rdx, rsi
mov rcx, r14
call fcn.1800691c0
jmp 0x1800390e9
mov esi, 0xf3
mov eax, esi
sub eax, 0xf1
je 0x1800390f4
sub eax, 1
je 0x1800390bc
cmp eax, 1
jne 0x1800390c1
mov rdi, qword [r14]
mov edx, eax
mov r9, qword [rdi + 0x18]
mov r8, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x30]
call fcn.18007c8f8
cmp rax, qword [rdi + 0x40]
je 0x1800390c1
mov rax, qword [r15]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x2b
mov rcx, qword [r15]
mov rax, qword [rcx]
call qword [rax]
jmp 0x1800390c1
mov ebx, 1
dec esi
cmp esi, 0xf0
ja 0x180039076
lea r9, [rsp + 0x78]
mov qword [rsp + 0x78], 4
mov r8, r14
mov edx, 0xf
mov rcx, r15
call fcn.180011450
dec ebp
cmp ebp, r12d
ja 0x180038fd0
mov rbp, qword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18003ae20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x88]
lea r15d, [rdx + 3]
mov r12, r8
mov ebp, edx
mov r14, rcx
cmp edx, r15d
jae 0x18003af52
mov rsi, qword [rsp + 0x88]
xor r13d, r13d
nop dword [rax]
mov eax, ebp
sub eax, 0x15
je 0x18003af36
sub eax, 1
je 0x18003aed1
cmp eax, 2
jne 0x18003af47
mov rax, qword [r14]
lea rdx, [rsp + 0x88]
mov r8d, 0x52
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x88], 0xff
call fcn.18005bea0
mov eax, dword [r12]
lea rdx, [rsp + 0x88]
mov dword [rsp + 0x88], eax
lea rcx, [rsp + 0x20]
mov rax, qword [r14]
mov r8d, 0x52
mov qword [rsp + 0x20], rax
call fcn.18005bea0
jmp 0x18003af47
mov edi, 0xae
mov eax, edi
sub eax, 0xae
je 0x18003aef1
sub eax, 1
je 0x18003aeeb
cmp eax, 1
je 0x18003af52
jmp 0x18003af2a
lea rbx, [rsi + rsi*2]
jmp 0x18003af2a
mov r9, qword [0x1800bd648]
lea rcx, [rsp + 0x78]
mov edx, 3
lea r8d, [rdx - 2]
call fcn.18007c8f8
movzx ecx, byte [rsp + 0x79]
mov rsi, rax
movzx edx, byte [rsp + 0x78]
shl edx, 8
or edx, ecx
movzx ecx, byte [rsp + 0x7a]
shl edx, 8
or edx, ecx
mov dword [r14], edx
inc edi
cmp edi, 0xb1
jb 0x18003aed6
jmp 0x18003af47
xor eax, eax
mov dword [r14], r13d
mov word [rsp + 0x78], ax
mov rsi, r13
mov byte [rsp + 0x7a], al
inc ebp
cmp ebp, r15d
jb 0x18003ae60
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003afe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea r12d, [r9 + 0xa2]
mov r14, rdx
mov rdi, r8
mov rdx, rcx
cmp r9d, r12d
jae case.0x18003b054.3
mov rbp, qword [rsp + 0x38]
lea esi, [r9 - 0x1f]
mov r15d, dword [rsp + 0x98]
lea r8, [0x180000000]
mov r13, qword [rsp + 0x38]
cmp esi, 0xb9
ja case.0x18003b054.7
movzx eax, byte [r8 + rsi + 0x3b278]
mov ecx, dword [r8 + rax*4 + 0x3b258]
add rcx, r8
jmp rcx
mov rax, qword [r14]
mov rbp, qword [rax + 0x228]
mov r15d, dword [rax + 0x1e0]
mov rax, qword [rax + 0x28]
mov rcx, qword [rax]
mov qword [rbp + 0x20], rcx
mov rax, qword [r14]
mov rcx, qword [rax + 0x28]
mov rax, qword [rcx + 8]
mov qword [rbp + 0x28], rax
jmp case.0x18003b054.7
mov rcx, qword [r14]
cmp dword [rcx + 0x148], 0
je 0x18003b0c9
cmp dword [rbp + 0x68], 0
jne 0x18003b0c9
mov eax, dword [rbp + 0x6c]
lea r8, [rsp + 0x20]
mov edx, 0x102
mov dword [rsp + 0x98], eax
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x20], rbp
call fcn.1800621a0
mov rcx, qword [r14]
mov rdx, qword [rsp + 0x80]
xor edi, edi
cmp dword [rcx + 0x1a8], edi
jle 0x18003b133
mov dword [rsp + 0x20], 1
mov rbx, rdx
mov qword [rsp + 0x38], rbp
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx]
lea r8, [rsp + 0x98]
movzx ecx, r15w
lea rdx, [rsp + 0x20]
mov r9d, 0x13
movzx eax, word [rax]
sar ax, cl
lea rcx, [rsp + 0x38]
cwde
mov dword [rsp + 0x98], eax
call fcn.18002b5d0
mov rcx, qword [r14]
lea rbx, [rbx + 8]
inc edi
cmp edi, dword [rcx + 0x1a8]
jl 0x18003b0f0
mov rcx, qword [rcx + 0x28]
mov rax, qword [rbp + 0x20]
mov rdi, qword [rsp + 0x90]
mov qword [rcx], rax
mov rax, qword [r14]
mov rcx, qword [rax + 0x28]
mov rax, qword [rbp + 0x28]
mov qword [rcx + 8], rax
jmp 0x18003b1eb
mov ecx, dword [rdi]
sub rcx, r13
call fcn.180081e7c
mov rbx, qword [rsp + 0x30]
mov edx, 1
mov r9, qword [0x1800bd648]
mov rcx, rax
mov qword [rbx + 0x10], rax
mov r8d, dword [rdi]
sub r8, r13
call fcn.18007c8f8
mov r13, rax
mov qword [rsp + 0x28], rbx
jmp 0x18003b1eb
mov rdi, qword [rsp + 0x30]
mov r8d, 0x70
mov rdx, rdi
xor ecx, ecx
call fcn.180003320
xor r8d, r8d
lea rcx, [rdi + 4]
mov r13, rax
lea edx, [r8 + 0x15]
call fcn.18003ae20
lea rcx, [rdi + 8]
mov edx, 0xc0
mov rbx, rax
call fcn.18005bb50
mov rdi, qword [rsp + 0x90]
add rax, rbx
add r13, rax
jmp 0x18003b1eb
xor r13d, r13d
lea ecx, [r13 + 0x18]
call fcn.180081e7c
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x80]
lea r8, [0x180000000]
add esi, 0x12
lea ecx, [rsi + 0x1f]
cmp ecx, r12d
jb 0x18003b034
jmp case.0x18003b054.3
mov rax, qword [r14]
mov ecx, dword [rax + 0x148]
test ecx, ecx
je 0x18003b231
mov eax, dword [rbp + 0x68]
test eax, eax
jne 0x18003b22c
mov eax, dword [rbp + 0x6c]
inc eax
and eax, 7
mov dword [rbp + 0x6c], eax
mov eax, ecx
dec eax
mov dword [rbp + 0x68], eax
mov dword [rsp + 0x28], 1
mov rax, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003d940
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebx, dword [rsp + 0xa8]
lea r13d, [rdx + 0xc]
mov r12, rcx
cmp edx, r13d
jae case.0x18003d9b2.17
mov rdi, qword [rsp + 0x20]
lea r15d, [rdx - 0x80]
mov rbp, qword [rsp + 0x20]
xor r10d, r10d
mov r14, qword [rsp + 0x20]
mov esi, dword [rsp + 0xa8]
lea r11d, [r10 + 0x2e]
lea rdx, [0x180000000]
cmp r15d, 0x11
ja case.0x18003d9b2.6
mov ecx, dword [rdx + r15*4 + 0x3db90]
add rcx, rdx
jmp rcx
mov qword [r12], r9
mov qword [r12 + 0x110], r8
jmp case.0x18003d9b2.6
mov rax, qword [rsp + 0x20]
mov rdi, qword [rax + 0x30]
jmp case.0x18003d9b2.6
mov rax, qword [rsp + 0x20]
mov rbp, qword [rax + 0x48]
jmp case.0x18003d9b2.6
movsd xmm0, qword [str.MSGraph.Chart.8]
movzx eax, word [0x1800aec90]
movsd qword [rsp + 0x38], xmm0
mov word [rsp + 0x40], ax
mov word [rsp + 0x42], r10w
jmp case.0x18003d9b2.6
mov rax, qword [r9]
mov qword [rsp + 0x20], rax
jmp case.0x18003d9b2.6
mov dword [rsp + 0x52], 0x38002e
mov word [rsp + 0x56], r10w
jmp case.0x18003d9b2.6
mov r8d, 4
lea rdx, [0x1800aed0e]
lea rcx, [rsp + 0x38]
call fcn.180076a10
mov eax, dword [str.hardLimitOverrideInBytes_I64u]
lea rdx, [0x1800aed8e]
mov dword [rsp + 0x4a], eax
lea rcx, [rsp + 0x38]
movzx eax, word [0x1800aed24]
mov word [rsp + 0x4e], ax
xor eax, eax
mov word [rsp + 0x50], ax
lea r8d, [rax + 1]
call fcn.180076a10
jmp 0x18003db4a
lea r8, [r12 + 0x120]
mov edx, 0x37
xor ecx, ecx
call fcn.180061fd0
jmp 0x18003db4a
mov r14, qword [rsp + 0x20]
mov edx, 1
mov r9, qword [r14 + 0x18]
mov r8, qword [r14 + 0x40]
mov rcx, qword [r14 + 0x30]
call fcn.18007c8f8
cmp rax, qword [r14 + 0x40]
je 0x18003dac5
mov rax, qword [r12]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x2b
mov rcx, qword [r12]
mov rax, qword [rcx]
call qword [rax]
mov rax, qword [r14 + 0x20]
mov r14, qword [rax]
jmp 0x18003db4a
mov rax, qword [r12]
mov r8d, dword [rax + 0x30]
test r8d, r8d
je 0x18003db1d
nop dword [rax + rax]
mov edx, 0x47
mov eax, edx
sub eax, 0x46
je 0x18003db03
cmp eax, 1
jne 0x18003db10
movzx eax, byte [rdi + 1]
movzx esi, byte [rdi]
shl eax, 8
or esi, eax
add rdi, 2
jmp 0x18003db10
movsxd rax, esi
movzx ecx, byte [rax + rbp]
mov byte [r14], cl
inc r14
dec edx
cmp edx, 0x45
ja 0x18003dae5
add r8d, 0xffffffff
jne 0x18003dae0
mov ebx, 1
jmp 0x18003db5b
xor r8d, r8d
lea r9, [r12 + 0x118]
xor ecx, ecx
lea edx, [r8 + 0x18]
call fcn.180043100
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
call qword [sym.imp.ole32.dll_CLSIDFromProgIDEx]
mov r9, qword [rsp + 0xb8]
mov r11d, 0x2e
xor r10d, r10d
mov r8, qword [rsp + 0xb0]
inc r15d
lea eax, [r15 + 0x80]
cmp eax, r13d
jb 0x18003d996
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180045b20
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
lea r15d, [rcx - 3]
mov r12, r9
mov r14, r8
mov rbx, rdx
mov ebp, ecx
cmp ecx, r15d
jbe 0x180045c86
nop
mov eax, ebp
sub eax, 0x86
je 0x180045c54
sub eax, 1
je 0x180045bdd
cmp eax, 3
jne 0x180045c7b
xor edx, edx
lea r8d, [rax + 0x65]
xor ecx, ecx
call fcn.18004fd60
test al, al
jne 0x180045d0c
mov ebx, 0xc1
xor edi, edi
nop word [rax + rax]
cmp ebx, 0xc1
je 0x180045cf5
cmp ebx, 0x608
je 0x180045ca5
cmp ebx, 0xb4f
jne 0x180045cfa
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x3c], 0x65
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r9d, r9d
mov rdx, r12
xor ecx, ecx
lea r8d, [r9 + 0x50]
call fcn.18003f6b0
jmp 0x180045c8b
mov rcx, qword [r14]
mov rdx, qword [rbx + 0x10]
add rcx, rcx
cmp rcx, rdx
ja 0x180045c03
mov qword [rbx + 0x10], rcx
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180045bfd
mov rax, qword [rbx]
mov byte [rax + rcx], 0
jmp 0x180045c7b
mov r8, qword [rbx + 0x18]
mov rsi, rcx
mov rax, r8
sub rsi, rdx
sub rax, rdx
cmp rsi, rax
ja 0x180045c3f
mov qword [rbx + 0x10], rcx
mov rax, rbx
cmp r8, 0x10
jb 0x180045c28
mov rax, qword [rbx]
lea rdi, [rax + rdx]
mov r8, rsi
mov rcx, rdi
xor edx, edx
call fcn.1800746e0
mov byte [rdi + rsi], 0
jmp 0x180045c7b
mov r9, rsi
mov byte [rsp + 0x20], 0
mov rdx, rsi
mov rcx, rbx
call fcn.1800691c0
jmp 0x180045c7b
xor edx, edx
mov rcx, rbx
call fcn.180067260
mov rcx, qword [r14]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x30], rcx
mov r8, rax
mov rcx, r12
mov edx, 0x6c
call fcn.180011450
dec ebp
cmp ebp, r15d
ja 0x180045b50
movzx eax, byte [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov r8d, 1
lea rdx, [0x1800ab174]
lea rcx, [rsp + 0x30]
call fcn.180076a10
mov eax, dword [0x1800aef60]
lea rdx, [0x1800aef70]
mov dword [rsp + 0x32], eax
lea rcx, [rsp + 0x30]
mov eax, dword [0x1800aef68]
mov r8d, 1
mov dword [rsp + 0x36], eax
movzx eax, word [0x1800aef6c]
mov word [rsp + 0x3a], ax
call fcn.180076a10
jmp 0x180045cfa
mov word [rsp + 0x30], di
add ebx, 0x547
cmp ebx, 0xfd5
jbe 0x180045b90
xor edx, edx
mov r8, r12
lea ecx, [rdx + 0x3c]
call fcn.180039340
jmp 0x180045c8b
Function at 0x18004b3a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push r14
push r15
sub rsp, 0x20
lea ebp, [rdx + 5]
mov r14, r9
mov r15, r8
mov ebx, edx
cmp edx, ebp
jae 0x18004b49e
mov qword [rsp + 0x48], rsi
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x50], rdi
mov rdi, qword [rsp + 0x40]
nop word [rax + rax]
mov eax, ebx
sub eax, 0x32
je 0x18004b487
sub eax, 1
je 0x18004b46f
sub eax, 4
je 0x18004b445
sub eax, 5
je 0x18004b418
cmp eax, 1
jne 0x18004b48a
mov r9, qword [rdi + 0x18]
mov edx, eax
mov r8, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x30]
call fcn.18007be3c
jmp 0x18004b48a
mov rdi, qword [r14]
mov rax, qword [rdi + 0x20]
mov r8d, dword [rdi + 0x48]
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rax]
test r8d, r8d
je 0x18004b48a
nop
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
add r8d, 0xffffffff
jne 0x18004b430
jmp 0x18004b48a
mov rdx, qword [0x1800bd698]
cmp rdx, qword [0x1800bd6a0]
je 0x18004b465
mov rax, qword [r15]
mov qword [rdx], rax
add qword [0x1800bd698], 8
jmp 0x18004b48a
mov r8, r15
call fcn.180068380
jmp 0x18004b48a
mov r9, qword [rsi + 0x18]
mov edx, 1
mov r8, qword [rsi + 0x40]
mov rcx, qword [rsi + 0x30]
call fcn.18007be3c
jmp 0x18004b48a
mov rsi, qword [r14]
inc ebx
cmp ebx, ebp
jb 0x18004b3e0
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
Function at 0x18004b670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea esi, [rcx - 9]
mov r14, rdx
cmp ecx, esi
jbe case.0x18004b6d4.18
mov rbp, qword [rsp + 0x60]
lea ebx, [rcx - 0xdc]
mov r15, qword [rsp + 0x60]
lea r13, [0x180000000]
mov rdi, qword [rsp + 0x60]
lea rdx, [0x180040440]
xor r12d, r12d
cmp ebx, 0x14
ja case.0x18004b6d4.3
mov ecx, dword [r13 + rbx*4 + 0x4b80c]
add rcx, r13
jmp rcx
mov qword [rsp + 0x60], rbp
jmp case.0x18004b6d4.3
mov rax, qword [r15 + 0x30]
mov qword [r15], rax
mov qword [r15 + 8], 0x1000
jmp case.0x18004b6d4.3
mov rcx, qword [r14]
mov edx, 1
mov r8d, 0xb0
mov rax, qword [rcx + 8]
call qword [rax]
mov rdi, rax
mov rax, qword [r14]
mov qword [rax + 0x228], rdi
jmp 0x18004b7c7
mov rcx, qword [r14]
mov edx, 1
mov rax, qword [rcx + 8]
lea r8d, [rdx + 0x57]
call qword [rax]
mov rcx, qword [r14]
mov rbp, rax
mov qword [rax + 0x30], rcx
lea rax, [0x180032ac0]
mov qword [rbp], rax
lea rax, [0x1800202e0]
mov qword [rbp + 0x10], rax
jmp 0x18004b7c7
mov qword [rdi], rdx
jmp case.0x18004b6d4.3
mov qword [rdi + 0x70], r12
mov qword [rdi + 0x90], r12
mov qword [rdi + 0x78], r12
mov qword [rdi + 0x98], r12
mov qword [rdi + 0x80], r12
mov qword [rdi + 0xa0], r12
mov qword [rdi + 0x88], r12
mov qword [rdi + 0xa8], r12
mov qword [rdi + 0x60], r12
jmp case.0x18004b6d4.3
mov rax, qword [r14]
mov edx, 1
mov r8d, 0x1000
mov r15, qword [rax + 0x28]
mov r9, qword [r15 + 0x28]
mov rcx, qword [r15 + 0x30]
call fcn.18007be3c
cmp rax, 0x1000
je 0x18004b7c7
mov rax, qword [r14]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x25
mov rcx, qword [r14]
mov rax, qword [rcx]
call qword [rax]
lea rdx, [0x180040440]
dec ebx
lea eax, [rbx + 0xdc]
cmp eax, esi
ja 0x18004b6c0
jmp case.0x18004b6d4.18
mov dword [rsp + 0x60], 1
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18004d570
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea ebp, [rcx + 6]
mov r15, rdx
mov edi, ecx
cmp ecx, ebp
jae 0x18004d752
mov rbx, qword [rsp + 0x80]
lea esi, [rcx - 0x23]
mov r12, qword [rsp + 0x80]
lea r8, [0x180000000]
mov r14, qword [rsp + 0x80]
lea r13, [0x1800363e0]
lea rdx, [0x1800439f0]
cmp esi, 7
ja case.0x18004d5d8.4
mov ecx, dword [r8 + rsi*4 + 0x4d774]
add rcx, r8
jmp rcx
mov eax, 0x11e
nop
cmp eax, 0x11e
je 0x18004d5f6
cmp eax, 0x1cf
jne 0x18004d5fd
mov rax, rbx
jmp 0x18004d75a
mov qword [rbx], r13
mov qword [rbx + 0x10], rdx
add eax, 0xb1
cmp eax, 0x280
jb 0x18004d5e0
mov rcx, qword [r15]
mov edx, 1
mov rax, qword [rcx + 8]
lea r8d, [rdx + 0x4f]
call qword [rax]
mov rbx, rax
jmp 0x18004d738
xor r12d, r12d
mov byte [rsp + 0x70], r12b
xor r14d, r14d
jmp case.0x18004d5d8.4
cmp byte [r14 + 1], 7
jne 0x18004d66a
mov eax, dword [r15 + 4]
lea r8, [rsp + 0x80]
sub eax, r12d
mov r9d, 0x1f
mov rdx, r14
mov dword [rsp + 0x80], eax
mov rcx, r15
call fcn.18003afe0
mov qword [r14 + 8], rax
jmp 0x18004d738
mov ecx, dword [r15 + 4]
sub rcx, r12
call fcn.180081e7c
mov r9, qword [0x1800bd648]
mov edx, 1
mov qword [r14 + 8], rax
mov rcx, rax
mov r8d, dword [r15 + 4]
sub r8, r12
call fcn.18007c8f8
mov r12, rax
jmp 0x18004d738
mov ecx, 0x10
call fcn.180081e7c
mov r8d, 0x70
lea rdx, [rsp + 0x70]
xor ecx, ecx
mov r14, rax
call fcn.180003320
movzx ecx, byte [rsp + 0x70]
lea r8, [rsp + 0x80]
mov byte [rsp + 0x80], cl
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x88], 4
mov r9d, 0x35
mov byte [rsp + 0x20], 4
mov r12, rax
call fcn.180048010
mov byte [r14], al
lea r8, [rsp + 0x80]
movzx eax, byte [rsp + 0x70]
lea rdx, [rsp + 0x88]
mov r9d, 0x35
mov byte [rsp + 0x80], al
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x88], 4
mov byte [rsp + 0x20], 0
call fcn.180048010
mov byte [r14 + 1], al
lea r8, [0x180000000]
lea rdx, [0x1800439f0]
inc edi
inc esi
cmp edi, ebp
jb 0x18004d5c4
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, r14
jmp 0x18004d75a
Function at 0x180054bd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r14d, [r8 + 9]
mov r13, rdx
mov r12, rcx
cmp r8d, r14d
jae case.0x180054c34.10
mov r15, qword [rsp + 0x88]
lea ebp, [r8 - 0x110]
mov rsi, qword [rsp + 0x88]
lea rdx, [0x180000000]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x88]
cmp ebp, 0x12
ja case.0x180054c34.6
mov ecx, dword [rdx + rbp*4 + 0x54d70]
add rcx, rdx
jmp rcx
mov rsi, qword [r15 + 0x48]
jmp case.0x180054c34.6
mov eax, dword [0x1800bd660]
test eax, eax
je 0x180054cb3
cmp eax, dword [r12]
je 0x180054cb3
mov ecx, 2
call fcn.18007711c
mov r8, qword [0x1800bd5f8]
lea rdx, str.Grouper_for_AB_Uncore_counting_data_exists_already_
mov rcx, rax
call fcn.1800010e0
xor r9d, r9d
mov dword [rsp + 0x20], 0xa1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.18005c390
lea rdx, [0x180000000]
inc ebp
lea eax, [rbp + 0x110]
cmp eax, r14d
jb 0x180054c25
mov eax, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [r12]
mov dword [0x1800bd660], eax
jmp case.0x180054c34.6
mov rax, qword [r15 + 0x20]
mov rbx, qword [r15 + 0x30]
mov rdi, qword [rax]
jmp case.0x180054c34.6
cmp qword [r12], 0xffffffffffffffff
setne byte [rsp + 0x80]
jmp case.0x180054c34.6
mov rax, qword [r12]
mov edx, dword [rax + 0x30]
test edx, edx
je 0x180054c83
nop word [rax + rax]
movzx eax, byte [rbx]
movzx ecx, byte [rax + rsi]
mov byte [rdi], cl
movzx eax, byte [rbx + 1]
movzx ecx, byte [rax + rsi]
mov byte [rdi + 1], cl
movzx eax, byte [rbx + 2]
add rbx, 3
movzx ecx, byte [rax + rsi]
mov byte [rdi + 2], cl
add rdi, 3
add edx, 0xffffffff
jne 0x180054cf0
jmp 0x180054c83
mov r9, qword [r15 + 0x18]
mov edx, 1
mov r8, qword [r15 + 0x40]
mov rcx, qword [r15 + 0x30]
call fcn.18007c8f8
cmp rax, qword [r15 + 0x40]
je 0x180054c83
mov rax, qword [r12]
mov rcx, qword [rax]
mov dword [rcx + 0x28], 0x2b
mov rcx, qword [r12]
mov rax, qword [rcx]
call qword [rax]
jmp 0x180054c83
mov r15, qword [r13]
jmp case.0x180054c34.6
mov eax, 1
jmp 0x180054c9e
Function at 0x180059100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea eax, [rdx + 0x2a]
mov r14, r8
mov dword [rsp + 0xa8], eax
mov r12, r9
mov ebx, dword [rsp + 0xa8]
mov r8, rcx
cmp edx, eax
jae case.0x18005917d.4
mov r15, qword [rsp + 0xc0]
lea r13d, [rdx - 0x100]
mov rdi, qword [rsp + 0x50]
lea rdx, [0x180000000]
mov ecx, eax
nop dword [rax + rax]
cmp r13d, 0x2b
ja case.default.0x18005917d
movzx eax, byte [rdx + r13 + 0x5938c]
mov ecx, dword [rdx + rax*4 + 0x59370]
add rcx, rdx
jmp rcx
mov rcx, qword [r12]
lea rdx, [rsp + 0x50]
mov esi, dword [r8 + 0x1c]
mov r9d, 0x105
shl esi, 3
lea r8, [rsp + 0x38]
lea eax, [rsi + rsi]
mov dword [rsp + 0x38], eax
mov eax, dword [rcx + 0x30]
mov dword [rsp + 0x40], eax
mov eax, dword [rcx + 0x174]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov rax, qword [r15]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.180037860
mov r8, qword [rsp + 0xa0]
xor ebp, ebp
cmp dword [r8 + 0xc], ebp
jle 0x180059331
xor r11d, r11d
nop word [rax + rax]
mov r10d, 0x73
mov eax, r10d
sub eax, 0x73
je 0x180059243
cmp eax, 1
jne 0x18005924a
mov rax, qword [r15]
xor r8d, r8d
mov rax, qword [r11 + rax]
test esi, esi
je 0x18005924a
mov r9d, esi
nop dword [rax]
nop dword [rax + rax]
movsx ecx, byte [rax + 1]
movsx edx, byte [rax]
lea rax, [rax + 2]
add ecx, r8d
xor r8d, 1
add edx, ecx
sar edx, 1
mov byte [rdi], dl
inc rdi
sub r9, 1
jne 0x180059220
jmp 0x18005924a
mov rax, qword [r14]
mov rdi, qword [r11 + rax]
inc r10d
cmp r10d, 0x75
jb 0x1800591f6
mov r8, qword [rsp + 0xa0]
inc ebp
add r11, 8
cmp ebp, dword [r8 + 0xc]
jl 0x1800591f0
jmp 0x180059331
mov rax, qword [r12]
mov ecx, dword [rsp + 0xa8]
cmp dword [rax + 0x254], 0
jne case.default.0x18005917d
mov rax, qword [rsp + 0x48]
mov dword [rax + 0x10], 0
jmp case.default.0x18005917d
mov ebx, 1
jmp case.0x18005917d.6
mov rdx, qword [r12]
xor ecx, ecx
cmp dword [rdx + 0x1e8], ecx
jle 0x1800592d8
mov rax, qword [rsp + 0x48]
add rax, 0x20
nop word [rax + rax]
mov dword [rax], 0
lea rax, [rax + 4]
mov rdx, qword [r12]
inc ecx
cmp ecx, dword [rdx + 0x1e8]
jl 0x1800592c0
mov rcx, qword [rsp + 0x48]
mov eax, dword [rdx + 0x1a0]
mov dword [rcx + 0x30], eax
jmp 0x180059331
mov rax, qword [r12]
mov r8, qword [rax + 0x288]
mov rcx, qword [rax + 0x280]
mov qword [rsp + 0x48], r8
mov eax, dword [r8 + 0x1c]
cdq
and edx, 7
add eax, edx
sar eax, 3
add dword [rcx + 0x24], eax
mov dword [r8 + 0x1c], 0
mov rcx, qword [r12]
mov rax, qword [rcx + 0x280]
call qword [rax + 0x10]
test eax, eax
je 0x18005936c
mov r8, qword [rsp + 0xa0]
lea rdx, [0x180000000]
mov ecx, dword [rsp + 0xa8]
add r13d, 7
lea eax, [r13 + 0x100]
cmp eax, ecx
jb 0x180059160
mov eax, ebx
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor eax, eax
jmp 0x180059354