joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006cde0
Capabilities:
Hash data with md5

Disassembly:
jmp 0x14006cde0
push rbx
sub rsp, 0x90
mov rax, qword [0x1400893e8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x67452301
xor eax, eax
mov dword [rsp + 0x24], 0xefcdab89
mov rbx, r8
mov qword [rsp + 0x70], rax
mov r8, rdx
mov dword [rsp + 0x78], eax
mov rdx, rcx
mov dword [rsp + 0x28], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0x10325476
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call fcn.14006cff0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14006ce80
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400707e0
add rsp, 0x90
pop rbx
ret

Function at 0x14006d120
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call fcn.14006d490
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14006d120
push rbx
sub rsp, 0x90
mov rax, qword [0x1400893e8]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x67452301
xor eax, eax
mov dword [rsp + 0x24], 0xefcdab89
mov rbx, r8
mov qword [rsp + 0x74], rax
mov r8, rdx
mov dword [rsp + 0x7c], eax
mov rdx, rcx
mov dword [rsp + 0x28], 0x98badcfe
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x2c], 0x10325476
movups xmmword [rsp + 0x34], xmm0
mov dword [rsp + 0x30], 0xc3d2e1f0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x64], xmm0
call fcn.14006d360
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14006d1d0
mov edx, 0x60
lea rcx, [rsp + 0x20]
call fcn.14006d4c0
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400707e0
add rsp, 0x90
pop rbx
ret
Function at 0x140071a10
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x140071a4d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.140070708
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140071b4c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.140070708
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x140071ac0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140017dc0
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x140071b8b
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x140071b8b
call fcn.140064280
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x140071b72
mov rcx, r14
call fcn.140064280
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140012130
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
mov rsi, rdx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov word [rsp + 0x30], 0
movzx eax, byte [rcx]
test al, al
je 0x1400121f6
mov rdi, rcx
mov r15d, 0x28
lea r12, [rsp + 0x30]
lea rbx, [rsp + 0x2a]
lea r14, [rsp + 0x2e]
nop
mov byte [rsp + 0x2e], al
mov byte [rsp + 0x2f], 0
mov r8d, 2
mov rcx, rbx
mov rdx, r14
call fcn.140019ca8
cmp rax, 1
jne 0x140012226
cmp word [r12], 0
mov rcx, r15
mov rax, r12
je 0x1400121d1
mov rdx, r12
mov rcx, r15
nop dword [rax + rax]
lea rax, [rdx + 2]
dec rcx
cmp word [rdx + 2], 0
mov rdx, rax
jne 0x1400121c0
test rcx, rcx
je 0x140012226
movzx ecx, word [rsp + 0x2a]
mov word [rax], cx
mov word [rax + 2], 0
add r12, 2
dec r15
movzx eax, byte [rdi + 1]
inc rdi
test al, al
jne 0x140012180
lea rcx, [rsp + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140014440
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140019c28
int3
Function at 0x140012ae0
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm8
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [0x140040b08]
test rcx, rcx
je 0x140012b4a
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140012b3d
mov rcx, qword [0x140040b08]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x140040b08]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x140043350], 1
jne 0x140012bf7
mov rbx, qword [0x14002e060]
mov qword [rsp + 0x50], rbx
movups xmm6, xmmword [0x14002e050]
movaps xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [0x14002e040]
movaps xmmword [rsp + 0x30], xmm7
movups xmm8, xmmword [0x14002e030]
movaps xmmword [rsp + 0x20], xmm8
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebp, 0x14
lea rdi, [0x140040b20]
mov r14, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, qword [sym.imp.SHELL32.dll_SHFileOperationW]
nop dword [rax + rax]
mov rcx, rdi
call r14
cmp eax, 0xffffffff
je 0x140012bf7
and eax, 0x10
je 0x140012bf7
mov ecx, 0x64
call r15
mov qword [rsp + 0x50], rbx
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
mov rcx, rsi
call r12
dec ebp
jne 0x140012bc0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140014440
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140014280
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x2030
call fcn.1400143e0
sub rsp, rax
mov rsi, rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2028], rax
mov eax, dword [0x140040b10]
test eax, eax
je 0x1400142b5
test eax, eax
jg 0x1400142fd
jmp 0x140014332
lea rdx, [0x140034546]
lea rcx, [rsp + 0x20]
mov r8d, 0x1000
call fcn.1400123e0
test al, al
je 0x1400143ba
lea rcx, [rsp + 0x20]
call fcn.14001993c
movsxd rcx, dword [0x140040b10]
lea rdx, [0x140045b90]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x140040b10], eax
test eax, eax
jle 0x140014332
lea rdi, [0x140045b90]
xor ebx, ebx
nop word cs:[rax + rax]
mov rdx, qword [rdi]
mov rcx, rsi
call fcn.14001a1f0
test eax, eax
je 0x14001439b
inc rbx
movsxd rax, dword [0x140040b10]
add rdi, 8
cmp rbx, rax
jl 0x140014310
mov rcx, rsi
call fcn.14001a228
cmp rax, 2
jne 0x140014349
mov bl, 1
cmp word [rsi + 2], 0x3a
je 0x14001439d
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x140014368
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test bl, bl
je 0x14001439d
cmp dword [0x140040b10], 0x3ff
jg 0x14001439d
mov rcx, rsi
call fcn.14001993c
movsxd rcx, dword [0x140040b10]
lea rdx, [0x140045b90]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x140040b10], eax
mov bl, 1
mov rcx, qword [rsp + 0x2028]
xor rcx, rsp
call fcn.140014440
mov eax, ebx
add rsp, 0x2030
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x140034546]
call fcn.1400137d0
int3

Function at 0x140014bb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140014bfa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140014bfa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140014bfa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140014bfa
cmp dword [rcx + 0x84], 0xe
jbe 0x140014bfa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140014bfc
xor al, al
add rsp, 0x28
ret
Function at 0x14001879c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400188ac
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001891b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001891b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001891b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001891b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001891b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001891b
cmp dword [rcx + 0xf8], 0
je 0x14001891b
mov ecx, ebx
call fcn.140018818
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140018a50
nop
cmp dword [rbp + 0x20], 0
jne 0x14001897c
call fcn.14001f36c
cmp eax, 1
jne 0x14001896c
xor dl, dl
jmp 0x140018976
call fcn.14001f338
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x140018987
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001887c
int3

Function at 0x1400188ac
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400188ac
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001891b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001891b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001891b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001891b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001891b
cmp dword [rcx + 0x84], 0xe
jbe 0x14001891b
cmp dword [rcx + 0xf8], 0
je 0x14001891b
mov ecx, ebx
call fcn.140018818
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140018a50
nop
cmp dword [rbp + 0x20], 0
jne 0x14001897c
call fcn.14001f36c
cmp eax, 1
jne 0x14001896c
xor dl, dl
jmp 0x140018976
call fcn.14001f338
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x140018987
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001887c
int3

Function at 0x14001a6e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001a708
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001a708
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140020568
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400205ef
mov rsi, rbx
cmp word [rax], bp
je 0x1400205ae
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140020598
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140020594
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001d530
mov rdi, rax
test rax, rax
je 0x1400205dc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400292e0
mov rbp, rdi
xor ecx, ecx
call fcn.14001c4f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140025230
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140025246
mov al, 1
jmp 0x1400252b2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140025257
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400252b0
mov ecx, dword [rcx + 0x18]
nop
call fcn.140020a60
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400252b0
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400252b0
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400252b0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400252b2
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x180001130
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180001172
xor al, al
jmp 0x1800011ea
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 0x3c]
mov rax, qword [rsp + 0x50]
add rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x180001199
xor al, al
jmp 0x1800011ea
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xe8]
mov rax, qword [rsp + 0x50]
add rax, rcx
cmp qword [rsp + 0x78], rax
jb 0x1800011e2
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rdx, qword [rsp + 0x50]
add rdx, rax
mov rax, qword [rsp + 0x58]
mov ecx, dword [rax + 0xec]
mov rax, rdx
add rax, rcx
cmp qword [rsp + 0x78], rax
jae 0x1800011e2
mov al, 1
jmp 0x1800011ea
xor al, al
jmp 0x1800011ea
add rsp, 0x68
ret

Function at 0x180001260
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18006d370]
mov qword [rsp + 0x20], rax
jmp 0x180001280
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800012a5
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180001272
add rsp, 0x38
ret

Function at 0x1800012b0
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x18006d388], eax
je 0x1800012cc
mov eax, 0x10dd
jmp 0x1800013e7
mov rax, qword [0x18006d3a0]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180001370
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx edx, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 0x28]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x180001340
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x180001340
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x20]
call fcn.180001460
mov r11, qword [rsp + 0x20]
mov qword [r11 + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.180054344
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x1800012d8
mov qword [0x18006d3a0], 0
call fcn.1800013f0
mov rax, qword [0x18006d398]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800013d0
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.180054344
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x18000138c
mov qword [0x18006d398], 0
mov dword [0x18006d388], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180001b20
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x180001b3d
xor eax, eax
jmp 0x180001bd6
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x180001b78
mov eax, dword [rsp + 0x18]
add eax, 1
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x180001bd1
movsxd rcx, dword [rsp + 0x18]
imul rcx, rcx, 0x60
mov rax, qword [rsp + 0x10]
cmp qword [rax + rcx + 0x48], 0
je 0x180001bcf
movsxd rdx, dword [rsp + 0x18]
imul rdx, rdx, 0x60
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp]
cmp qword [rcx + rdx + 0x48], rax
jb 0x180001bcb
movsxd rdx, dword [rsp + 0x18]
imul rdx, rdx, 0x60
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
cmp qword [rcx + rdx + 0x48], rax
jb 0x180001bcf
xor eax, eax
jmp 0x180001bd6
jmp 0x180001b6d
mov eax, 1
add rsp, 0x28
ret

Function at 0x180001cc0
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x18006d38c], 0
je 0x180001cdd
mov eax, dword [0x18006d38c]
jmp 0x180001da1
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x180001cf1
xor eax, eax
jmp 0x180001da1
mov ecx, 0x10
call fcn.180053f88
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180001d5a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180001d3f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.180054344
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x18006d38c], eax
mov qword [0x18006d390], 0
mov eax, dword [rsp + 0x20]
jmp 0x180001da1
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180001d76
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x180001d1a
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x50]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x18006d398]
mov qword [rcx], rax
mov rax, qword [rsp + 0x28]
mov qword [0x18006d398], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x180008a10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180008ad9
cmp byte [rcx + 0x71], 0
je 0x180008ad9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180008acc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180008a88
sub eax, 1
je 0x180008a8c
cmp eax, 2
jne 0x180008acc
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x180008aba
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180008acc
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x180009d60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, qword [r8 + 0x18]
mov r14, rdx
mov rsi, qword [r8 + 0x10]
mov rdi, r8
mov rdx, rcx
mov r10, r8
cmp r15, 0x10
jb 0x180009d96
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test rsi, rsi
je 0x180009dd4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, rsi
jb 0x180009dc0
mov rcx, qword [rdx + 0x30]
mov rax, qword [rdx + 0x18]
and rcx, r9
mov r12, qword [rdx + 8]
add rcx, rcx
mov qword [rsp + 0x40], rbp
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, r12
je 0x180009e44
mov rbp, qword [rax + rcx*8]
nop dword [rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jb 0x180009e12
mov rdx, qword [rdx]
mov rcx, rdi
cmp r15, 0x10
jb 0x180009e1e
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x180009e2f
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180009e3a
cmp rbx, rbp
je 0x180009e44
mov rbx, qword [rbx + 8]
jmp 0x180009e00
test rbx, rbx
je 0x180009e44
mov qword [r14], rbx
jmp 0x180009e47
mov qword [r14], r12
mov rbp, qword [rsp + 0x40]
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret