joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001c90
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x18006d080]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r14, r9
mov rbp, r8
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.1800328c0
lea rax, [r15 + 0xc0]
cmp qword [rax + 0x18], 8
jb 0x180001cfd
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 8
jb 0x180001d36
mov rax, qword [rdi]
jmp 0x180001d39
mov rax, rdi
mov word [rax], bx
cmp word [rsp + 0x70], bx
je 0x180001d5a
lea rax, [rsp + 0x70]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180001d50
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.180004d60
mov dword [rsp + 0x30], 1
cmp qword [rdi + 0x18], 8
jb 0x180001d7e
mov rax, qword [rdi]
jmp 0x180001d81
mov rax, rdi
mov r11, rsi
sub r11, rax
nop word [rax + rax]
movzx r10d, word [rax]
movzx edx, word [rax + r11]
sub r10d, edx
jne 0x180001da6
add rax, 2
test edx, edx
jne 0x180001d90
test r10d, r10d
jne 0x180001deb
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, rbp
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.180001ab0
mov rdx, rax
mov rcx, rdi
call fcn.180001930
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x180001deb
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.180004eb0
mov rax, rdi
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.180011830
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180002ef0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x9a0]
sub rsp, 0xaa0
mov rax, qword [0x18006d080]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.1800328c0
cmp qword [rdi + 0x58], 8
lea r8, [rdi + 0x40]
jb 0x180002f3e
mov r8, qword [r8]
lea r9, str.Config
lea rdx, [0x18004e878]
lea rcx, [rsp + 0x40]
call fcn.1800050f0
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180002f6f
lea rcx, [rsp + 0x40]
call fcn.180005640
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.1800328c0
lea r9, str.UseVestige.ini
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rbp + 0x150]
call fcn.1800050f0
xor ebx, ebx
cmp word [rbp + 0x150], bx
jne 0x180002fb2
mov r8d, ebx
jmp 0x180002fca
lea rax, [rbp + 0x150]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x180002fc0
lea rcx, [rdi + 0xc0]
lea rdx, [rbp + 0x150]
call fcn.180004d60
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call fcn.1800328c0
lea r9, str.UseCache.ini
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rbp + 0x360]
call fcn.1800050f0
cmp word [rbp + 0x360], bx
jne 0x18000301e
mov r8, rbx
jmp 0x18000303a
lea rax, [rbp + 0x360]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x180003030
lea rcx, [rdi + 0xe0]
lea rdx, [rbp + 0x360]
call fcn.180004d60
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x208
call fcn.1800328c0
lea rdx, str.WSRT
lea rcx, [rsp + 0x20]
call fcn.180005940
cmp qword [rax + 0x18], 8
jb 0x18000307c
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x18004e8d4]
lea rcx, [rbp + 0x570]
call fcn.1800050f0
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x1800030af
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
inc r8
call fcn.180004eb0
lea rcx, [rbp + 0x570]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800030cc
lea rcx, [rbp + 0x570]
call fcn.180005640
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.1800328c0
lea r9, str.UseCache.ini
lea r8, [rbp + 0x570]
lea rdx, str._s_s
lea rcx, [rbp + 0x780]
call fcn.1800050f0
cmp word [rbp + 0x780], bx
je 0x18000311f
lea rax, [rbp + 0x780]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180003115
lea rcx, [rdi + 0x100]
mov r8, rbx
lea rdx, [rbp + 0x780]
call fcn.180004d60
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.180011830
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180005370
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rbx, r8
mov rcx, r8
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsi]
mov r9d, 1
xor r8d, r8d
mov rdx, rdi
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180005640
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
or r8, 0xffffffffffffffff
mov rbx, rcx
mov rdi, r8
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x180005660
lea eax, [rdi + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.180011880
mov rsi, rax
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x180005690
xor r14d, r14d
movsxd rdi, edi
mov ebx, r14d
lea ebp, [r14 + 1]
test rdi, rdi
js 0x1800056ff
mov qword [rsp + 0x40], r15
mov r15d, 0x5c
nop dword [rax]
cmp word [rsi + rbx*2], r15w
jne 0x1800056ed
mov rcx, rsi
mov word [rsi + rbx*2], r14w
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1800056e8
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1800056f7
mov word [rsi + rbx*2], r15w
inc rbx
cmp rbx, rdi
jle 0x1800056c0
jmp 0x1800056fa
mov ebp, r14d
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.1800116ac
mov rbx, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180005720
Capabilities:
Check if file exists
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x18006d080]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor r9d, r9d
mov rdi, rdx
mov rsi, rcx
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x180005770
test eax, eax
je 0x18000583a
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x180005790
mov eax, dword [0x18004e7d0]
lea rdx, [rsp + 0x20]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax]
cmp word [rdx + 2], 0
lea rdx, [rdx + 2]
jne 0x1800057b0
xor r8d, r8d
nop
movzx ecx, word [rdi + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x1800057c0
lea rcx, [rsp + 0x20]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x1800057e0
mov dword [rcx], eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180005806
lea rcx, [rsp + 0x20]
call fcn.180005640
cmp word [rsp + 0x20], 0
jne 0x180005812
xor ebx, ebx
jmp 0x18000582a
lea rax, [rsp + 0x20]
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180005820
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180004d60
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180011830
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180005cb0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
xor bl, bl
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
movzx ecx, bl
mov edx, 1
test eax, eax
cmovne ecx, edx
movzx eax, cl
add rsp, 0x20
pop rbx
ret
Function at 0x180006640
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x18006d080]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.1800328c0
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
or r14, 0xffffffffffffffff
cmp word [rdi], bx
jne 0x1800066af
mov r8d, ebx
jmp 0x1800066bc
mov r8, r14
inc r8
cmp word [rdi + r8*2], bx
jne 0x1800066b2
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180004d60
nop
lea rcx, [rsp + 0x28]
call fcn.18000d3b0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000681a
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180006810
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rbp - 0x64], 0
jne 0x180006727
mov r8, rbx
jmp 0x18000673b
lea rax, [rbp - 0x64]
mov r8, r14
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180006730
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.180004d60
nop
lea rcx, [rsp + 0x48]
call fcn.18000d3b0
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov r9, qword [rsp + 0x60]
cmp r9, 8
cmovae rdx, rdi
mov r10, qword [rsp + 0x38]
mov r8, r10
mov r11, qword [rsp + 0x58]
cmp r11, r10
cmovb r8, r11
test r8, r8
jmp 0x1800067ba
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x1800067ab
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x1800067ba
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r14d
jmp 0x1800067bf
jne 0x180006795
mov r8d, ebx
test r8d, r8d
jne 0x1800067cb
cmp r11, r10
jb 0x1800067cb
jbe 0x1800067f4
cmp r9, 8
jb 0x1800067e2
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180004eb0
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x180006700
mov ebx, 1
cmp r9, 8
jb 0x180006810
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.180004eb0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x180006837
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.180004eb0
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.180011830
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180006bc0
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
xor r14d, r14d
lea rax, [r11 - 0x18]
mov rbx, r9
mov qword [r11 - 0x18], r14
mov rbp, r8
mov qword [r11 - 0x20], r14
mov rsi, rdx
mov qword [r11 - 0x28], r14
mov rdi, rcx
mov qword [r11 - 0x58], rax
mov r9d, 0xf013f
lea rdx, str.SoftWare
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180006d04
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rdi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180006cf9
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r14
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r14
mov rdx, rsi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x180006ca9
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
jmp 0x180006cfe
or rax, 0xffffffffffffffff
nop dword [rax]
cmp word [rbx + rax*2 + 2], r14w
lea rax, [rax + 1]
jne 0x180006cb0
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180006e00
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
xor ebx, ebx
movsxd rbp, edx
xor r11d, r11d
xor r10d, r10d
mov r14, r9
mov r15, r8
mov rdi, rcx
test edx, edx
jle 0x180006f3c
mov rsi, rcx
lea r12, [0x180050e00]
neg rsi
mov rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x3d
jne 0x180006e56
inc r11d
cmp r11d, 2
jg 0x180006ea9
cmp al, 0x7f
ja 0x180006ea9
movzx eax, al
movzx ecx, byte [rax + r12]
cmp cl, 0x7f
je 0x180006ea9
cmp cl, 0x40
jae 0x180006e71
test r11d, r11d
jne 0x180006ea9
inc rdx
inc ebx
inc r10d
lea rax, [rsi + rdx]
cmp rax, rbp
jl 0x180006e46
test ebx, ebx
je 0x180006f3c
lea eax, [rbx + rbx*2]
lea eax, [rax*2 + 7]
sar eax, 3
cmp dword [r9], eax
jge 0x180006eb3
mov dword [r9], eax
mov eax, 0xfffffff0
jmp 0x180006f3e
mov eax, 0xffffffee
jmp 0x180006f3e
xor r8d, r8d
xor r11d, r11d
mov r9d, 3
mov rax, r15
test r10d, r10d
jle 0x180006f36
nop word [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rcx + r12]
xor ecx, ecx
cmp dl, 0x40
sete cl
and edx, 0x3f
sub r9d, ecx
inc r11d
mov ecx, r8d
mov r8d, edx
shl ecx, 6
or r8d, ecx
cmp r11d, 4
jne 0x180006f2b
xor r11d, r11d
test r9d, r9d
jle 0x180006f0e
mov ecx, r8d
shr ecx, 0x10
mov byte [rax], cl
inc rax
cmp r9d, 1
jle 0x180006f1f
mov ecx, r8d
shr ecx, 8
mov byte [rax], cl
inc rax
cmp r9d, 2
jle 0x180006f2b
mov byte [rax], r8b
inc rax
dec r10d
inc rdi
test r10d, r10d
jg 0x180006ed0
sub eax, r15d
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x180006f60
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov byte [rcx + 0x89], 0
xor eax, eax
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x180006f9f
mov rdx, qword [rdx]
call fcn.180008630
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x18000c3f0
Capabilities:
Check if file exists

Disassembly:
push rdi
mov eax, 0x1270
call fcn.1800117c0
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1290], rbx
mov rax, qword [0x18006d080]
xor rax, rsp
mov qword [rsp + 0x1260], rax
mov rbx, rdx
mov edi, ecx
cmp qword [0x18006fdb8], 0
jne 0x18000c520
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.1800328c0
movups xmm0, xmmword [str.C:LogResLog64.dll]
movaps xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [0x180051678]
movaps xmmword [rsp + 0x60], xmm1
movsd xmm0, qword [0x180051688]
movsd qword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000c509
lea r8, [0x18006fdf8]
cmp qword [0x18006fe10], 8
cmovae r8, qword [0x18006fdf8]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.18000c1b0
nop
mov r8d, 0xc
lea rdx, str.ResLog64.dll
lea rcx, [rsp + 0x30]
call fcn.180004980
lea rcx, [rsp + 0x30]
mov r9, qword [rsp + 0x30]
mov r8, qword [rsp + 0x48]
cmp r8, 8
cmovae rcx, r9
lea rdx, [rsp + 0x50]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x18000c4e0
cmp r8, 8
jb 0x18000c509
inc r8
mov rdx, r9
lea rcx, [rsp + 0x30]
call fcn.180004eb0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x18006fdb8], rax
test rax, rax
je 0x18000c58f
xor r8d, r8d
lea rdx, [0x18004e740]
mov rcx, rbx
call fcn.180004d60
mov r9d, 0x800
lea r8, [rsp + 0x260]
mov edx, edi
mov rcx, qword [0x18006fdb8]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jle 0x18000c58f
cmp word [rsp + 0x260], 0
jne 0x18000c563
xor r8d, r8d
jmp 0x18000c57b
lea rax, [rsp + 0x260]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x18000c570
lea rdx, [rsp + 0x260]
mov rcx, rbx
call fcn.180004d60
mov al, 1
jmp 0x18000c591
xor al, al
mov rcx, qword [rsp + 0x1260]
xor rcx, rsp
call fcn.180011830
mov rbx, qword [rsp + 0x1290]
add rsp, 0x1270
pop rdi
ret
Function at 0x18000c650
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x2070
call fcn.1800117c0
sub rsp, rax
mov rax, qword [0x18006d080]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov rsi, rcx
mov rdi, rdx
xor ecx, ecx
call fcn.180037a60
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.180038798
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rbx]
lea rdx, str.__d__d__d__d__d__d___d_:_s
mov r9d, dword [rbx + 0x10]
mov r8d, dword [rbx + 0x14]
inc r9d
mov qword [rsp + 0x48], rdi
add r8d, 0x76c
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rbx + 8]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], eax
call fcn.18000c140
mov rcx, rsi
xor edi, edi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebp, 1
lea rdx, [0x1800516e8]
test eax, eax
mov rcx, rsi
cmovne edi, ebp
call fcn.1800381ac
mov rbx, rax
test rax, rax
je 0x18000c7a3
test edi, edi
jne 0x18000c734
mov eax, 0xfeff
lea r8d, [rbp + 1]
mov r9, rbx
mov word [rsp + 0x54], ax
mov edx, ebp
lea rcx, [rsp + 0x54]
call fcn.1800383f8
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18000c740
add eax, eax
lea rcx, [rsp + 0x60]
movsxd r8, eax
mov r9, rbx
mov rdx, rbp
call fcn.1800383f8
mov eax, 0xd
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 0xb]
call fcn.1800383f8
mov eax, 0xa
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 8]
call fcn.1800383f8
mov rcx, rbx
call fcn.18003805c
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.180011830
mov rbx, qword [rsp + 0x20a0]
add rsp, 0x2070
pop rdi
pop rsi
pop rbp
ret
Function at 0x180015350
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x180015363
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.1800159c8
lea rdx, [0x18006b738]
lea rcx, [rsp + 0x20]
call fcn.180032128
int3

Function at 0x18001ff58
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x180071010]
xor edx, edx
jmp fcn.180015350

Function at 0x180020948
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x180071010]
jmp fcn.180015350
Function at 0x1400faa64
Capabilities:
Link many functions at runtime

Disassembly:
jmp 0x1402ebbd0
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1404ceb80]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x1404e3788], 0
je 0x1402ebc2b
mov eax, 1
jmp 0x1402ebdab
mov dword [rsp + 0x20], 0
jmp 0x1402ebc3f
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x1402ebc71
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1404e3788], rax
cmp qword [0x1404e3788], 0
je 0x1402ebc6f
jmp 0x1402ebc71
jmp 0x1402ebc35
cmp qword [0x1404e3788], 0
jne 0x1402ebc93
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.1400fc79c
xor eax, eax
jmp 0x1402ebdab
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x1404e3788]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404e3790], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x1404e3788]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404e3798], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x1404e3788]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404e37a0], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x1404e3788]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404e37a8], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x1404e3788]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404e37b0], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x1404e3788]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404e37b8], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x1404e3788]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1404e37c0], rax
cmp qword [0x1404e3790], 0
je 0x1402ebd8c
cmp qword [0x1404e37a0], 0
je 0x1402ebd8c
cmp qword [0x1404e37a8], 0
je 0x1402ebd8c
cmp qword [0x1404e37b0], 0
je 0x1402ebd8c
cmp qword [0x1404e37b8], 0
je 0x1402ebd8c
cmp qword [0x1404e37c0], 0
jne 0x1402ebda6
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.1400fc79c
call fcn.1400fa9ec
xor eax, eax
jmp 0x1402ebdab
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140378c50]
call fcn.1400fdd81
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400fc369
add rsp, 0x70
pop rdi
ret
Function at 0x1400fafaa
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140264340
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x1404ceb80]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x1404fe479]
call fcn.1400fea51
xor edx, edx
mov ecx, 2
call fcn.1400fc2bf
mov qword [rbp + 8], rax
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rbp + 0x30], 0x238
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x1402643bb
xor eax, eax
jmp 0x14026441b
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400fcc8d
test eax, eax
jne 0x1402643d0
xor eax, eax
jmp 0x14026441b
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400fdf93
test eax, eax
je 0x14026440f
mov rcx, qword [rbp + 0x420]
call fcn.1400fb923
mov rdx, rax
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x14026440d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x38]
jmp 0x14026441b
jmp 0x1402643d0
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14034d9d0]
call fcn.1400fdd81
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1400fc369
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret