joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5187a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x518886
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x32c1626c75accee7
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x572076c31f0632c1
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50808090c010b05
mov qword [rsp + 0x18], rdx
movabs rdx, 0x200050808090c01
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x602060b0908010a
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x518820
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x69]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x518852
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x518877
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x69]
cmp rsi, 0xe
jb 0x518802
jmp 0x51886b
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
nop
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456420
mov eax, edi
mov ecx, 0xe
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.005187a0

Function at 0x5195c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x519687
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x515e807281727e74
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x895e697f
movabs rdx, 0x30b080509080a08
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30a01040600030b
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x519628
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 6]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 6]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0xe
jge 0x519657
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x51967a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x51960b
jmp 0x51966e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456420
mov eax, edi
mov ecx, 0xc
call fcn.00456420
nop
call fcn.00454140
jmp fcn.005195c0
Function at 0x519aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x519b9b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x47727fb1b49f804e
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x639daab9af47727f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x738694c092470470
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10090a120e120b04
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x2020a08130b1110
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd0a08050d030202
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x101209050a0d0e01
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x519b39
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x39]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x519b6b
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x519b8e
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x39]
cmp rsi, 0x15
jb 0x519b1f
jmp 0x519b82
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456420
mov eax, edi
mov ecx, 0x15
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.00519aa0

Function at 0x51dac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x51dc5b
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0xacefb5966586b6a9
mov qword [rsp + 0x62], rdx
movabs rdx, 0xfb6f72e6adedacef
mov qword [rsp + 0x68], rdx
movabs rdx, 0x3542e37ad9ccfa3a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x7396bc2091c420b7
mov qword [rsp + 0x78], rdx
movabs rdx, 0xccc708986f747075
mov qword [rsp + 0x80], rdx
movabs rdx, 0x8acc72b0dbda8c20
mov qword [rsp + 0x88], rdx
movabs rdx, 0xac70bf74da535b64
mov qword [rsp + 0x90], rdx
movabs rdx, 0x20230d2c1508282e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1114282920230d2c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x312910012e01182a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1923330725193008
mov qword [rsp + 0x32], rdx
movabs rdx, 0x19301305160a1111
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x2f051b1015240f2f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x900122a0615271c
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x22d290705201c27
mov qword [rsp + 0x52], rdx
movabs rdx, 0x2c22353016041515
mov qword [rsp + 0x5a], rdx
xor eax, eax
jmp 0x51dbf1
movzx r9d, byte [rsp + rsi + 0x62]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7f]
mov byte [rsp + rdi + 0x62], dl
mov byte [rsp + rsi + 0x62], r8b
add rax, 2
cmp rax, 0x44
jge 0x51dc28
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x51dc4e
movzx r8d, byte [rsp + rdi + 0x62]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7f]
nop dword [rax + rax]
cmp rsi, 0x36
jb 0x51dbd7
jmp 0x51dc42
xor eax, eax
lea rbx, [rsp + 0x62]
mov ecx, 0x36
call fcn.00444780
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x36
call fcn.00456420
mov eax, edi
mov ecx, 0x36
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.0051dac0
Function at 0x51dc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ddb8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x7f862d71be9acd4
mov qword [rsp + 0x46], rdx
movabs rdx, 0x26507f862d71be9
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4fb69af6edef6e9
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5fd36ff57453fb2e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x220a78d272720420
mov qword [rsp + 0x60], rdx
movabs rdx, 0x319021403051f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4020603200e0a14
mov qword [rsp + 0x24], rdx
movabs rdx, 0x100b04020603200e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x31f1e2109161f13
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1606011b21180c20
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1b07111f05030606
mov qword [rsp + 0x3e], rdx
xor eax, eax
jmp 0x51dd58
movzx r9d, byte [rsp + rsi + 0x46]
sub r9d, edx
lea edx, [r9 - 0x5e]
mov byte [rsp + rdi + 0x46], dl
lea edx, [r8 - 0x5e]
mov byte [rsp + rsi + 0x46], dl
add rax, 2
cmp rax, 0x2a
jge 0x51dd88
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x51ddab
movzx r8d, byte [rsp + rdi + 0x46]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x22
jb 0x51dd3b
jmp 0x51dd9f
xor eax, eax
lea rbx, [rsp + 0x46]
mov ecx, 0x22
call fcn.00444780
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00456420
mov eax, edi
mov ecx, 0x22
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.0051dc80

Function at 0x51e2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51e3a7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x726892617a76727c
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x9d987772
movabs rdx, 0xa00010503070203
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x808010100000901
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x51e348
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x10
jge 0x51e377
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x51e39a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x51e32b
jmp 0x51e38e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0051e2e0
Function at 0x5314c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53157d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5245376b4e235425
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x3460
movabs rdx, 0x902020105080504
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x4090908
xor eax, eax
jmp 0x531520
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 5]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 5]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x53154d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x531570
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x531503
jmp 0x531564
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456420
mov eax, edi
mov ecx, 0xa
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.005314c0

Function at 0x534060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53414a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x40333535363d3a31
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x3840333535363d3a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x353554444342433c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10010e0a01000a00
mov qword [rsp + 0x19], rdx
movabs rdx, 0x90207090f0f1001
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf0a0006020403
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x5340ed
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x13]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x13]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jge 0x53411a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x53413d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x5340d0
jmp 0x534131
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00534060
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
shr cl, cl
and eax, 0x322d6d08
invalid
nop
sbb byte [rax - 0x38], 0xce
not r15d
test eax, 0xc8c46322
rcr dword [rsp + rcx*4 - 0x15], 0x5b
sub bl, al
invalid
in al, 0x99
invalid
shr eax, cl
scasb al, byte [rdi]
stosd dword [rdi], eax
invalid
ret
retf 0x2ae5
shr byte [rsi], 1
out dx, al
invalid
mov edi, 0xfcb3fa9c
fstp qword [rax]
popfq
invalid
mov dh, 0x10
invalid
Function at 0x18000276c
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x1800027c6
mov r11b, 0x23
lea rbx, [0x180047b10]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x1800027b0
cmp rdx, 2
jb 0x1800027b0
cmp byte [r10], r11b
jne 0x1800027b0
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x18000278e
jmp 0x180002807
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180002807
mov r11b, 0x23
lea rbx, [0x180047b10]
cmp dl, r11b
jne 0x1800027eb
cmp byte [r10], r11b
jne 0x1800027eb
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x1800027d9
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x1800056f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
mov r9, rcx
mov rax, qword [rcx + 0xf8]
mov r10d, 8
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x38]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x180047b10]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x18000571d
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x1228], ebx
jne 0x180005758
mov r8, rdx
mov ecx, ebx
lea edx, [r10 + 0xc]
call fcn.180016124
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180005760
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
mov r11d, 4
mov rax, qword [rcx + 0xf8]
mov r9, rcx
mov r10d, r11d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x38]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x180047b10]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x18000578f
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x1228], ebx
jne 0x1800057c9
movsxd r8, edx
mov ecx, ebx
mov edx, r11d
call fcn.180016124
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800057d4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm2, dword [rcx + 0x110]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x114]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xf8]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xf0]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x180047b10]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x180005842
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x18003dde4
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x150
mov rbx, rcx
lea rcx, [0x180053730]
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18003de0d
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x18005377c], 0x7fffffff
jne 0x18003de2f
mov dword [0x18005377c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp qword [0x180053298], 0xffffffffffffffff
jne 0x18003dea2
lea rdx, str.BetterConsoleLog.txt
lea rcx, [rsp + 0x40]
call fcn.18003dd9c
mov rcx, rax
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x180053298], rax
cmp rax, 0xffffffffffffffff
jne 0x18003dea2
xor r9d, r9d
lea r8, str.ASSERTION_FAILURE
lea rdx, str.Could_not_write_to_BetterConsoleLog.txt
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov r8, rax
and qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rbx
mov rcx, qword [0x180053298]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180053298]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea rcx, [0x180053730]
add rsp, 0x150
pop rbx
jmp qword [sym.imp.MSVCP140.dll__Mtx_unlock]
jle 0x180098c91
outsd dx, dword [rsi]
mov ebp, 0xbeac7cd4
add cl, byte [rsi + 0x25]
xor al, byte [rax]
add byte [rax + 0x4ebb8a3f], al
mov ebp, 0xbea09ae5
movabs al, byte [0x553f800000323e89]
pop rdi
xor byte [rbp - 0x416b5fcf], bh
invalid
mov word [rdi + 0x14], ds
mov ebp, 0xbe888e93
sahf
jge 0x180098c87
mov cl, 0
add byte [rax - 0xa7efbc1], al
mov esp, 0xbe78cfcc
sbb eax, 0x311bd4
add byte [rax - 0x38f3abc1], al
mov esp, 0xbe605c13
mul ah
cmpsd dword [rsi], dword [rdi]
mov cl, 0
add byte [rax - 0x6297cfc1], al
mov esp, 0xbe47c5c2
jge 0x180098c20
mov esi, 0x30e5967d
in eax, 0x30
add byte [rax], al
cmp byte [rdi], 0xb
jno 0x180098c50
movabs byte [0xb11167f9be2f10], al
add byte [rax + 0x3155023f], al
mov esp, 0xbe164083
adc al, 0xe6
call 0x100098d60
invalid
Function at 0x18003f370
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, qword [0x1800536c8]
mov rsi, rcx
mov al, byte [rcx]
mov rdx, rcx
mov r8, rdi
movabs r9, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
jmp 0x18003f3ba
inc rdx
movzx eax, al
xor r9, rax
imul r9, rcx
mov al, byte [rdx]
test al, al
jne 0x18003f3ab
test rdi, rdi
je 0x18003f3df
mov al, byte [rdi]
xor r9, 0x3a
jmp 0x18003f3d7
inc r8
movzx eax, al
xor r9, rax
mov al, byte [r8]
imul r9, rcx
test al, al
jne 0x18003f3cb
mov r8, qword [0x1800537b8]
mov rbx, qword [0x1800537b0]
sub r8, rbx
sar r8, 5
test r8, r8
jle 0x18003f42c
or rbp, 0xffffffffffffffff
mov rdx, r8
shr rdx, 1
mov r11, rdx
shl r11, 5
cmp qword [r11 + rbx], r9
jae 0x18003f422
add rbx, 0x20
mov rax, rbp
add rbx, r11
sub rax, rdx
add r8, rax
jmp 0x18003f427
jbe 0x18003f443
mov r8, rdx
test r8, r8
jg 0x18003f3fd
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
mov rax, rbx
test rdx, rdx
je 0x18003f478
mov r10, rdx
shr r10, 1
mov rcx, r10
shl rcx, 5
cmp qword [rcx + rax], r9
jae 0x18003f470
add rcx, 0x20
add rax, rcx
mov rcx, rbp
sub rcx, r10
add rdx, rcx
jmp 0x18003f473
mov rdx, r10
test rdx, rdx
jg 0x18003f44b
shl r8, 5
lea rcx, [rbx + 0x20]
add rcx, r11
sub r8, rcx
add r8, rbx
sar r8, 5
jmp 0x18003f4b7
mov r10, r8
shr r10, 1
mov rdx, r10
shl rdx, 5
cmp r9, qword [rdx + rcx]
jae 0x18003f4a7
mov r8, r10
jmp 0x18003f4b7
add rdx, 0x20
add rcx, rdx
mov rdx, rbp
sub rdx, r10
add r8, rdx
test r8, r8
jg 0x18003f48f
jmp 0x18003f515
cmp byte [rsi], 0
mov r10, rsi
mov r8, qword [rax + 8]
je 0x18003f4e3
mov r9b, byte [rsi]
mov dl, byte [r8]
inc r8
cmp r9b, dl
jne 0x18003f511
inc r10
mov r9b, byte [r10]
test r9b, r9b
jne 0x18003f4cd
mov dl, byte [r8]
inc r8
cmp dl, 0x3a
jne 0x18003f511
mov r9b, byte [rdi]
mov r10, rdi
jmp 0x18003f507
mov dl, byte [r8]
inc r8
cmp r9b, dl
jne 0x18003f511
inc r10
mov r9b, byte [r10]
test r9b, r9b
jne 0x18003f4f6
cmp byte [r8], r9b
je 0x18003f51f
add rax, 0x20
cmp rax, rcx
jne 0x18003f4be
jmp 0x18003f42c
mov rax, qword [rax + 0x10]
jmp 0x18003f42e
Function at 0x180041f50
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x180094b10]
mov rdx, qword [rbx]
mov cl, byte [rbx + 0x20]
mov rbp, rdx
lea rdi, [rdx - 5]
and cl, 1
je 0x180041f86
mov rbp, rdi
movzx eax, cl
lea r9, [rsp + 0x40]
test cl, cl
mov r8d, 0x40
cmove rdi, rdx
lea r14, [rax*2 + 5]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180041fbc
mov eax, 0xa
jmp 0x180042048
test esi, esi
je 0x180041fde
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180041fff
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180041fff
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180041ff9
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180041fff
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18004256c
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x1800425d0
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800425be
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800425b7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18004258b
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x180053608]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret