joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180025460
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x1801deda8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebp, ecx
movaps xmm6, xmm2
movabs rcx, 0x2553a7eb99aabf55
mov rbx, rdx
call fcn.1800b83e0
xor esi, esi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x20], 0x2f2f120f
mov rcx, qword [rsp + 0x20]
call fcn.1800b8400
lea rcx, [rsp + 0x28]
call fcn.1800b8400
mov qword [rsp + 0x20], rsi
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x20], edi
mov rcx, qword [rsp + 0x20]
call fcn.1800b8400
call fcn.1800b8390
cmp dword [rsp + 0x28], esi
lea rax, str.MP1_
lea r8, str.MP0_
mov r9, rbx
cmovne r8, rax
lea rdx, str._s_s
lea rcx, [rsp + 0x30]
call fcn.1800b3b20
test ebp, ebp
je 0x1800255d6
sub ebp, 1
je 0x180025578
cmp ebp, 1
jne 0x180025634
lea rax, [rsp + 0x30]
nop
inc rdi
cmp byte [rax + rdi], sil
jne 0x180025520
mov ebx, esi
test rdi, rdi
je 0x180025555
mov rax, rsi
movsx ecx, byte [rsp + rax + 0x30]
call fcn.1800c88a8
add eax, ebx
inc esi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
mov eax, esi
cmp rax, rdi
jb 0x180025533
lea eax, [rbx + rbx*8]
mov r8d, 1
mov ecx, eax
movaps xmm1, xmm6
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.180099ae0
jmp 0x180025634
lea rax, [rsp + 0x30]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], sil
jne 0x180025580
mov ebx, esi
test rdi, rdi
je 0x1800255b5
mov rax, rsi
movsx ecx, byte [rsp + rax + 0x30]
call fcn.1800c88a8
add eax, ebx
inc esi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
mov eax, esi
cmp rax, rdi
jb 0x180025593
lea ecx, [rbx + rbx*8]
mov r8d, 1
mov eax, ecx
shr eax, 0xb
xor eax, ecx
cvttss2si edx, xmm6
imul ecx, eax, 0x8001
call fcn.180099a50
jmp 0x180025634
lea rax, [rsp + 0x30]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], sil
jne 0x1800255e0
mov ebx, esi
test rdi, rdi
je 0x180025615
mov rax, rsi
movsx ecx, byte [rsp + rax + 0x30]
call fcn.1800c88a8
add eax, ebx
inc esi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
mov eax, esi
cmp rax, rdi
jb 0x1800255f3
lea ecx, [rbx + rbx*8]
mov r8d, 1
mov eax, ecx
shr eax, 0xb
xor eax, ecx
cvttss2si edx, xmm6
imul ecx, eax, 0x8001
call fcn.180099b70
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800bcd90
mov rbx, qword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x180025660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1801deda8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov ebp, ecx
mov r14, r8
movabs rcx, 0x2553a7eb99aabf55
mov rbx, rdx
call fcn.1800b83e0
xor esi, esi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x20], 0x2f2f120f
mov rcx, qword [rsp + 0x20]
call fcn.1800b8400
lea rcx, [rsp + 0x28]
call fcn.1800b8400
mov qword [rsp + 0x20], rsi
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x20], edi
mov rcx, qword [rsp + 0x20]
call fcn.1800b8400
call fcn.1800b8390
cmp dword [rsp + 0x28], esi
lea rax, str.MP1_
lea r8, str.MP0_
mov r9, rbx
cmovne r8, rax
lea rdx, str._s_s
lea rcx, [rsp + 0x30]
call fcn.1800b3b20
test ebp, ebp
je 0x1800257d7
sub ebp, 1
je 0x18002577d
cmp ebp, 1
jne 0x180025833
lea rax, [rsp + 0x30]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], sil
jne 0x180025720
mov ebx, esi
test rdi, rdi
je 0x180025755
mov rax, rsi
movsx ecx, byte [rsp + rax + 0x30]
call fcn.1800c88a8
add eax, ebx
inc esi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
mov eax, esi
cmp rax, rdi
jb 0x180025733
lea ecx, [rbx + rbx*8]
xorps xmm1, xmm1
mov eax, ecx
mov r8d, 1
shr eax, 0xb
xor eax, ecx
cvtsi2ss xmm1, r14
imul ecx, eax, 0x8001
call fcn.180099ae0
jmp 0x180025833
lea rax, [rsp + 0x30]
inc rdi
cmp byte [rax + rdi], sil
jne 0x180025782
mov ebx, esi
test rdi, rdi
je 0x1800257b7
mov rax, rsi
movsx ecx, byte [rsp + rax + 0x30]
call fcn.1800c88a8
add eax, ebx
inc esi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
mov eax, esi
cmp rax, rdi
jb 0x180025795
lea eax, [rbx + rbx*8]
mov r8d, 1
mov ecx, eax
mov edx, r14d
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.180099a50
jmp 0x180025833
lea rax, [rsp + 0x30]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], sil
jne 0x1800257e0
mov ebx, esi
test rdi, rdi
je 0x180025815
mov rax, rsi
movsx ecx, byte [rsp + rax + 0x30]
call fcn.1800c88a8
add eax, ebx
inc esi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
mov eax, esi
cmp rax, rdi
jb 0x1800257f3
lea eax, [rbx + rbx*8]
mov r8d, 1
mov ecx, eax
mov edx, r14d
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.180099b70
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800bcd90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180032e00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push r15
sub rsp, 0x48
mov qword [rsp + 0x68], rbp
xor edx, edx
mov qword [rsp + 0x70], rsi
mov r15, rcx
mov qword [rsp + 0x40], r14
call fcn.1800b17d0
mov r14, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
call fcn.1800b4f70
mov rbx, qword [rsp + 0x28]
xor esi, esi
mov rbp, qword [rsp + 0x30]
sub rbp, rbx
add rbp, 7
shr rbp, 3
cmp rbx, qword [rsp + 0x30]
cmova rbp, rsi
test rbp, rbp
je 0x180032eba
mov qword [rsp + 0x78], rdi
nop dword [rax]
mov rdi, qword [rbx]
lea r9, [rsp + 0x20]
mov rcx, rdi
mov r8d, 0x40
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, r15
call fcn.180017f30
mov rdx, rax
mov r8, r14
mov rcx, rdi
call fcn.1800bdb90
mov r8d, dword [rsp + 0x20]
xor r9d, r9d
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
inc rsi
lea rbx, [rbx + 8]
cmp rsi, rbp
jne 0x180032e60
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
test rbx, rbx
je 0x180032f1f
mov rax, qword [rsp + 0x38]
movabs rcx, 0x1fffffffffffffff
sub rax, rbx
sar rax, 3
cmp rax, rcx
ja 0x180032f2e
lea rax, [rax*8]
cmp rax, 0x1000
jb 0x180032f17
test bl, 0x1f
jne 0x180032f2e
mov rax, qword [rbx - 8]
cmp rax, rbx
jae 0x180032f2e
sub rbx, rax
sub rbx, 8
cmp rbx, 0x1f
ja 0x180032f2e
mov rbx, rax
mov rcx, rbx
call fcn.180018a40
mov rcx, r15
add rsp, 0x48
pop r15
pop rbx
jmp fcn.1800aa730
call fcn.1800c7f0c
int3
Function at 0x180036b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14d, ecx
movabs r12, 0x6de94b55a39542c6
mov rcx, r12
call fcn.1800b83e0
xor edi, edi
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x58], r14d
mov rcx, qword [rsp + 0x58]
call fcn.1800b8400
call fcn.1800b8390
movabs r13, 0xe9559a12052415be
mov rcx, r13
mov ebx, dword [rax]
call fcn.1800b83e0
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x58], ebx
mov rcx, qword [rsp + 0x58]
call fcn.1800b8400
call fcn.1800b8390
mov esi, edi
lea r15, sym.MZ_B_9V_N_IMY_ToElo0.GX_qAb_rTZsvR__kiB_qQR_Yr_
mov ebx, edi
mov ebp, dword [rax]
nop word [rax + rax]
mov eax, esi
movsx ecx, byte [rax + r15 + 0x12f330]
call fcn.1800c88a8
add eax, ebx
inc esi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp esi, 0x10
jb 0x180036bc0
lea eax, [rbx + rbx*8]
mov edx, eax
shr edx, 0xb
xor edx, eax
imul eax, edx, 0x8001
cmp ebp, eax
je 0x180036c8e
mov rcx, r12
call fcn.1800b83e0
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x58], r14d
mov rcx, qword [rsp + 0x58]
call fcn.1800b8400
call fcn.1800b8390
mov rcx, r13
mov ebx, dword [rax]
call fcn.1800b83e0
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x58], ebx
mov rcx, qword [rsp + 0x58]
call fcn.1800b8400
call fcn.1800b8390
mov ebx, edi
mov esi, dword [rax]
nop word [rax + rax]
mov eax, edi
movsx ecx, byte [rax + r15 + 0x12f348]
call fcn.1800c88a8
add eax, ebx
inc edi
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp edi, 0x10
jb 0x180036c50
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp esi, eax
je 0x180036c8e
mov al, 1
jmp 0x180036c90
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180038fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rbx + rcx], 0
jne 0x180038ff0
xor esi, esi
mov edi, esi
test rbx, rbx
je 0x180039025
mov eax, esi
movsx ecx, byte [rax + rbp]
call fcn.1800c88a8
add eax, edi
inc esi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, esi
cmp rax, rbx
jb 0x180039004
mov rbx, qword [rsp + 0x30]
lea eax, [rdi + rdi*8]
mov rbp, qword [rsp + 0x38]
mov ecx, eax
mov rsi, qword [rsp + 0x40]
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
add rsp, 0x20
pop rdi
ret
Function at 0x180039c70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r12d, ecx
xor r14d, r14d
nop dword [rax]
nop dword [rax + rax]
mov r15, qword [0x1801e2108]
add r15, r14
or rbx, 0xffffffffffffffff
mov rsi, qword [r15]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x180039cb1
xor ebp, ebp
xor edi, edi
test rbx, rbx
je 0x180039ce6
xor eax, eax
movsx ecx, byte [rax + rsi]
call fcn.1800c88a8
add eax, edi
inc ebp
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
mov eax, ebp
cmp rax, rbx
jb 0x180039cc5
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
cmp eax, r12d
je 0x180039d0c
add r14, 0x70
cmp r14, 0x1500
jl 0x180039ca0
xor eax, eax
jmp 0x180039d0f
mov rax, r15
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800a5ce0
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x60
mov rax, qword [0x1801deda8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rdi, rcx
je 0x1800a5e8d
cmp byte [rcx + 0x71], 0
je 0x1800a5e8d
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x1800a5d30
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800bcd90
add rsp, 0x60
pop rdi
ret
xor r8d, r8d
mov qword [rsp + 0x80], rsi
lea rcx, [rsp + 0x38]
lea edx, [r8 + 8]
call fcn.18002c250
mov qword [rsp + 0x78], rbx
mov rcx, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
nop dword [rax + rax]
cmp r9, 0x10
lea rax, [rsp + 0x30]
mov r9, qword [rsp + 0x48]
lea rdx, [rsp + 0x38]
cmovae rdx, rcx
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
cmovae r8, rcx
mov rcx, qword [rdi + 0x68]
add r9, rdx
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
call qword [r10 + 0x40]
test eax, eax
je 0x1800a5db7
sub eax, 1
je 0x1800a5dbb
mov r9, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
sub eax, 2
je 0x1800a5e33
xor bl, bl
jmp 0x1800a5e35
mov byte [rdi + 0x71], 0
mov r9, qword [rsp + 0x50]
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
cmp r9, 0x10
mov rbx, qword [rsp + 0x30]
cmovae rax, rcx
sub rbx, rax
je 0x1800a5e0f
cmp r9, 0x10
lea rax, [rsp + 0x38]
mov r9, qword [rdi + 0x80]
mov r8, rbx
cmovae rax, rcx
mov edx, 1
mov rcx, rax
call fcn.1800d2f64
mov r9, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
cmp rbx, rax
jne 0x1800a5db3
cmp byte [rdi + 0x71], 0
je 0x1800a5e33
test rbx, rbx
jne 0x1800a5d60
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rsp + 0x38]
call fcn.1800163b0
jmp 0x1800a5d4e
mov bl, 1
mov rsi, qword [rsp + 0x80]
cmp r9, 0x10
jb 0x1800a5e72
lea rax, [r9 + 1]
cmp rax, 0x1000
jb 0x1800a5e6d
test cl, 0x1f
jne 0x1800a5ea2
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x1800a5ea2
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x1800a5ea2
mov rcx, rax
call fcn.180018a40
movzx eax, bl
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800bcd90
add rsp, 0x60
pop rdi
ret
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800bcd90
add rsp, 0x60
pop rdi
ret
call fcn.1800c7f0c
int3
Function at 0x1800b8a00
Capabilities:
Hash data using murmur3

Disassembly:
test r8d, r8d
jle 0x1800b8c8e
mov r11, rsp
push r15
sub rsp, 0x150
mov rax, qword [0x1801deda8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov qword [r11 + 0x10], rbx
mov r10, rcx
mov qword [r11 + 0x18], rbp
xor r15d, r15d
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
mov dword [rsp + 4], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
nop dword [rax + rax]
mov eax, r15d
lea r9, [rsp + 0x20]
shl eax, 6
movsxd r11, eax
add r11, rdx
xor r8d, r8d
nop dword [rax]
nop dword [rax + rax]
lea eax, [r8*4]
inc r8d
movsxd rcx, eax
lea r9, [r9 + 4]
movzx eax, byte [r11 + rcx + 1]
movzx edx, byte [rcx + r11]
shl edx, 8
or edx, eax
movzx eax, byte [r11 + rcx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [r11 + rcx + 3]
shl edx, 8
or edx, eax
mov dword [r9 - 4], edx
cmp r8d, 0x10
jl 0x1800b8a80
lea rax, [rsp + 0x58]
mov r11d, 0x30
nop dword [rax]
mov edx, dword [rax]
mov r9d, edx
mov r8d, dword [rax - 0x34]
lea rax, [rax + 4]
mov ecx, edx
rol r9d, 0xf
shr edx, 0xa
rol ecx, 0xd
xor r9d, ecx
mov ecx, r8d
xor r9d, edx
ror ecx, 7
mov edx, r8d
shr r8d, 3
rol edx, 0xe
xor edx, ecx
xor edx, r8d
add r9d, edx
add r9d, dword [rax - 0x3c]
add r9d, dword [rax - 0x18]
mov dword [rax + 4], r9d
sub r11, 1
jne 0x1800b8ad0
mov r11d, dword [r10 + 0x88]
xor ebx, ebx
mov edi, dword [r10 + 0x8c]
mov esi, dword [r10 + 0x90]
mov r13d, dword [r10 + 0x94]
mov r9d, dword [r10 + 0x98]
mov ebp, dword [r10 + 0x9c]
mov r14d, dword [r10 + 0xa0]
mov r12d, dword [r10 + 0xa4]
lea r10, [0x180137880]
nop word [rax + rax]
mov r8d, r9d
mov eax, r9d
rol eax, 7
mov ecx, r9d
ror r8d, 0xb
not ecx
xor r8d, eax
and ecx, r14d
mov eax, r9d
mov edx, r11d
ror eax, 6
xor r8d, eax
ror edx, 0xd
mov eax, ebp
and eax, r9d
xor ecx, eax
mov eax, r11d
add r8d, ecx
rol eax, 0xa
add r8d, dword [rbx + r10]
xor edx, eax
add r8d, dword [rsp + rbx + 0x20]
mov eax, r11d
ror eax, 2
add r8d, r12d
xor edx, eax
mov ecx, edi
xor ecx, esi
mov eax, edi
and eax, esi
and ecx, r11d
xor ecx, eax
mov r12d, r14d
add edx, ecx
mov r14d, ebp
mov ebp, r9d
add rbx, 4
lea r9d, [r8 + r13]
mov r13d, esi
mov esi, edi
mov edi, r11d
lea r11d, [rdx + r8]
cmp rbx, 0x100
jl 0x1800b8b60
mov r10, qword [rsp + 8]
mov eax, r12d
mov rdx, qword [rsp + 0x10]
inc r15d
mov dword [rsp], r12d
add dword [r10 + 0x88], r11d
add dword [r10 + 0x8c], edi
add dword [r10 + 0x90], esi
add dword [r10 + 0x94], r13d
add dword [r10 + 0x98], r9d
add dword [r10 + 0x9c], ebp
add dword [r10 + 0xa0], r14d
add dword [r10 + 0xa4], eax
cmp r15d, dword [rsp + 4]
jl 0x1800b8a60
mov r14, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
mov r12, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800bcd90
add rsp, 0x150
pop r15
ret
Function at 0x1800b8a09
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
test r8d, r8d
jle 0x1800b8c8e
mov r11, rsp
push r15
sub rsp, 0x150
mov rax, qword [0x1801deda8]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov qword [r11 + 0x10], rbx
mov r10, rcx
mov qword [r11 + 0x18], rbp
xor r15d, r15d
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r14
mov dword [rsp + 4], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
nop dword [rax + rax]
mov eax, r15d
lea r9, [rsp + 0x20]
shl eax, 6
movsxd r11, eax
add r11, rdx
xor r8d, r8d
nop dword [rax]
nop dword [rax + rax]
lea eax, [r8*4]
inc r8d
movsxd rcx, eax
lea r9, [r9 + 4]
movzx eax, byte [r11 + rcx + 1]
movzx edx, byte [rcx + r11]
shl edx, 8
or edx, eax
movzx eax, byte [r11 + rcx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [r11 + rcx + 3]
shl edx, 8
or edx, eax
mov dword [r9 - 4], edx
cmp r8d, 0x10
jl 0x1800b8a80
lea rax, [rsp + 0x58]
mov r11d, 0x30
nop dword [rax]
mov edx, dword [rax]
mov r9d, edx
mov r8d, dword [rax - 0x34]
lea rax, [rax + 4]
mov ecx, edx
rol r9d, 0xf
shr edx, 0xa
rol ecx, 0xd
xor r9d, ecx
mov ecx, r8d
xor r9d, edx
ror ecx, 7
mov edx, r8d
shr r8d, 3
rol edx, 0xe
xor edx, ecx
xor edx, r8d
add r9d, edx
add r9d, dword [rax - 0x3c]
add r9d, dword [rax - 0x18]
mov dword [rax + 4], r9d
sub r11, 1
jne 0x1800b8ad0
mov r11d, dword [r10 + 0x88]
xor ebx, ebx
mov edi, dword [r10 + 0x8c]
mov esi, dword [r10 + 0x90]
mov r13d, dword [r10 + 0x94]
mov r9d, dword [r10 + 0x98]
mov ebp, dword [r10 + 0x9c]
mov r14d, dword [r10 + 0xa0]
mov r12d, dword [r10 + 0xa4]
lea r10, [0x180137880]
nop word [rax + rax]
mov r8d, r9d
mov eax, r9d
rol eax, 7
mov ecx, r9d
ror r8d, 0xb
not ecx
xor r8d, eax
and ecx, r14d
mov eax, r9d
mov edx, r11d
ror eax, 6
xor r8d, eax
ror edx, 0xd
mov eax, ebp
and eax, r9d
xor ecx, eax
mov eax, r11d
add r8d, ecx
rol eax, 0xa
add r8d, dword [rbx + r10]
xor edx, eax
add r8d, dword [rsp + rbx + 0x20]
mov eax, r11d
ror eax, 2
add r8d, r12d
xor edx, eax
mov ecx, edi
xor ecx, esi
mov eax, edi
and eax, esi
and ecx, r11d
xor ecx, eax
mov r12d, r14d
add edx, ecx
mov r14d, ebp
mov ebp, r9d
add rbx, 4
lea r9d, [r8 + r13]
mov r13d, esi
mov esi, edi
mov edi, r11d
lea r11d, [rdx + r8]
cmp rbx, 0x100
jl 0x1800b8b60
mov r10, qword [rsp + 8]
mov eax, r12d
mov rdx, qword [rsp + 0x10]
inc r15d
mov dword [rsp], r12d
add dword [r10 + 0x88], r11d
add dword [r10 + 0x8c], edi
add dword [r10 + 0x90], esi
add dword [r10 + 0x94], r13d
add dword [r10 + 0x98], r9d
add dword [r10 + 0x9c], ebp
add dword [r10 + 0xa0], r14d
add dword [r10 + 0xa4], eax
cmp r15d, dword [rsp + 4]
jl 0x1800b8a60
mov r14, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
mov r12, qword [rsp + 0x140]
mov rdi, qword [rsp + 0x148]
mov rsi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800bcd90
add rsp, 0x150
pop r15
ret
Function at 0x1800bf330
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x18013c8f8]
xor ecx, ecx
lea r8, [0x18013c8f0]
lea rdx, str.FlsAlloc
call fcn.1800bf158
mov rbx, rax
test rax, rax
je 0x1800bf370
mov rcx, rax
call fcn.1800bd45c
mov rcx, rdi
call rbx
jmp 0x1800bf376
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800bf3d8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x18013c908]
mov ecx, 2
lea r8, [0x18013c900]
lea rdx, str.FlsGetValue
call fcn.1800bf158
mov rdi, rax
test rax, rax
je 0x1800bf419
mov rcx, rax
call fcn.1800bd45c
mov ecx, ebx
call rdi
jmp 0x1800bf421
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800bf42c
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x18013c910]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x18013c908]
call fcn.1800bf158
mov rsi, rax
test rax, rax
je 0x1800bf478
mov rcx, rax
call fcn.1800bd45c
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1800bf483
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800df908
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1800df7a8
call fcn.1800c89b8
mov dword [rax], 0x16
call fcn.1800c7eec
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1800df790
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1800df790
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1800df7da
lock or dword [rax + 0x14], 0x10
jmp 0x1800df790
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1800df7f7
mov rcx, qword [rbp + 0x10]
call fcn.1800e0898
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800de9b0
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1800e002c
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1800df84e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1800df790
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1800df8ba
mov rcx, qword [rbp + 0x10]
call fcn.1800de9b0
cmp eax, 0xffffffff
je 0x1800df8a1
mov rcx, qword [rbp + 0x10]
call fcn.1800de9b0
cmp eax, 0xfffffffe
je 0x1800df8a1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.1800de9b0
movsxd rdi, eax
lea rsi, [0x1801e7160]
mov rcx, rbx
sar rdi, 6
call fcn.1800de9b0
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1800df8a8
lea rax, [0x1801df210]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1800df8ba
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1800df8f0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1800df8ec
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1800df8ec
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1800df793
jmp 0x1800df760

Function at 0x1800e0840
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800e0860
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800c8948
or eax, 0xffffffff
jmp 0x1800e0862
xor eax, eax
add rsp, 0x28
ret