joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x180089b10]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov ebx, dword [rsp + 0x40]
lea r11d, [rcx - 8]
mov qword [rsp + 0x48], r8
mov r9, r8
mov dword [rsp + 0x38], ecx
mov r13, rdx
mov dword [rsp + 0x34], r11d
mov r10d, ecx
cmp ecx, r11d
jbe case.0x1800170a9.0
mov r15, qword [rsp + 0x48]
lea r11d, [rcx - 0x10b]
movzx esi, byte [rsp + 0x30]
lea rdx, [0x180000000]
movzx ebp, byte [rsp + 0x30]
movzx r12d, byte [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
movzx r14d, byte [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x3c], r11d
cmp r11d, 0xa
ja case.default.0x1800170a9
mov ecx, dword [rdx + r11*4 + 0x17254]
add rcx, rdx
jmp rcx
xor r15d, r15d
mov r8, r9
cmp qword [r9 + 0x18], 0x10
jb 0x1800170bb
mov r8, qword [r9]
mov eax, dword [r9 + 0x10]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x40], eax
xor r9d, r9d
lea rax, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x27
call fcn.180021160
mov r10d, dword [rsp + 0x38]
mov r11d, dword [rsp + 0x3c]
lea rdx, [0x180000000]
mov r9, qword [rsp + 0x48]
mov eax, dword [rsp + 0x34]
dec r10d
dec r11d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x3c], r11d
cmp r10d, eax
ja 0x180017098
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.18006fee0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0x150], sil
mov byte [rsp + 0x151], bpl
jmp case.0x1800170a9.3
movzx esi, byte [rsp + 0x150]
jmp case.0x1800170a9.3
mov rdx, r13
mov ecx, PathMakeUniqueName
call fcn.180058630
test eax, eax
je 0x1800170e4
mov ecx, 0x69
mov eax, ecx
sub eax, 0x69
je 0x180017184
cmp eax, 1
je case.0x1800170a9.0
jmp 0x180017189
mov ebx, 0xfffffffc
inc ecx
cmp ecx, 0x6b
jb 0x180017176
jmp 0x1800170e4
cmp qword [r13 + 0x18], 0x10
mov r9, r13
jb 0x1800171a3
mov r9, qword [r13]
cmp r15, qword [r13 + 0x10]
jae 0x1800170f5
nop dword [rax]
mov r8d, SHTestTokenMembership
mov eax, r8d
sub eax, 0xf0
je 0x18001720c
sub eax, 1
je 0x1800171f6
sub eax, 1
je 0x1800171e0
cmp eax, 1
jne 0x180017217
movzx eax, r14b
movzx ecx, byte [rax + rdi]
xor byte [r9 + r15], cl
inc r15
jmp 0x180017217
movzx eax, bpl
mov byte [rax + rdi], r12b
movzx eax, sil
movzx r14d, byte [rax + rdi]
add r14b, r12b
jmp 0x180017217
movzx edx, sil
movzx eax, bpl
movzx r12d, byte [rdx + rdi]
movzx ecx, byte [rax + rdi]
mov byte [rdx + rdi], cl
jmp 0x180017217
inc sil
movzx eax, sil
add bpl, byte [rax + rdi]
inc r8d
cmp r8d, 0xf4
jb 0x1800171b6
cmp r15, qword [r13 + 0x10]
jb 0x1800171b0
jmp 0x1800170ee
mov eax, dword [r9]
xor ebx, ebx
mov dword [r13 + 0x98], eax
jmp case.0x1800170a9.3
movzx ebp, byte [rsp + 0x151]
lea rdi, [rsp + 0x50]
jmp case.0x1800170a9.3
Function at 0x180032550
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov ebp, dword [rsp + 0xe8]
mov r12, r9
mov r13, r8
mov rsi, rcx
lea ebx, [rbp + 0xff]
mov dword [rsp + 0x80], ebx
cmp ebp, ebx
jae 0x1800325e1
mov r15, qword [rsp + 0xe0]
mov edi, dword [rsp + 0xe8]
mov r14, qword [rsp + 0x80]
nop dword [rax]
mov eax, ebp
sub eax, 0x94
je 0x18003265e
sub eax, 0x7c
je 0x180032637
sub eax, 0x33
je 0x180032607
sub eax, 0x33
je 0x180032716
cmp eax, 0x33
jne 0x180032729
mov dword [rsp + 0x50], 0
mov rax, qword [rsp + 0x50]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
test edi, edi
je 0x180032729
mov ecx, 0xca
mov eax, ecx
sub eax, 0xca
je 0x180032624
cmp eax, 1
je 0x1800325e1
jmp 0x180032628
mov dword [rsp + 0x50], edi
inc ecx
cmp ecx, 0xcc
jb 0x180032614
jmp 0x180032729
mov r14, qword [rsi + 0x60]
lea rcx, [rsp + 0x78]
mov r8d, 0xbc
mov rdx, rsi
lea rax, [r14 + 1]
mov qword [rsp + 0x78], rax
call fcn.18004e2b0
mov edi, eax
jmp 0x180032729
mov ebx, 0x38
mov eax, ebx
sub eax, 0x38
je 0x180032678
cmp eax, 1
je 0x1800325e1
jmp 0x180032704
mov eax, dword [rdx]
lea r9, [rsp + 0x68]
mov dword [rsp + 0xe8], eax
lea r8, [rsp + 0x70]
mov eax, dword [r13]
lea rdx, [rsp + 0x78]
mov dword [rsp + 0x50], eax
lea rcx, [rsp + 0x50]
mov eax, dword [r12]
mov dword [rsp + 0x68], eax
mov eax, dword [r15]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov dword [rsp + 0x38], ILFree
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x78], 0xffffffff
call fcn.18003dc30
mov rdx, qword [rsp + 0xc8]
mov qword [rsp + 0x50], rax
inc ebx
cmp ebx, 0x3a
jb 0x180032663
mov ebx, dword [rsp + 0x80]
movzx eax, byte [r15]
mov rcx, qword [rsi + 0x50]
mov byte [r14 + rcx], al
inc r14
mov qword [rsi + 0x60], r14
add ebp, 0x33
cmp ebp, ebx
jae 0x1800325e1
mov rdx, qword [rsp + 0xc8]
jmp 0x1800325b0
Function at 0x18004ed20
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea r12d, [rcx + 7]
mov r14, r8
mov rdi, rdx
mov r15d, ecx
cmp ecx, r12d
jae case.0x18004ed6f.4
mov r13, qword [rsp + 0x98]
lea ebp, [rcx - 0x93]
lea rdx, [0x180000000]
nop dword [rax + rax]
cmp ebp, 8
ja case.0x18004ed6f.5
mov ecx, dword [rdx + rbp*4 + 0x4ee90]
add rcx, rdx
jmp rcx
mov qword [rsp + 0x28], 0
lea r8, [0x18001bfa0]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rdi + 0x80], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov r13, rax
lea rdx, [0x180000000]
inc r15d
inc ebp
cmp r15d, r12d
jb 0x18004ed60
mov eax, dword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [0x180089bd8], rdi
jmp case.0x18004ed6f.5
test r13, r13
je 0x18004ee60
mov rax, r13
xchg qword [0x180089be0], rax
jmp case.0x18004ed6f.5
mov esi, 0xffffffe2
movsxd rax, dword [r14]
cmp dword [rdi + rax*4 + 0x28], 0
jle 0x18004eda0
mov ebx, 0xffffffe2
movsxd rax, dword [r14]
cmp dword [rdi + rax*4 + 0x28], 0
jle 0x18004ee45
lea r9, [rsp + 0x98]
mov dword [rsp + 0x98], ebx
mov r8, rdi
mov dword [rsp + 0x38], esi
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x20], 0x63
call fcn.1800290f0
add ebx, 2
cmp ebx, 0x1f
jl 0x18004ee02
add esi, 2
cmp esi, 0x1f
jl 0x18004edf3
jmp 0x18004eda0
mov byte [rsp + 0x80], 1
jmp case.0x18004ed6f.5
mov byte [rsp + 0x80], 0
jmp case.0x18004ed6f.4
mov eax, 0x70
cmp eax, 0x70
je 0x18004ee88
add eax, 0xaa
cmp eax, 0x11a
jb 0x18004ee72
jmp case.0x18004ed6f.4
xor eax, eax
jmp 0x18004edb8
Function at 0x1800015d0
Capabilities:
Execute anti-debugging instructions
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x1d0
mov rax, qword [0x180049010]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov qword [rsp + 0x88], rax
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x90], rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 0
jmp 0x180001652
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x186a0
jge 0x18000167b
xor eax, eax
xor ecx, ecx
cpuid
mov r8, qword [rsp + 0x90]
mov dword [r8], eax
mov dword [r8 + 4], ebx
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], edx
jmp 0x180001648
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x98], rax
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x34], 0
jmp 0x1800016da
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x186a0
jge 0x1800016fa
rdtsc
shl rdx, 0x20
or rax, rdx
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
jmp 0x1800016d0
rdtsc
shl rdx, 0x20
or rax, rdx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x48]
test rax, rax
jl 0x180001734
cvtsi2sd xmm0, rax
jmp 0x18000174d
mov rcx, rax
shr rcx, 1
and rax, 1
or rcx, rax
cvtsi2sd xmm1, rcx
addsd xmm1, xmm1
movaps xmm0, xmm1
mov rax, qword [rsp + 0x40]
test rax, rax
jl 0x18000175e
cvtsi2sd xmm1, rax
jmp 0x180001777
mov rcx, rax
shr rcx, 1
and rax, 1
or rcx, rax
cvtsi2sd xmm2, rcx
addsd xmm2, xmm2
movaps xmm1, xmm2
divsd xmm0, xmm1
movsd qword [rsp + 0x50], xmm0
cvtsd2ss xmm0, qword [rsp + 0x50]
cvtss2sd xmm0, xmm0
movsd qword [rsp + 0x20], xmm0
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
lea rdx, str.Times:__llx__llx__f
lea rcx, [rsp + 0xc0]
call fcn.180001e40
lea rcx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, qword [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
movsd xmm0, qword [rsp + 0x50]
comisd xmm0, xmmword [0x1800412f8]
jb 0x1800017ee
mov dword [rsp + 0x38], 1
jmp 0x1800017f6
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180038a40
add rsp, 0x1d0
pop rbx
ret
Function at 0x180001d20
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x180049010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
lea rcx, str.Agent::init_anti_cheat
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
xor r9d, r9d
lea rdx, [0x1800012c0]
xor r8d, r8d
nop
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rcx, rbx
call fcn.180001820
test al, al
je 0x180001e12
lea rdx, str.VM_detected
lea rcx, [rsp + 0x50]
call fcn.180001e40
movabs rcx, 0x4c6431fdad60d010
lea r8, [rsp + 0x30]
movabs rax, 0x3c1307a8062078f9
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs rax, 0x3c1307a8060e56d7
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x48], rax
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, 2
mov rcx, rbx
call fcn.180001b70
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
nop
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180038a40
add rsp, 0x160
pop rbx
ret
Function at 0x1800053c0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rax, qword [0x180049010]
xor rax, rsp
mov qword [rsp + 0x220], rax
lea rcx, str.Agent::init
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
lea rcx, [0x18004b5e8]
nop
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.user32.dll
mov qword [0x180049cd8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str._Agent::init__Initializing_MH
mov qword [0x180049ce0], rax
lea rcx, [rsp + 0x20]
call fcn.180001e40
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edi, edi
mov esi, 1
mov ebx, edi
xor eax, eax
lock cmpxchg dword [0x180049c88], esi
je 0x180005474
cmp rbx, 0x20
jae 0x18000545d
xor ecx, ecx
jmp 0x18000545f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180049c88], esi
jne 0x180005453
cmp qword [0x180049c90], rdi
jne 0x1800054f8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, edi
mov edx, 9
test rax, rax
mov qword [0x180049c90], rax
xchg dword [0x180049c88], edi
cmove ecx, edx
test ecx, ecx
jne 0x1800054fe
lea rdx, str._Agent::init__Hooking_VP
lea rcx, [rsp + 0x120]
call fcn.180001e40
lea rcx, [rsp + 0x120]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r8, [0x180049ca8]
lea rdx, [0x180007a50]
call fcn.180036ca0
test eax, eax
jne 0x1800054fe
mov rcx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, esi
call fcn.180037190
jmp 0x1800054fe
xchg dword [0x180049c88], edi
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
nop
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.180038a40
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180005fb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180005fe7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x180006008
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18000600a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18000606b
test ecx, ecx
jle 0x180006043
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18000606b
cmp qword [rdi + 0x80], 0
je 0x18000606b
lfence
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180006090
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1800060b2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1800060cb
lfence
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov qword [rsp + 0x20], rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x1800060ec
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800060ee
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x180006123
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, rbx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800061c4
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18000615e
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x1800061a1
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1800061c4
cmp rbx, rax
ja 0x180006170
test rdi, rdi
je 0x1800061c4
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rbx, rdi
sub rbx, rax
sub rbp, rbx
mov rax, rbp
lfence
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1800065e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180049010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000660d
xor eax, eax
jmp 0x180006765
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x180006638
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x180006638
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x180006765
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180006758
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x18000667b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800066a6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000675d
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180006715
sub eax, 1
je 0x180006715
cmp eax, 2
jne 0x180006758
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000675d
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180006746
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180006758
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18000675d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180038a40
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1800069a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180049010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180006a76
cmp byte [rcx + 0x71], 0
je 0x180006a76
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180006a72
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180006a34
sub eax, 1
je 0x180006a38
cmp eax, 2
jne 0x180006a72
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180038a40
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180006a69
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180006a72
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180006a1c
xor al, al
jmp 0x180006a1c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180038a40
add rsp, 0x60
pop rbx
ret

Function at 0x180007160
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180049010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, r8
lea r9, [rsp + 0x20]
mov rdi, rdx
mov r8d, 0x40
mov rdx, rsi
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180038a40
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x180007e90
Capabilities:
Enumerate gui resources
Print debug messages

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x180049010]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp qword [rcx + 0x48], 0
mov rbx, rcx
jne 0x180008077
lea rdx, str._Agent::check_render_state__Enumerating_windows
lea rcx, [rsp + 0x30]
call fcn.180001e40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rdx, [0x180049ca0]
lea rcx, [0x180007d20]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp qword [rbx + 0x48], 0
jne 0x180007ef7
xor al, al
jmp 0x180008079
mov qword [rsp + 0x158], rsi
lea rdx, str._Agent::check_render_state__Initializing_win32
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x160], rdi
call fcn.180001e40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rbx + 0x48]
call fcn.180008870
lea rdx, str._Agent::check_render_state__Initializing_DX
lea rcx, [rsp + 0x30]
call fcn.180001e40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rax, qword [rbx + 0x38]
mov rcx, qword [rbx + 0x378]
mov rdi, qword [0x180049c80]
mov rcx, qword [rcx + rax]
mov rax, qword [rcx + 0x30]
mov ecx, 0x28
mov rsi, qword [rax + 0xf0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, qword [0x180049c80]
xor r11d, r11d
mov r8, rax
test r9, r9
je 0x180007fe6
movsx rdx, word [r9 + 0x60f0]
lea rax, [r9 + 0x60f4]
mov r10d, dword [r9 + 0x3f58]
lea rax, [rax + rdx*8]
cmp dword [rax], r10d
je 0x180007fdb
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r9 + 0x60f0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60f4]
add rax, r9
mov dword [rax], r10d
mov dword [rax + 4], r11d
inc word [rax + 4]
inc dword [r9 + 0x60e8]
test r8, r8
je 0x180008009
mov qword [r8 + 8], r11
mov qword [r8 + 0x10], r11
mov qword [r8 + 0x18], r11
mov dword [r8 + 0x20], 0x1388
mov dword [r8 + 0x24], 0x2710
jmp 0x18000800c
mov r8, r11
or dword [rdi + 0xc], 8
lea rax, str.imgui_impl_dx9
mov qword [rdi + 0x88], rax
mov rcx, rsi
mov qword [rdi + 0x98], r8
mov qword [r8], rsi
mov rax, qword [rsi]
call qword [rax + htons]
lea rdx, str._Agent::check_render_state__Hooking_wndproc
lea rcx, [rsp + 0x30]
call fcn.180001e40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rbx + 0x48]
lea r8, [0x1800074d0]
mov edx, 0xfffffffc
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rdi, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x158]
mov qword [rbx + 0x30], rax
mov al, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180038a40
add rsp, 0x140
pop rbx
ret