joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800236f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x180023723
mov r8d, 0x502
lea rdx, str.D:ClientesRoyalMenuSemIsolado1111111111imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xc8]
movss xmm0, dword [rdi]
subss xmm0, dword [rbx + 0x10]
movss xmm1, dword [rdi + 4]
subss xmm1, dword [rbx + 0x14]
cvttss2si r8d, xmm0
movss xmm0, dword [rdi + 8]
subss xmm0, dword [rbx + 0x10]
cvttss2si r9d, xmm1
movss xmm1, dword [rdi + 0xc]
lea rdi, [0x18010d2d0]
subss xmm1, dword [rbx + 0x14]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, r8b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
cvttss2si r10d, xmm0
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
cvttss2si r11d, xmm1
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r10b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
xor ebx, dword [rdi + rdx*4]
shr eax, 0x10
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r11b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r11d
shr eax, 8
movzx edx, al
mov eax, r11d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x1802ef300]
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r11d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
not ebx
cmp dword [rax + 0x1a60], ebx
jne 0x1800238c4
mov dword [rax + 0x1a64], ebx
cmp dword [rax + 0x1a9c], ebx
jne 0x1800238d3
mov byte [rax + 0x1aa0], 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800238e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc0], 0
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jg 0x18002391b
mov r8d, 0x502
lea rdx, str.D:ClientesRoyalMenuSemIsolado1111111111imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, dword [rbx + 0xc0]
xor ecx, ecx
mov r8, qword [rbx + 0xc8]
mov rdx, rdi
sub rdx, rsi
test rdi, rdi
mov r8d, dword [r8 + rax*4 - 4]
cmove rdx, rcx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180024fd0

Function at 0x180024b10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180024b33
test rdx, rdx
jne 0x180024b4d
mov r8d, 0x599
lea rdx, str.D:ClientesRoyalMenuSemIsolado1111111111imguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test r14, r14
je 0x180024b59
mov qword [r14], 0
mov rdx, rbx
mov rcx, rdi
call fcn.180024ca0
mov rbx, rax
test rax, rax
jne 0x180024b7a
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180024c7d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180024c7d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180024c7d
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180024c7d
cmp rdi, 0xffffffffffffffff
je 0x180024c7d
mov rax, qword [0x1802ef300]
test rax, rax
je 0x180024bf6
inc dword [rax + 0x3bc]
mov rdx, qword [0x1802ef310]
lea rcx, [rdi + rbp]
call qword [0x180166040]
mov rsi, rax
test rax, rax
je 0x180024c7d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x180024c55
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1802ef300]
test rax, rax
je 0x180024c43
dec dword [rax + 0x3bc]
mov rdx, qword [0x1802ef310]
mov rcx, rsi
call qword [0x180166048]
jmp 0x180024c86
test ebp, ebp
jle 0x180024c67
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180024c78
mov qword [r14], rdi
mov rax, rsi
jmp 0x180024c88
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x180024fd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18002502d
lea rbx, [0x18010d2d0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180025014
cmp r10, 2
jb 0x180025014
cmp byte [r9], r8b
jne 0x180025014
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180024ff0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18002506f
lea rbx, [0x18010d2d0]
cmp r8b, 0x23
jne 0x180025053
cmp byte [r9], r8b
jne 0x180025053
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180025040
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180026010
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp byte [rcx], 0
mov rbx, rcx
jne 0x18002602b
cmp byte [rcx + 0x2ef4], 0
je 0x180026045
mov r8d, 0xfef
lea rdx, str.D:ClientesRoyalMenuSemIsolado1111111111imguiimgui.cpp
lea rcx, str._g.Initialized___g.SettingsLoaded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
lea r8, [0x18010f339]
mov dword [rsp + 0x2c], eax
lea r11, [0x18010d2d0]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x180026089
cmp byte [r8], r9b
jne 0x180026089
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x180026076
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x180032550]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x180032480]
mov qword [rsp + 0x38], rax
lea rax, [0x1800325d0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x180026199
inc edi
test ecx, ecx
je 0x1800260f5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1800260fa
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x180026199
mov rax, qword [0x1802ef300]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x18002611e
inc dword [rax + 0x3bc]
mov rdx, qword [0x1802ef310]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [0x180166040]
mov rdx, qword [rbx + 0x2f18]
mov rsi, rax
test rdx, rdx
je 0x180026187
movsxd rcx, dword [rbx + 0x2f10]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2f18]
test rcx, rcx
je 0x18002617a
mov rax, qword [0x1802ef300]
test rax, rax
je 0x18002617a
dec dword [rax + 0x3bc]
mov rdx, qword [0x1802ef310]
call qword [0x180166048]
mov qword [rbx + 0x2f18], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180027280
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x1802ef300]
cmp byte [rbx + 0x2f30], 0
je 0x180027365
cmp qword [rbx + 0x2f38], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x2f40]
je 0x18002734d
mov ecx, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test ecx, ecx
jns 0x1800272f2
mov eax, ecx
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.180033020
mov dword [rdi], ebp
mov r8, rsi
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.180032980
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x2f38]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x2f48]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x1802ef308]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.180032980
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x18002c780
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1802ef300]
mov ebp, ecx
mov rsi, qword [rax + 0x1a18]
lea rbx, [rsi + 0xc0]
cmp dword [rbx], 0
jg 0x18002c7ce
mov r8d, 0x502
lea rdx, str.D:ClientesRoyalMenuSemIsolado1111111111imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x18010d2d0]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, bpl
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rsi + 0xc4]
not edi
cmp edx, r8d
jne 0x18002c864
lea ecx, [rdx + 1]
test r8d, r8d
je 0x18002c850
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18002c855
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180033160
movsxd rcx, dword [rbx]
mov rax, qword [rsi + 0xc8]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18002c940
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1802ef300]
mov rbp, rcx
mov rsi, qword [rax + 0x1a18]
lea rbx, [rsi + 0xc0]
cmp dword [rbx], 0
jg 0x18002c990
mov r8d, 0x502
lea rdx, str.D:ClientesRoyalMenuSemIsolado1111111111imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x18010d2d0]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, bpl
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rsi + 0xc4]
not edi
cmp edx, r8d
jne 0x18002ca72
lea ecx, [rdx + 1]
test r8d, r8d
je 0x18002ca5e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18002ca63
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180033160
movsxd rcx, dword [rbx]
mov rax, qword [rsi + 0xc8]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18002f730
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
sub rsp, 0x28
mov rax, qword [0x1802ef300]
xor ebp, ebp
mov r15, rcx
mov dword [rax + 0x2ef8], ebp
test rcx, rcx
je 0x18002f879
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, qword [0x1802ef300]
mov qword [rsp + 0x50], rdi
lea rbx, [rsi + 0x2f00]
mov dword [rsi + 0x2ef8], ebp
mov ecx, dword [rbx + 4]
test ecx, ecx
jns 0x18002f795
mov eax, ecx
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.180033020
mov dword [rbx], ebp
cmp dword [rbx + 4], ebp
jne 0x18002f7a9
mov edx, 8
mov rcx, rbx
call fcn.180033020
movsxd rcx, dword [rbx]
mov edi, ebp
mov rax, qword [rbx + 8]
mov byte [rcx + rax], bpl
inc dword [rbx]
mov eax, dword [rsi + 0x2f10]
test eax, eax
jle 0x18002f814
mov qword [rsp + 0x20], r14
mov r14, rbp
cmp ebp, eax
jl 0x18002f7e8
mov r8d, 0x4f8
lea rdx, str.D:ClientesRoyalMenuSemIsolado1111111111imguiimgui.h
lea rcx, str.i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov r9, qword [rsi + 0x2f18]
mov r8, rbx
add r9, r14
mov rcx, rsi
mov rdx, r9
call qword [r9 + reloc.WLDAP32.dll_Ordinal_32]
mov eax, dword [rsi + 0x2f10]
inc edi
add r14, 0x30
cmp edi, eax
jl 0x18002f7e8
mov r14, qword [rsp + 0x20]
mov eax, dword [rbx]
lea rdi, [0x1802ef308]
test eax, eax
lea rdx, [0x1801112a0]
lea ecx, [rax - 1]
mov rax, qword [rsi + 0x2f08]
cmove ecx, ebp
test rax, rax
movsxd rbp, ecx
mov rcx, r15
cmovne rdi, rax
call fcn.180024ca0
mov rsi, qword [rsp + 0x48]
mov rbx, rax
test rax, rax
je 0x18002f86f
mov r9, rax
mov r8, rbp
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop r15
pop rbp
ret
Function at 0x180036660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x1800367f1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x1800366d0
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.18003a490
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.180033bc0
mov dword [rbx + 0x80], 0
jmp 0x1800367dd
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.18003aa10
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180060b70
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x180060c3c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x180060c3c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x180060c55
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x180060c2c
cmp byte [rax], 0x5c
jne 0x180060c26
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x180060c26
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x180060c12
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x180060c23
test r8b, 0x10
jne 0x180060c26
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x180060c26
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.180062000
test edi, edi
jne 0x180060b90
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.180061350
int3
Function at 0x180062a10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180062a44
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180062a30
ret

Function at 0x18006b610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rdx]
lea rdi, [rdx + 8]
mov ebp, r8d
mov rsi, rdx
mov rbx, rcx
cmp eax, 0xd
jne 0x18006b672
mov rax, qword [rcx]
movsxd r10, dword [rdi]
mov r9, qword [rax + 0x38]
mov edx, dword [r9 + r10*4]
mov eax, edx
and eax, 0x3f
cmp al, 0x1c
jne 0x18006b677
dec dword [rcx + 0x20]
and edx, 0xffc7ffff
or edx, 0x460000
xor eax, eax
shr edx, 0x11
mov ecx, 0x4000
test r8d, r8d
cmove eax, ecx
or edx, eax
jmp 0x18006b6d1
cmp eax, 8
je 0x18006b6ae
mov rdx, qword [rbx]
movzx ecx, byte [rcx + 0x3c]
inc ecx
movzx eax, byte [rdx + 0xc]
cmp ecx, eax
jbe 0x18006b693
cmp ecx, 0xff
jae 0x18006b6f5
mov byte [rdx + 0xc], cl
inc byte [rbx + 0x3c]
mov rdx, rsi
movzx r8d, byte [rbx + 0x3c]
mov rcx, rbx
dec r8d
call fcn.18006b210
cmp dword [rsi], 8
jne 0x18006b6c1
mov edx, dword [rdi]
bt edx, 8
jb 0x18006b6c1
movzx eax, byte [rbx + 0x3a]
cmp edx, eax
jl 0x18006b6c1
dec byte [rbx + 0x3c]
mov edx, dword [rdi]
shl edx, 9
or edx, ebp
shl edx, 0xe
or edx, 0x3fe4
mov rcx, rbx
call fcn.18006b750
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18006c1e0
mov rcx, qword [rbx + 0x10]
lea rdx, str.function_or_expression_needs_too_many_registers
call fcn.1800763f0
int3

Function at 0x1800752d0
Capabilities:
Read file on windows

Disassembly:
push rbx
mov eax, 0x2050
call fcn.180107320
sub rsp, rax
mov rax, qword [0x1802ee528]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
lea rdx, [rsp + 0x20]
call fcn.180066d40
nop
mov edx, 0x2000
lea rcx, [rsp + 0x20]
call fcn.180067c40
mov r9, rbx
mov edx, 1
mov r8d, 0x2000
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
cmp rax, 0x2000
je 0x180075300
lea rcx, [rsp + 0x20]
call fcn.180067d10
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.180106c20
add rsp, 0x2050
pop rbx
ret

Function at 0x180075360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x2050
call fcn.180107320
sub rsp, rax
mov rax, qword [0x1802ee528]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [rsp + 0x20]
call fcn.180066d40
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180067c40
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.180067d10
xor eax, eax
test rbx, rbx
setne al
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.180106c20
mov rbx, qword [rsp + 0x2078]
add rsp, 0x2050
pop rdi
ret
Function at 0x18007c2f0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x140
mov rax, qword [0x1802ee528]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbp, qword [rsp + 0x190]
mov rdi, rcx
mov rcx, r8
mov rbx, r9
mov r14, rdx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
jne 0x18007c343
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
je 0x18007c3c1
lea r8, str.LUA_NOENV
mov edx, 0xfff0b9d8
mov rcx, rdi
call fcn.180063b40
mov edx, 0xffffffff
mov rcx, rdi
call fcn.180065c90
mov edx, 0xfffffffe
mov rcx, rdi
mov ebx, eax
call fcn.180065980
test ebx, ebx
jne 0x18007c3c1
lea r9, [0x18011c5dc]
mov rdx, rsi
lea r8, [0x18011c5e0]
mov rcx, rdi
call fcn.1800674f0
mov r9, rbp
lea r8, reloc.WS2_32.dll_accept
mov rdx, rax
mov rcx, rdi
call fcn.1800674f0
lea edx, [rbx - 2]
mov rcx, rdi
lea r8d, [rbx - 1]
call fcn.180065560
lea edx, [rbx - 2]
mov rcx, rdi
call fcn.180065980
jmp 0x18007c3cc
mov rdx, rbp
mov rcx, rdi
call fcn.180064c60
mov r8d, 0x105
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x18007c447
cmp eax, 0x105
je 0x18007c447
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x18007c447
xor r8d, r8d
mov byte [rax], 0
mov rcx, rdi
lea edx, [r8 - 1]
call fcn.180065df0
mov rdx, rax
lea r9, [rsp + 0x20]
lea r8, reloc.WLDAP32.dll_Ordinal_33
mov rcx, rdi
call fcn.1800674f0
mov edx, 0xfffffffe
mov rcx, rdi
lea r8d, [rdx + 1]
call fcn.180065560
mov edx, 0xfffffffe
mov rcx, rdi
call fcn.180065980
jmp 0x18007c456
lea rdx, str.unable_to_get_ModuleFileName
mov rcx, rdi
call fcn.1800671f0
mov r8, r14
mov edx, 0xfffffffe
mov rcx, rdi
call fcn.1800656c0
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180106c20
add rsp, 0x140
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret