joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14020b760
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400c0f87
sub rsp, rax
mov rax, qword [0x1402a2040]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1402a6c10]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14020b975
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14020b8b9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14020b8b9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14020b899
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14020b828
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14020b935
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14020b994
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x44], eax
jae 0x14020b970
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14020b994
jmp 0x14020b7fe
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400c28f0
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14020fa00
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov edx, 8
lea rcx, [rsp + 0x60]
call fcn.1400c190f
movzx eax, al
test eax, eax
je 0x14020fa27
mov al, 1
jmp 0x14020fb1c
lea rcx, [rsp + 0x60]
call fcn.1400c58d9
movzx eax, al
test eax, eax
je 0x14020fa66
lea rcx, [rsp + 0x60]
call fcn.1400c4740
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.1400c4740
mov rax, qword [rax + 8]
mov rcx, qword [rsp + 0x40]
cmp qword [rcx], rax
jne 0x14020fa66
xor al, al
jmp 0x14020fb1c
lea rcx, [rsp + 0x60]
call fcn.1400c495c
mov ecx, eax
call fcn.1400c5848
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x14020fa8b
xor al, al
jmp 0x14020fb1c
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov r9d, 1
lea r8, [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14020fad0
xor al, al
jmp 0x14020fb1c
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14020faf9
xor al, al
jmp 0x14020fb1c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jne 0x14020fb0f
mov dword [rsp + 0x20], 1
jmp 0x14020fb17
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x50
pop rdi
ret
Function at 0x14022ed50
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
je 0x14022ed8f
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
test eax, eax
je 0x14022ed8f
lea rdx, [0x1402817c0]
mov rcx, qword [rsp + 0x40]
call fcn.1400c2972
test eax, eax
jne 0x14022edc6
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20001004
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x14022edb5
xor eax, eax
jmp 0x14022ee15
cmp dword [rsp + 0x20], 0
jne 0x14022edc4
call qword [sym.imp.KERNEL32.dll_GetACP]
jmp 0x14022ee15
jmp 0x14022ee11
lea rdx, [0x1402817e0]
mov rcx, qword [rsp + 0x40]
call fcn.1400c2972
test eax, eax
jne 0x14022ee03
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x2000000b
mov rax, qword [rsp + 0x48]
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x14022ee01
xor eax, eax
jmp 0x14022ee15
jmp 0x14022ee11
mov rcx, qword [rsp + 0x40]
call fcn.1400c00d7
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x14022eed0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
movzx eax, word [rsp + 0x50]
and eax, 0x3ff
movzx eax, ax
bts eax, 0xa
movzx eax, ax
mov dword [rsp + 0x24], eax
call fcn.1400c127a
add rax, 0x98
mov qword [rsp + 0x30], rax
mov r9d, 2
lea r8, [rsp + 0x20]
mov edx, 0x20000001
mov ecx, dword [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x14022ef33
xor eax, eax
jmp 0x14022ef73
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x50], eax
je 0x14022ef6e
cmp dword [rsp + 0x58], 0
je 0x14022ef6e
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.14022e4a0
mov dword [rsp + 0x28], eax
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
call fcn.1400c058c
mov ecx, dword [rsp + 0x28]
cmp ecx, eax
jne 0x14022ef6e
xor eax, eax
jmp 0x14022ef73
mov eax, 1
add rsp, 0x48
ret
Function at 0x1800cbe3c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
and dword [rax - 0x38], 0
mov rdi, rcx
mov r8d, dword [0x1805b9dd4]
mov sil, dl
mov dword [rax - 0x30], 0x3f800000
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x1805f0770], eax
jg 0x1800cc001
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs rbp, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x60]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, 8
jb 0x1800cbea6
mov rax, qword [0x1805f0760]
mov rdx, qword [0x1805f0748]
and rax, rcx
mov r9, qword [0x1805f0738]
add rax, rax
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, r9
je 0x1800cbef7
mov r8, qword [rdx + rax*8]
jmp 0x1800cbeef
cmp rcx, r8
je 0x1800cbef7
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x1800cbee6
jmp 0x1800cbef9
xor ecx, ecx
test rcx, rcx
mov rax, r9
cmovne rax, rcx
cmp rax, r9
jne 0x1800cbf7a
and dword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
call fcn.1800cc2ec
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x60]
inc rcx
xor rbx, rax
imul rbx, rbp
cmp rcx, 8
jb 0x1800cbf23
and rbx, qword [0x1805f0760]
mov rdx, qword [0x1805f0748]
add rbx, rbx
mov rax, qword [0x1805f0738]
mov rcx, qword [rdx + rbx*8 + 8]
cmp rcx, rax
je 0x1800cbf71
mov r8, qword [rdx + rbx*8]
jmp 0x1800cbf69
cmp rcx, r8
je 0x1800cbf71
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x1800cbf60
jmp 0x1800cbf73
xor ecx, ecx
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [0x1805ba8a8]
lea rdx, [rax + 0x18]
movss xmm1, dword [0x1800c38c0]
movss xmm0, dword [rdx]
subss xmm1, dword [rcx + 0x18]
mulss xmm1, dword [rsp + 0x80]
test sil, sil
je 0x1800cbfb3
comiss xmm0, dword [0x1800c38c0]
jae 0x1800cbfc4
addss xmm0, xmm1
jmp 0x1800cbfc0
comiss xmm0, dword [0x1800c378c]
jbe 0x1800cbfc4
subss xmm0, xmm1
movss dword [rdx], xmm0
comiss xmm0, dword [0x1800c378c]
mov rbx, qword [rsp + 0x68]
lea rcx, [rsp + 0x20]
mov rbp, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
cmovae rcx, rdx
comiss xmm0, dword [0x1800c38c0]
cmovbe rax, rcx
movss xmm0, dword [rax]
movss dword [rdx], xmm0
add rsp, 0x50
pop rdi
ret
lea rcx, [0x1805f0770]
call fcn.180134c0c
cmp dword [0x1805f0770], 0xffffffff
jne 0x1800cbe8d
mov ecx, 0x20
call fcn.180134b28
xorps xmm0, xmm0
lea rcx, [0x1805f0748]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x1805f0748], 0
mov qword [0x1805f0738], rax
movdqa xmmword [0x1805f0750], xmm0
mov qword [0x1805f0760], 7
mov qword [0x1805f0768], 8
mov dword [0x1805f0730], 0x3f800000
call fcn.1800cc1ac
lea rcx, [0x1801a1d78]
call fcn.180134fdc
lea rcx, [0x1805f0770]
call fcn.180134ba0
jmp 0x1800cbe8d
Function at 0x1800cc2ec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [r8 + rcx]
movabs rdx, 0x100000001b3
xor rbp, rax
inc rcx
imul rbp, rdx
cmp rcx, 8
jb 0x1800cc317
mov rcx, qword [0x1805f0760]
mov rdx, qword [0x1805f0748]
and rcx, rbp
mov rdi, qword [0x1805f0738]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rdi
je 0x1800cc39b
mov r8, qword [rdx + rcx*8]
mov rcx, qword [r14]
jmp 0x1800cc36d
cmp rax, r8
je 0x1800cc398
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800cc364
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rdi, rax
movabs rax, 0x7ffffffffffffff
cmp qword [0x1805f0740], rax
jne 0x1800cc3bc
lea rcx, [0x1800bc7a0]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov ecx, 0x20
call fcn.180134b28
movups xmm0, xmmword [r14]
mov rbx, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov rdx, qword [0x1805f0740]
lea rcx, [rdx + 1]
test rcx, rcx
js 0x1800cc3ec
cvtsi2ss xmm1, rcx
jmp 0x1800cc401
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x1805f0768]
xorps xmm0, xmm0
test rcx, rcx
js 0x1800cc417
cvtsi2ss xmm0, rcx
jmp 0x1800cc42c
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1805f0730]
comiss xmm0, xmm1
jae 0x1800cc48a
call fcn.1800cc4f8
mov rcx, qword [0x1805f0760]
mov rdx, qword [0x1805f0748]
and rcx, rbp
mov rdi, qword [0x1805f0738]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rdi
je 0x1800cc483
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rbx + 0x10]
jmp 0x1800cc47a
cmp rax, r8
je 0x1800cc4cd
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800cc471
mov rdi, qword [rax]
mov rdx, qword [0x1805f0740]
mov r8, qword [rdi + 8]
inc rdx
mov qword [0x1805f0740], rdx
mov qword [rbx], rdi
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rdi + 8], rbx
mov rax, qword [0x1805f0760]
mov rcx, qword [0x1805f0748]
and rax, rbp
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x1805f0738]
jne 0x1800cc4d2
mov qword [rcx + rax*8], rbx
jmp 0x1800cc4e4
mov rdi, rax
jmp 0x1800cc483
cmp rdx, rdi
jne 0x1800cc4dd
mov qword [rcx + rax*8], rbx
jmp 0x1800cc4e9
cmp qword [rcx + rax*8 + 8], r8
jne 0x1800cc4e9
mov qword [rcx + rax*8 + 8], rbx
mov qword [rsi], rbx
mov byte [rsi + 8], 1
jmp 0x1800cc37a
Function at 0x1800cc4f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x1805f0740]
mov esi, 1
add rcx, rsi
xorps xmm1, xmm1
js 0x1800cc522
cvtsi2ss xmm1, rcx
jmp 0x1800cc537
mov rax, rcx
and rcx, rsi
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm1, dword [0x1805f0730]
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x1800cc56a
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x1800cc56a
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, esi
xor eax, esi
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x1800c3b30]
xor ecx, ecx
comiss xmm1, xmm0
jb 0x1800cc58f
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1800cc58f
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x1805f0768]
cvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x1800cc5c4
cmp rdx, 0x200
jae 0x1800cc5c1
shl rdx, 3
cmp rdx, rcx
jae 0x1800cc5c4
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov rax, rsi
shl rax, cl
cmp rdx, rax
jbe 0x1800cc5eb
lea rcx, [0x1800bc7c0]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [0x1805f0738]
lea rax, [rdx - 1]
or rax, rsi
mov rdi, rsi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1805f0748]
lea rdx, [rdi + rdi]
call fcn.1800cc1ac
mov rax, qword [0x1805f0738]
lea r9, [rdi - 1]
mov qword [0x1805f0760], r9
mov qword [0x1805f0768], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800cc737
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [rax + r8 + 0x10]
movabs r10, 0x100000001b3
xor r11, rdx
add r8, rsi
imul r11, r10
cmp r8, 8
jb 0x1800cc650
mov rdi, qword [0x1805f0748]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x1800cc68e
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x1800cc6fd
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x1800cc6d2
mov r10, qword [r10]
cmp r10, rax
je 0x1800cc687
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800cc687
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x1800cc711
cmp qword [rdi + r11*8], r10
jne 0x1800cc6c8
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800cc737
mov r9, qword [0x1805f0760]
jmp 0x1800cc640
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800cc6fd
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800cc748
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x70
mov eax, dword [0x1800bc850]
mov rbx, rcx
movups xmm0, xmmword [0x1800bc828]
mov dword [rsp + 0x68], eax
movzx eax, word [0x1800bc854]
movups xmm1, xmmword [0x1800bc838]
mov word [rsp + 0x6c], ax
mov eax, 0x30
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x1800bc848]
movsd qword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm1
jmp 0x1800cc7ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1800cc7b4
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x1800cc80d
inc ax
mov word [rsp + 0x6a], ax
jmp 0x1800cc7cf
cmp eax, 0xe7
jne 0x1800cc80d
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x1800cc80d
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1800cc794
mov byte [rbx], 1
mov al, 1
add rsp, 0x70
pop rbx
ret
xor al, al
jmp 0x1800cc807

Function at 0x1800cc814
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r8
test r8, r8
jne 0x1800cc828
lea eax, [r8 + 1]
jmp 0x1800cc869
test rcx, rcx
je 0x1800cc867
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1800cc867
test rdx, rdx
je 0x1800cc867
and dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 1
cmp eax, ecx
jne 0x1800cc861
cmp dword [rsp + 0x50], ebx
je 0x1800cc863
xor cl, cl
mov al, cl
jmp 0x1800cc869
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x1800cc870
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x1800cc903
test rcx, rcx
je 0x1800cc903
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1800cc903
and qword [rax - 0x10], 0
xor r9d, r9d
and dword [rax + 0x10], 0
lea rax, [rax + 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1800cc8f1
mov eax, dword [rsp + 0x48]
cmp rax, rdi
jb 0x1800cc903
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov r8d, edi
and qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x1800cc8f1
jmp 0x1800cc905
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], 0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800cc9fc
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
mov rdi, r8
mov qword [r11 + 8], rsi
mov rbx, rcx
test rdx, rdx
je 0x1800cca53
cmp word [rdx], si
je 0x1800cca53
mov qword [r11 - 0x18], rsi
lea rax, [r11 + 8]
mov qword [r11 - 0x20], rax
xor r9d, r9d
mov qword [r11 - 0x28], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1800cca96
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x88]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rsp + 0x80]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
mov edi, eax
test rcx, rcx
je 0x1800cca94
cmp rcx, rbx
je 0x1800cca94
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1800ccf44
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
inc dword [0x1803f7ac8]
mov r9d, 0x138
mov edx, dword [0x1803f7ad0]
cmp edx, r9d
jne 0x1800ccfaf
lea r8, [0x1803f7ae0]
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8]
lea r8, [r8 + 8]
mov al, dl
and al, 1
neg al
movabs rax, 0xb5026f5aa96619e9
sbb rcx, rcx
shr rdx, 1
and rcx, rax
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1800ccf68
jmp 0x1800ccfc3
cmp edx, 0x270
jb 0x1800ccfc9
lea rcx, [0x1803f7ad0]
call fcn.1800ce240
mov edx, dword [0x1803f7ad0]
mov eax, edx
lea rcx, [0x1803f7ad8]
inc edx
xorps xmm2, xmm2
mov rcx, qword [rcx + rax*8]
mov dword [0x1803f7ad0], edx
mov rax, rcx
shr rax, 0x1d
movabs rdx, 0x38eb3ffff6d3
and rax, qword [0x1803f8e58]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
shr rdx, 0xb
test rdx, rdx
js 0x1800cd033
cvtsi2sd xmm2, rdx
jmp 0x1800cd048
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm2, rax
addsd xmm2, xmm2
mulsd xmm2, qword [0x1800c37e0]
mov rbx, qword [0x1803f7ac0]
movsd xmm0, qword [0x1803f8e68]
subsd xmm0, qword [0x1803f8e60]
mulsd xmm2, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
addsd xmm2, qword [0x1803f8e60]
mulsd xmm2, xmm0
mulsd xmm2, qword [0x1800c3b70]
cvttsd2si rax, xmm2
sub rbx, rax
cmp qword [0x1803f7ab8], rbx
cmovl rbx, qword [0x1803f7ab8]
mov qword [0x1803f7ac0], rbx
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rbx, 0x2710
add rcx, rax
mov qword [0x1805bb920], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x1800ce240
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r10, [rcx + 0x9c8]
mov r9, rcx
mov rax, qword [r10]
mov r11d, 0x9c
mov rbx, 0xffffffff80000000
movabs rdi, 0xb5026f5aa96619e9
lea r8, [r10 + 8]
mov rdx, qword [r8]
xor rdx, rax
and rdx, rbx
xor rdx, qword [r8]
mov al, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, rdi
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 - 0x9c0], rcx
lea r10, [r8]
sub r11, 1
jne 0x1800ce26e
lea r10, [r9 + 0xea8]
mov r11d, 0x9b
mov rax, qword [r10]
lea r8, [r10 + 8]
mov rdx, qword [r8]
xor rdx, rax
and rdx, rbx
xor rdx, qword [r8]
mov al, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, rdi
xor rcx, qword [r10 - 0xea0]
xor rcx, rdx
mov qword [r10 - 0x9c0], rcx
lea r10, [r8]
sub r11, 1
jne 0x1800ce2ba
mov rdx, qword [r9 + 8]
xor rdx, qword [r9 + 0x1380]
and rdx, rbx
mov rbx, qword [rsp + 8]
xor rdx, qword [r9 + 8]
mov al, dl
and al, 1
neg al
sbb rcx, rcx
and dword [r9], 0
and rcx, rdi
shr rdx, 1
xor rcx, qword [r9 + 0x4e0]
mov rdi, qword [rsp + 0x10]
xor rcx, rdx
mov qword [r9 + 0x9c0], rcx
ret
Function at 0x1800d52f4
Capabilities:
Encode data using xor
Hash data with crc32
Link many functions at runtime

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov ebx, ecx
lea rcx, [rbp - 0x80]
call fcn.1801086d0
mov edx, ebx
mov rcx, rax
call fcn.180109500
xor edi, edi
test al, al
je 0x1800d533e
lea rdx, [rbp + 0xb0]
call fcn.1801085fc
mov eax, dword [rax]
jmp 0x1800d5b16
mov rcx, qword [0x1805db9a8]
lea rdx, [0x1800bdc50]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rcx, qword [0x1805db9a8]
lea rdx, [0x1800bdc30]
mov r12, rax
mov qword [rbp - 0x28], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp - 0x28]
mov rcx, r12
call rax
mov rcx, qword [0x1805db9a8]
lea rdx, [0x1800bdc30]
mov ebx, edi
mov qword [rbp + 0xc0], rdi
mov dword [rbp + 0xb8], ebx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rbp + 0xc0]
mov rcx, r12
call rax
cmp qword [rbp + 0xc0], rdi
jbe 0x1800d5b14