joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180039b50
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180039b81
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180628ff8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180629008]
lea rdx, [rdi + rdi]
call fcn.180033b60
mov rax, qword [0x180628ff8]
lea r9, [rdi - 1]
mov qword [0x180629020], r9
mov qword [0x180629028], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180039cf4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180629008]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180039c40
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180039cb5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180039c7d
mov r10, qword [rdx]
cmp r10, rax
je 0x180039c77
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180039cb5
cmp r9, rdx
je 0x180039c91
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180039cc9
cmp r9, rdx
jne 0x180039c82
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180039cef
mov r9, qword [0x180629020]
jmp 0x180039bf1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180039cb5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180040ac0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180040af1
xor eax, eax
lea r8, [0x18003fde0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180042e00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1803ce040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180042ed3
cmp byte [rcx + 0x71], 0
je 0x180042ed3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180042ecf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180042e94
sub eax, 1
je 0x180042e98
cmp eax, 2
jne 0x180042ecf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800457e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180042ec6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x180042ecf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180042e7c
xor al, al
jmp 0x180042e7c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800457e0
add rsp, 0x60
pop rbx
ret
Function at 0x1800445b0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800445e5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x28], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001f030
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18004475d
mov qword [rsp + 0x30], rbp
xorps xmm2, xmm2
mov qword [rsp + 0x20], r15
movabs rbp, 0x100000001b3
movabs r15, 0xcbf29ce484222325
movss xmm0, dword [rax + 0x10]
ucomiss xmm0, xmm2
mov rcx, qword [rcx]
jp 0x180044667
jne 0x180044667
movaps xmm1, xmm2
jmp 0x18004466a
movaps xmm1, xmm0
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
movd r9d, xmm1
mov edx, r9d
shr edx, 8
movzx r10d, dl
movzx edx, r9b
xor rdx, r15
imul rdx, rbp
xor r10, rdx
mov edx, r9d
imul r10, rbp
shr edx, 0x10
movzx r8d, dl
xor r10, r8
mov edx, r9d
imul r10, rbp
shr rdx, 0x18
xor r10, rdx
imul r10, rbp
and r11, r10
add r11, r11
mov rdx, qword [rdi + r11*8]
cmp rdx, rbx
jne 0x1800446cc
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x180044747
mov r10, qword [rdi + r11*8 + 8]
ucomiss xmm0, dword [r10 + 0x10]
jp 0x18004470a
jne 0x18004470a
mov r10, qword [r10]
cmp r10, rax
je 0x180044703
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8 + 8], rax
jmp 0x180044747
cmp rdx, r10
je 0x180044722
nop
mov r10, qword [r10 + 8]
ucomiss xmm0, dword [r10 + 0x10]
jp 0x18004471d
je 0x18004476e
cmp rdx, r10
jne 0x180044710
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180044653
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
mov r14, qword [rsp + 0x28]
add rsp, 0x38
pop rdi
pop rsi
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180044747
Function at 0x140700590
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14070059a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1407005c3
pop rbp
sub rbp, 0x33
sub rbp, 0x700590
sub rsp, 0x20
add byte [rax], al
jmp 0x1407005e2
mov rax, 0x700590
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0xffffffffd177c034
xor byte [rax], dl
inc rax
dec rcx
jne 0x140700601
jmp 0x140700618
jl 0x1407005d7
fnstsw word [rdi + 0x343408bd]
xor al, 0x7c
mov ch, 0xf5
cmp al, 0x35
xor al, 0x34
jl 0x14070065f
fnstsw word [rbx + rsi*8 - 0xc]
invalid
xor eax, 0x9f8e7cdd
cmp eax, 0x3434445e
xor al, 0x34
fdiv qword [rcx]
xor al, 0x34
xor al, 0xdd
and dh, byte [rsp + rsi]
xor al, 0xf5
fdiv qword [rsi]
add eax, 0xf5b57c25
xor byte [rsp + rsi], dh
xor al, 0x7c
retf
Function at 0x180001560
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180001780
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180001667
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800015c4
mov rax, qword [0x180009008]
cmp qword [rsp + 0x20], rax
ja 0x1800015c4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180001586
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800015f3
jmp 0x180001667
cmp dword [rsp + 0x50], 0x10000
jne 0x18000164a
cmp qword [rsp + 0x48], 0x10000
jb 0x18000164a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180001638
mov rax, qword [rsp + 0x28]
jmp 0x180001669
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180001662
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180001780
mov qword [rsp + 0x20], rax
jmp 0x180001586
xor eax, eax
add rsp, 0x68
ret

Function at 0x180001670
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800017c0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180001773
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x1800016cb
mov rax, qword [0x180009008]
cmp qword [rsp + 0x20], rax
ja 0x1800016cb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18000168d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1800016fa
jmp 0x180001773
cmp dword [rsp + 0x50], 0x10000
jne 0x180001751
cmp qword [rsp + 0x48], 0x10000
jb 0x180001751
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000173f
mov rax, qword [rsp + 0x28]
jmp 0x180001775
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18000176e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800017c0
mov qword [rsp + 0x20], rax
jmp 0x18000168d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180001810
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180001da0
mov qword [rsp + 0x28], 0
cmp qword [0x180009108], 0
jne 0x180001858
cmp qword [0x180009100], 0
je 0x180001858
mov rax, qword [0x180009100]
mov qword [0x180009108], rax
cmp qword [0x180009108], 0
je 0x1800018fe
mov rax, qword [0x180009108]
cmp qword [rax + 0x10], 0
je 0x1800018fe
mov rax, qword [0x180009108]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800018fe
mov rax, qword [0x180009108]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800018fe
mov rax, qword [0x180009108]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x1800018c4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x1800018cb
xor eax, eax
jmp 0x180001a79
mov rax, qword [0x180009108]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180001a79
mov rax, qword [0x180009100]
mov qword [0x180009108], rax
jmp 0x180001920
mov rax, qword [0x180009108]
mov rax, qword [rax + 8]
mov qword [0x180009108], rax
cmp qword [0x180009108], 0
je 0x18000196d
cmp qword [0x180009108], 0
je 0x18000196b
mov rax, qword [0x180009108]
cmp qword [rax + 0x10], 0
je 0x18000196b
mov rax, qword [0x180009108]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18000196b
mov rax, qword [0x180009108]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18000196b
jmp 0x18000189c
jmp 0x18000190e
mov rcx, qword [rsp + 0x60]
call fcn.180003c20
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180001a80
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180001a77
mov rax, qword [rsp + 0x48]
mov qword [0x180009108], rax
mov rax, qword [0x180009108]
mov dword [rax], 0x52727464
mov rax, qword [0x180009108]
mov qword [rax + 0x10], 0
mov rax, qword [0x180009108]
mov rcx, qword [0x180009100]
mov qword [rax + 8], rcx
mov rax, qword [0x180009108]
mov qword [0x180009100], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180009108]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180001a28
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180001a62
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180001a1e
mov rax, qword [0x180009108]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18000189c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1800044d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x180004503
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180004549
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180004544
nop
cmp rbx, rcx
jae 0x180004549
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
dec edi
jne 0x180004530
cmp rbx, rcx
jb 0x18000454d
xor eax, eax
jmp 0x180004559
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800050f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
movsxd rax, dword [rcx + 0x3c]
movzx ecx, word [rax + rcx + 0x18]
mov edx, 0x10b
cmp cx, dx
je 0x18000528a
mov edx, 0x20b
cmp cx, dx
jne 0x18000528a
mov rdx, rdi
mov ecx, dword [rax + rdi + 0x88]
call fcn.180005530
mov r15d, eax
add r15, rdi
mov rdx, rdi
mov ecx, dword [r15 + 0x20]
call fcn.180005530
mov esi, eax
add rsi, rdi
mov rdx, rdi
mov ecx, dword [r15 + 0x24]
call fcn.180005530
mov r14d, eax
add r14, rdi
mov ebp, dword [r15 + 0x18]
test ebp, ebp
je 0x18000528a
xor r12d, r12d
nop dword [rax]
dec ebp
mov r8d, dword [rsi]
movsxd rcx, dword [rdi + 0x3c]
add rcx, rdi
movzx eax, word [rcx + 0x14]
lea r11, [rax + rcx]
cmp r8d, dword [r11 + 0x2c]
jb 0x1800051f9
movzx eax, r12w
movzx r10d, word [rcx + 6]
cmp r12w, r10w
jae 0x1800051f6
movzx ecx, ax
lea rdx, [rcx + rcx*4]
mov r9d, dword [r11 + rdx*8 + 0x24]
cmp r8d, r9d
jb 0x1800051d7
mov edx, dword [r11 + rdx*8 + 0x28]
add edx, r9d
cmp r8d, edx
jb 0x1800051e0
inc ax
cmp ax, r10w
jmp 0x1800051b7
movzx ecx, ax
lea rax, [rcx + rcx*4]
mov ecx, dword [r11 + rax*8 + 0x2c]
sub ecx, dword [r11 + rax*8 + 0x24]
add r8d, ecx
jmp 0x1800051f9
mov r8d, r12d
mov ebx, r8d
add rbx, rdi
lea rdx, str.0Hs_xnsHrr
lea rcx, [rsp + 0x28]
call fcn.180001d30
nop
cmp qword [rax + 0x18], 0x10
jb 0x18000521b
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.180028678
test rax, rax
setne bl
cmp qword [rsp + 0x40], 0x10
jb 0x18000523e
mov rcx, qword [rsp + 0x28]
call fcn.180027f2c
mov qword [rsp + 0x40], reloc.ACTIVEDS.dll_FreeADsMem
mov qword [rsp + 0x38], r12
mov byte [rsp + 0x28], 0
test bl, bl
jne 0x180005267
add rsi, 4
add r14, 2
test ebp, ebp
jne 0x180005190
jmp 0x18000528a
mov rdx, rdi
mov ecx, dword [r15 + 0x1c]
call fcn.180005530
mov ecx, eax
movzx r8d, word [r14]
add rcx, rdi
mov rdx, rdi
mov ecx, dword [rcx + r8*4]
call fcn.180005530
jmp 0x18000528c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800292b0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180005380
Capabilities:
Resolve function by hash

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, r9
mov r15d, r8d
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
test rcx, rcx
je 0x1800054f2
test rdx, rdx
je 0x1800054f2
test r8d, r8d
je 0x1800054f2
mov rcx, rdx
call fcn.1800050f0
mov r14d, eax
test eax, eax
je 0x1800054f2
mov edx, 0x6e1a959c
mov ecx, 0x6a4abc5b
call fcn.1800055a0
test rax, rax
je 0x1800054f2
mov r13d, r15d
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, r15d
xor edx, edx
mov rcx, rsi
call rax
mov r15, rax
test rax, rax
je 0x1800054f2
mov edx, 0xd83d6aa1
mov ecx, 0x6a4abc5b
call fcn.1800055a0
test rax, rax
je 0x1800054f2
mov qword [rsp + 0x20], rbx
mov r9d, r13d
mov r8, rdi
mov rdx, r15
mov rcx, rsi
call rax
test eax, eax
je 0x1800054f2
lea rdi, [r15 + r14]
cmp qword [0x18009d1e0], rbx
je 0x18000546d
mov r8, r12
mov rdx, rdi
mov rcx, rsi
call fcn.180005830
jmp 0x1800054a4
mov edx, 0x72bd9cdd
mov ecx, 0x6a4abc5b
call fcn.1800055a0
test rax, rax
je 0x1800054ac
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r12
mov r9, rdi
xor edx, edx
mov r8d, 0x100000
mov rcx, rsi
call rax
mov qword [rsp + 0x48], rax
mov rbx, rax
test rbx, rbx
je 0x1800054f2
mov edx, 0xce05d9ad
mov ecx, 0x6a4abc5b
call fcn.1800055a0
test rax, rax
je 0x1800054cd
or edx, 0xffffffff
mov rcx, rbx
call rax
mov edx, 0xc3b4eb78
mov ecx, 0x6a4abc5b
call fcn.1800055a0
test rax, rax
je 0x1800054f2
mov r9d, 0x8000
xor r8d, r8d
mov rdx, r15
mov rcx, rsi
call rax
jmp 0x1800054fb
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x1800055a0
Capabilities:
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x1800990e0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov dword [rsp + 0x44], edx
xor edi, edi
mov esi, edi
mov qword [rsp + 0x58], rdi
mov r12d, edi
mov qword [rsp + 0x50], rdi
mov r13d, edi
mov qword [rsp + 0x68], rdi
cmp ecx, 0x6a4abc5b
jne 0x180005601
mov r15, qword [0x18009c9b0]
jmp 0x180005618
cmp ecx, 0x3cfa685d
jne 0x180005613
call fcn.1800059d0
mov r15, rax
jmp 0x180005618
mov r15, qword [rsp + 0x60]
test r15, r15
je 0x1800057c8
mov r8d, 0x104
lea rdx, [rsp + 0x90]
mov rcx, r15
call qword [0x18009c9d0]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, [rsp + 0x90]
call qword [0x18009c9a8]
mov r13, rax
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
je 0x1800057c8
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov rcx, rax
call qword [0x18009c9c8]
mov r12, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x1800057c8
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [0x18009c998]
mov rsi, rax
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1800057c8
movsxd r14, dword [rax + 0x3c]
add r14, rax
mov qword [rsp + 0x80], r14
xor r9d, r9d
mov r8d, dword [r14 + 0x88]
mov rdx, rax
mov rcx, r14
call fcn.180005920
mov rbx, rax
xor r9d, r9d
mov r8d, dword [rax + 0x24]
mov rdx, rsi
mov rcx, r14
call fcn.180005920
mov qword [rsp + 0x88], rax
xor r9d, r9d
mov r8d, dword [rbx + 0x1c]
mov rdx, rsi
mov rcx, r14
call fcn.180005920
mov qword [rsp + 0x78], rax
xor r9d, r9d
mov r8d, dword [rbx + 0x20]
mov rdx, rsi
mov rcx, r14
call fcn.180005920
mov rcx, rax
mov qword [rsp + 0x60], rax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x48], eax
mov ebx, edi
mov dword [rsp + 0x40], ebx
nop
cmp ebx, eax
jae 0x1800057c8
mov r14d, ebx
xor r9d, r9d
mov r8d, dword [rcx + r14*4]
mov rdx, rsi
mov rcx, qword [rsp + 0x80]
call fcn.180005920
mov qword [rsp + 0x70], rax
mov ecx, edi
movzx edx, byte [rax]
nop dword [rax + rax]
ror ecx, 0xd
movsx edx, dl
add ecx, edx
inc rax
mov qword [rsp + 0x70], rax
movzx edx, byte [rax]
test dl, dl
jne 0x180005780
cmp ecx, dword [rsp + 0x44]
jne 0x1800057b7
mov rax, qword [rsp + 0x88]
movzx eax, word [rax + r14*2]
mov rcx, qword [rsp + 0x78]
mov edi, dword [rcx + rax*4]
add rdi, r15
jmp 0x1800057c8
inc ebx
mov dword [rsp + 0x40], ebx
mov eax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
jmp 0x180005750
test rsi, rsi
je 0x1800057d6
mov rcx, rsi
call qword [0x18009c9c0]
mov rcx, r13
call qword [0x18009c9b8]
mov rcx, r12
call qword [0x18009c9b8]
mov rax, rdi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1800292b0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x180005830
Capabilities:
Resolve function by hash

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x60
xorps xmm0, xmm0
mov rdi, rdx
mov rsi, rcx
mov edx, 0x442f2041
mov ecx, 0x3cfa685d
mov rbx, r8
mov qword [rax + 0x20], 0
movdqu xmmword [rax - 0x18], xmm0
call fcn.1800055a0
test rax, rax
je 0x1800058c5
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x88]
xor edx, edx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rdi
mov rcx, rsi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rax
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x180005920
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rbx, r9
mov rdi, rdx
test r9, r9
je 0x180005952
mov r10, qword [r9]
test r10, r10
je 0x180005952
mov r11d, dword [r10 + 0xc]
cmp r8d, r11d
jb 0x180005952
mov edx, dword [r10 + 0x10]
add edx, r11d
cmp r8d, edx
jb 0x18000599a
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea r10, [rcx + 0x18]
add r10, rax
xor edx, edx
test r9d, r9d
je 0x18000598d
nop dword [rax]
mov ecx, dword [r10 + 0xc]
cmp r8d, ecx
jb 0x180005982
add ecx, dword [r10 + 0x10]
cmp r8d, ecx
jb 0x18000599a
inc edx
add r10, 0x28
cmp edx, r9d
jb 0x180005970
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
test r10, r10
je 0x18000598d
test rbx, rbx
je 0x1800059a7
mov qword [rbx], r10
sub r8d, dword [r10 + 0xc]
mov eax, dword [r10 + 0x14]
mov rbx, qword [rsp + 8]
mov ecx, r8d
add rcx, rdi
mov rdi, qword [rsp + 0x10]
add rax, rcx
ret