joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180023009
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rdx, rdx
je 0x1800231c8
mov r11, rsp
push rbp
push rsi
push r12
push r13
lea rbp, [r11 - 0x5f]
sub rsp, 0x98
mov rax, qword [0x18005b0d0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r13d, r8d
mov rsi, rdx
mov r12d, ecx
cmp ecx, 1
jg 0x1800231af
mov qword [r11 + 0x18], rbx
xor ebx, ebx
mov byte [rbp - 0x39], 0
test r8d, r8d
je 0x180023194
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
movabs r15, 0x2020202020202020
lea r14, str.0123456789abcdef
nop dword [rax]
mov edi, ebx
and edi, 0xf
jne 0x180023119
test ebx, ebx
je 0x180023092
lea r8, [rbp - 0x39]
lea rdx, [0x180042700]
mov ecx, r12d
call fcn.180022fd0
mov qword [rbp - 0x39], r15
mov eax, 0x80008001
mov qword [rbp - 0x31], r15
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mul ebx
shr edx, 0xf
mov eax, ebx
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
imul edx, edx, 0xffff
sub eax, edx
mov dword [rbp + 0xf], r15d
mov word [rbp + 0x13], r15w
mov ecx, eax
shr rax, 0xc
mov byte [rbp + 0x15], 0
and eax, 0xf
mov byte [rbp - 0x33], 0x3a
movzx eax, byte [rax + r14]
mov byte [rbp - 0x37], al
mov eax, ecx
shr rax, 8
and eax, 0xf
movzx eax, byte [rax + r14]
mov byte [rbp - 0x36], al
mov eax, ecx
shr rax, 4
and eax, 0xf
and ecx, 0xf
movzx eax, byte [rax + r14]
mov byte [rbp - 0x35], al
movzx eax, byte [rcx + r14]
mov byte [rbp - 0x34], al
movzx edx, byte [rsi]
xor r8d, r8d
lea ecx, [rdi + rdi*2 + 9]
mov eax, edx
cmp edi, 8
setge r8b
shr rax, 4
and edx, 0xf
movzx eax, byte [rax + r14]
add r8d, ecx
lea ecx, [r8 + 1]
mov byte [rbp + r8 - 0x39], al
movzx eax, byte [rdx + r14]
mov byte [rbp + rcx - 0x39], al
movzx ecx, byte [rsi]
call qword [sym.imp.MSVCR100.dll_isprint]
test eax, eax
je 0x180023166
movzx eax, byte [rsi]
movsxd rcx, edi
mov byte [rbp + rcx + 3], al
jmp 0x18002316e
movsxd rax, edi
mov byte [rbp + rax + 3], reloc.ca_core.dll_Ordinal_46
inc ebx
inc rsi
cmp ebx, r13d
jb 0x180023070
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
lea r8, [rbp - 0x39]
lea rdx, [0x180042700]
mov ecx, r12d
call fcn.180022fd0
mov rbx, qword [rsp + 0xd0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.18003c580
add rsp, 0x98
pop r13
pop r12
pop rsi
pop rbp
repz ret
Function at 0x180024120
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movzx eax, byte [rcx + 2]
movzx r9d, byte [rcx + 3]
movzx r10d, byte [rcx + 7]
shl r9d, 8
shl r10d, 8
xor ebx, ebx
or r9d, eax
movzx eax, byte [rcx + 1]
movsxd r8, r8d
shl r9d, 8
shl r8, 4
mov r11, rdx
or r9d, eax
movzx eax, byte [rcx]
mov edx, ebx
shl r9d, 8
lea edi, [rbx + 8]
or r9d, eax
movzx eax, byte [rcx + 6]
or r10d, eax
movzx eax, byte [rcx + 5]
shl r10d, 8
or r10d, eax
movzx eax, byte [rcx + 4]
shl r10d, 8
or r10d, eax
lea rax, [0x180044c90]
add r8, rax
and edx, 3
mov eax, r10d
mov ecx, r10d
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, dword [r8 + rdx*4]
add eax, ebx
add ecx, r10d
add ebx, 0x9e3779b9
xor ecx, eax
mov edx, ebx
add r9d, ecx
and edx, 3
mov eax, r9d
mov ecx, r9d
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, ebx
shr rax, 0xb
add ecx, r9d
and eax, 3
mov eax, dword [r8 + rax*4]
add eax, ebx
xor ecx, eax
add r10d, ecx
mov eax, r10d
mov ecx, r10d
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, dword [r8 + rdx*4]
add eax, ebx
add ecx, r10d
add ebx, 0x9e3779b9
xor ecx, eax
mov edx, ebx
add r9d, ecx
and edx, 3
mov eax, r9d
mov ecx, r9d
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, ebx
shr rax, 0xb
add ecx, r9d
and eax, 3
mov eax, dword [r8 + rax*4]
add eax, ebx
xor ecx, eax
add r10d, ecx
mov eax, r10d
mov ecx, r10d
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, dword [r8 + rdx*4]
add eax, ebx
add ecx, r10d
add ebx, 0x9e3779b9
xor ecx, eax
mov edx, ebx
add r9d, ecx
mov eax, r9d
mov ecx, r9d
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, ebx
shr rax, 0xb
add ecx, r9d
and eax, 3
mov eax, dword [r8 + rax*4]
add eax, ebx
xor ecx, eax
add r10d, ecx
mov ecx, r10d
mov eax, r10d
shr ecx, 5
shl eax, 4
and edx, 3
xor ecx, eax
mov eax, dword [r8 + rdx*4]
add eax, ebx
add ecx, r10d
add ebx, 0x9e3779b9
xor ecx, eax
mov edx, ebx
add r9d, ecx
mov eax, r9d
mov ecx, r9d
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, ebx
shr rax, 0xb
add ecx, r9d
and eax, 3
mov eax, dword [r8 + rax*4]
add eax, ebx
xor ecx, eax
add r10d, ecx
dec rdi
jne 0x180024190
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov byte [r11], r9b
mov byte [r11 + 4], r10b
shr r9d, 8
shr r10d, 8
mov byte [r11 + 1], r9b
mov byte [r11 + 5], r10b
shr r9d, 8
shr r10d, 8
mov byte [r11 + 2], r9b
shr r9d, 8
mov byte [r11 + 6], r10b
shr r10d, 8
mov byte [r11 + 3], r9b
mov byte [r11 + 7], r10b
ret
Function at 0x180024310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov edi, dword [rcx]
mov ebx, dword [rcx + 4]
mov r11, rcx
lea rsi, [rdx + 0x1004]
mov ebp, 4
nop dword [rax + rax]
xor edi, dword [rsi - 4]
add rsi, 0x10
mov eax, edi
shr rax, 0x10
movzx ecx, al
mov eax, edi
mov r9d, dword [rdx + rcx*4 + 0x400]
shr rax, 0x18
add r9d, dword [rdx + rax*4]
mov eax, edi
shr rax, 8
movzx ecx, al
movzx eax, dil
xor r9d, dword [rdx + rcx*4 + reloc.mfc100.dll_Ordinal_2048]
add r9d, dword [rdx + rax*4 + 0xc00]
xor r9d, ebx
xor r9d, dword [rsi - 0x10]
mov eax, r9d
shr rax, 0x10
movzx ecx, al
mov eax, r9d
mov r8d, dword [rdx + rcx*4 + 0x400]
shr rax, 0x18
add r8d, dword [rdx + rax*4]
mov eax, r9d
shr rax, 8
movzx ecx, al
movzx eax, r9b
xor r8d, dword [rdx + rcx*4 + reloc.mfc100.dll_Ordinal_2048]
add r8d, dword [rdx + rax*4 + 0xc00]
xor r8d, edi
xor r8d, dword [rsi - 0xc]
mov eax, r8d
shr rax, 0x10
movzx ecx, al
mov eax, r8d
mov ebx, dword [rdx + rcx*4 + 0x400]
shr rax, 0x18
add ebx, dword [rdx + rax*4]
mov eax, r8d
shr rax, 8
movzx ecx, al
movzx eax, r8b
xor ebx, dword [rdx + rcx*4 + reloc.mfc100.dll_Ordinal_2048]
add ebx, dword [rdx + rax*4 + 0xc00]
xor ebx, r9d
xor ebx, dword [rsi - 8]
mov eax, ebx
shr rax, 0x10
movzx ecx, al
mov eax, ebx
mov edi, dword [rdx + rcx*4 + 0x400]
shr rax, 0x18
add edi, dword [rdx + rax*4]
mov eax, ebx
shr rax, 8
movzx ecx, al
movzx eax, bl
xor edi, dword [rdx + rcx*4 + reloc.mfc100.dll_Ordinal_2048]
add edi, dword [rdx + rax*4 + 0xc00]
xor edi, r8d
dec rbp
jne 0x180024340
mov eax, dword [rdx + 0x1044]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
xor eax, ebx
mov rbx, qword [rsp + 8]
mov dword [r11], eax
mov eax, dword [rdx + 0x1040]
xor eax, edi
mov rdi, qword [rsp + 0x20]
mov dword [r11 + 4], eax
ret
Function at 0x180024470
Capabilities:
Encrypt data using blowfish

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movaps xmm0, xmmword [0x180045d90]
movaps xmm1, xmmword [0x180045da0]
lea rbx, [rdx + 0x1000]
mov rdi, rdx
mov rbp, rcx
lea rdx, [0x180044d90]
mov r8d, 0x1000
mov rcx, rdi
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x180045db0]
movaps xmm1, xmmword [0x180045dc0]
movups xmmword [rbx + 0x20], xmm0
movsd xmm0, qword [0x180045dd0]
movups xmmword [rbx + 0x30], xmm1
movsd qword [rbx + 0x40], xmm0
call sub.MSVCR100.dll_memcpy
xor r11d, r11d
mov esi, 4
lea r9d, [r11 + 0x12]
mov ecx, r11d
nop dword [rax]
mov edx, r11d
mov r8, rsi
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
shl edx, 8
inc rcx
or eax, edx
cmp rcx, 0x18
cmovge rcx, r11
dec r8
mov edx, eax
jne 0x180024500
xor dword [rbx], eax
add rbx, rsi
dec r9
jne 0x1800244f0
mov qword [rsp + 0x38], r11
lea r10, [rdi + 0x1004]
lea ebx, [r8 + 9]
nop word [rax + rax]
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.180024310
mov edx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
mov dword [r10 - 4], edx
mov dword [r10], eax
add r10, 8
dec rbx
jne 0x180024540
lea r10, [rdi + 4]
nop dword [rax]
mov ebx, pe_nt_image_headers64
nop word [rax + rax]
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.180024310
mov edx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
mov dword [r10 - 4], edx
mov dword [r10], eax
add r10, 8
dec rbx
jne 0x180024580
dec rsi
jne 0x180024570
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180025e20
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
movsxd rax, dword [rdx + 8]
mov r12, qword [rdx]
mov r14d, r8d
cmp byte [r12 + rax], 0
mov rbp, rdx
mov rsi, rcx
mov edi, 1
mov r13, rax
je 0x180025e84
inc eax
movsxd rcx, eax
call qword [sym.imp.MSVCR100.dll_malloc]
mov r8, r13
mov rdx, r12
mov rcx, rax
mov rbx, rax
call sub.MSVCR100.dll_memcpy
movsxd r11, dword [rbp + 8]
mov byte [r11 + rbx], 0
jmp 0x180025e87
mov rbx, r12
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsi + 4], eax
cmp eax, 0xffffffff
jne 0x180025eb8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x180025ef6
mov rax, qword [rax + 0x18]
cmp qword [rax], 0
je 0x180025ef6
mov rax, qword [rax]
mov ecx, dword [rax]
mov dword [rsi + 4], ecx
movzx ecx, r14w
call qword [sym.imp.ca_core.dll_Ordinal_9]
mov word [rsi + 2], ax
cmp rbx, qword [rbp]
je 0x180025ed5
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_free]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, edi
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
lea rdx, str.Problem_accessing_the_DNS.__addr:__s_
mov r8, rbx
mov ecx, edi
call fcn.180022fd0
xor edi, edi
jmp 0x180025ec6
Function at 0x180025f10
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x18005b0d0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor esi, esi
mov rdi, rdx
mov rbx, rcx
mov dword [rcx + 0x4120], esi
mov dword [rcx + 0x28], esi
mov qword [rcx + 0x80], rsi
lea edx, [rsi + 1]
lea ecx, [rsi + 2]
lea r8d, [rsi + 6]
mov dword [rsp + 0x38], 1
call qword [sym.imp.ca_core.dll_Ordinal_23]
mov dword [rbx + 0x110], eax
cmp eax, 0xffffffff
je 0x18002611c
lea r8, [rsp + 0x34]
movsxd rcx, eax
mov edx, 0x8004667e
mov dword [rsp + 0x34], 1
call qword [sym.imp.ca_core.dll_Ordinal_10]
movsxd rcx, dword [rbx + 0x110]
lea r8d, [rsi + 0x10]
mov rdx, rdi
call qword [sym.imp.gifenc.dll_Ordinal_4]
test eax, eax
je 0x18002602f
movsxd rax, dword [rbx + 0x110]
lea r8, [rsp + 0x50]
lea ecx, [rsi + 0x40]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x40], 0xa
mov qword [rsp + 0x20], rax
call qword [sym.imp.ca_core.dll_Ordinal_18]
test eax, eax
js 0x18002608d
je 0x18002608d
movsxd rcx, dword [rbx + 0x110]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, Ordinal_4108
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x30], 4
call qword [sym.imp.httpsrv.dll_Ordinal_7]
cmp dword [rsp + 0x34], esi
jne 0x18002613d
movsxd rcx, dword [rbx + 0x110]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov dword [rsp + 0x30], esi
call qword [sym.imp.ca_core.dll_Ordinal_10]
cmp word [rbx + 0x4250], si
je 0x18002609a
lea r8, str.RTMP_Connect0
lea rdx, str._s_..._SOCKS_negotiation
mov ecx, 4
call fcn.180022fd0
mov rcx, rbx
call fcn.1800266b0
test eax, eax
jne 0x18002609a
lea r8, str.RTMP_Connect0
lea rdx, str._s__SOCKS_negotiation_failed.
lea ecx, [rax + 1]
call fcn.180022fd0
mov rcx, rbx
call fcn.18002c240
jmp 0x18002613d
mov eax, dword [rbx + 0x4248]
movsxd rcx, dword [rbx + 0x110]
lea r9, [rsp + 0x30]
imul eax, eax, 0x3e8
mov edx, 0xffff
mov r8d, 0x1006
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x1800260f2
mov r9d, dword [rbx + 0x4248]
lea r8, str.RTMP_Connect0
lea rdx, str._s__Setting_socket_timeout_to__ds_failed_
mov ecx, 1
call fcn.180022fd0
movsxd rcx, dword [rbx + 0x110]
mov edx, 6
lea r9, [rsp + 0x38]
lea r8d, [rdx - 5]
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov eax, 1
jmp 0x18002613f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea r8, str.RTMP_Connect0
lea rdx, str._s__failed_to_create_socket._Error:__d
mov r9d, eax
mov ecx, 1
call fcn.180022fd0
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18003c580
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18002cf10
Capabilities:
Print debug messages

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x2c]
movsxd rbp, r8d
mov r14, rdx
mov rbx, rcx
test eax, eax
jne 0x18002d069
mov rax, qword [rcx + 0x2a0]
cmp rax, 0x1e00000
jle 0x18002cf5c
mov r8, qword [rcx + 0x260]
lea rdx, str.Fatal_error:__s_MemoryBuffer_full._CopyBlockIn_been_skiped
mov ecx, 2
add rsp, 0x20
pop r14
pop rbp
pop rbx
jmp fcn.180035240
mov eax, dword [rcx + 0x30]
test eax, eax
jne 0x18002d069
cmp dword [rcx + 0x10], eax
je 0x18002cfa4
mov rcx, qword [rcx + 0x2a0]
lea r8d, [rax + 2]
xor edx, edx
add rcx, rbp
mov qword [rbx + 0x2a0], rcx
mov ecx, dword [rbx + 0x10]
call qword [sym.imp.MSVCR100.dll__lseek]
mov ecx, dword [rbx + 0x10]
mov r8d, ebp
mov rdx, r14
add rsp, 0x20
pop r14
pop rbp
pop rbx
jmp qword [sym.imp.MSVCR100.dll__write]
add qword [rcx + 0x58], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
add rcx, 0x2a8
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, reloc.ca_core.dll_Ordinal_48
call qword [sym.imp.MSVCR100.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x18002cff8
mov qword [rax], rsi
mov qword [rax + 0x20], rsi
mov dword [rax + 8], esi
mov dword [rax + 0x28], esi
mov dword [rax + 0x18], esi
mov qword [rax + 0x10], rsi
mov byte [rax + 0x2c], 1
jmp 0x18002cffb
mov rdi, rsi
mov rcx, rbp
call qword [sym.imp.MSVCR100.dll_malloc]
mov r8, rbp
mov rdx, r14
mov rcx, rax
mov qword [rdi + 0x20], rax
mov dword [rdi + 0x28], ebp
call sub.MSVCR100.dll_memcpy
mov r11, qword [rdi + 0x20]
lea rcx, [rbx + 0x268]
mov rdx, rdi
mov qword [rdi], r11
mov qword [rdi + 0x10], r11
mov dword [rdi + 8], ebp
mov dword [rdi + 0x18], ebp
mov byte [rdi + 0x2c], 1
call qword [sym.imp.mfc100.dll_Ordinal_1688]
add qword [rbx + 0x2a0], rbp
lea rcx, [rbx + 0x2a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov dword [rbx + 0x34], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x18002d080
Capabilities:
Read file on windows

Disassembly:
push rdi
push r13
push r15
sub rsp, 0x30
lea eax, [r8 - 1]
mov r13d, r8d
mov r15, rdx
mov rdi, rcx
cmp eax, 0x1dfffff
ja 0x18002d26c
mov ecx, dword [rcx + 0x10]
mov qword [rsp + 0x50], rbx
test ecx, ecx
je 0x18002d0e8
mov edx, dword [rdi + 0x14]
xor r8d, r8d
call qword [sym.imp.MSVCR100.dll__lseek]
mov ecx, dword [rdi + 0x10]
mov r8d, r13d
mov rdx, r15
call qword [sym.imp.MSVCR100.dll__read]
mov ecx, dword [rdi + 0x10]
mov ebx, eax
call qword [sym.imp.MSVCR100.dll__tell]
mov dword [rdi + 0x14], eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r13
pop rdi
ret
mov eax, dword [rdi + 0x24]
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
test eax, eax
je 0x18002d114
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r11d, dword [rdi + 0x24]
test r11d, r11d
jne 0x18002d100
lea rcx, [rdi + 0x2a8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r12d, r12d
mov ebp, r12d
test r13d, r13d
jle 0x18002d23f
mov qword [rsp + 0x60], rsi
nop word [rax + rax]
mov rax, qword [rdi + 0x2a0]
test rax, rax
jle 0x18002d23a
cmp qword [rdi + 0x280], 0
je 0x18002d23a
mov rax, qword [rdi + 0x270]
mov esi, r13d
mov rbx, qword [rax + 0x10]
sub esi, ebp
mov eax, dword [rbx + 8]
test eax, eax
jg 0x18002d17a
mov esi, r12d
jmp 0x18002d1ad
mov rdx, qword [rbx]
movsxd rcx, dword [rbx + 0x28]
cmp esi, eax
cmovg esi, eax
add rcx, qword [rbx + 0x20]
movsxd r12, esi
lea rax, [rdx + r12]
cmp rax, rcx
ja 0x18002d1a4
movsxd rcx, ebp
mov r8, r12
add rcx, r15
call sub.MSVCR100.dll_memcpy
add qword [rbx], r12
sub dword [rbx + 8], esi
xor r12d, r12d
movsxd rax, esi
sub qword [rdi + 0x2a0], rax
test esi, esi
jne 0x18002d22f
mov qword [rdi + 8], r12
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18002d1e9
call qword [sym.imp.MSVCR100.dll_free]
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x28], r12d
mov dword [rbx + 8], r12d
mov qword [rbx], r12
mov dword [rbx + 0x18], r12d
mov qword [rbx + 0x10], r12
mov byte [rbx + 0x2c], sil
lea rcx, [rdi + 0x268]
call qword [sym.imp.mfc100.dll_Ordinal_11231]
cmp byte [rbx + 0x2c], 0
je 0x18002d226
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18002d226
call qword [sym.imp.MSVCR100.dll_free]
mov qword [rbx + 0x20], r12
mov dword [rbx + 0x28], r12d
mov dword [rbx + 8], r12d
mov qword [rbx], r12
mov dword [rbx + 0x18], r12d
mov qword [rbx + 0x10], r12
mov byte [rbx + 0x2c], 0
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_]
add ebp, esi
cmp ebp, r13d
jl 0x18002d140
mov rsi, qword [rsp + 0x60]
lea rcx, [rdi + 0x2a8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r13
pop rdi
ret
or eax, 0xffffffff
add rsp, 0x30
pop r15
pop r13
pop rdi
ret
Function at 0x18002f0d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x30
xor r14d, r14d
mov esi, r8d
mov r12, rdx
mov r13, rcx
mov ebx, r14d
mov ebp, r14d
test r8d, r8d
jle 0x18002f157
mov qword [rsp + 0x60], rdi
mov edi, r8d
mov rcx, qword [r13 + 8]
mov r8d, reloc.mfc100.dll_Ordinal_2048
add ebp, reloc.mfc100.dll_Ordinal_2048
cmp ebp, esi
movsxd rdx, ebx
lea r9, [rsp + 0x70]
cmovg r8d, edi
add rdx, r12
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002f13e
add ebx, dword [rsp + 0x70]
sub edi, reloc.mfc100.dll_Ordinal_2048
cmp ebp, esi
jl 0x18002f100
mov eax, ebx
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret

Function at 0x18002f170
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18005b0d0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov edi, r9d
mov rsi, r8
test rcx, rcx
je 0x18002f215
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x3c], edx
mov dword [rsp + 0x40], r9d
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0xa8]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0xb0]
lea rdx, [rsp + 0x38]
mov r8d, Ordinal_26
mov dword [rsp + 0x38], 0xf1f2f3f4
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x4c], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18002f1fe
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.18002f0d0
jmp 0x18002f217
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18002f215
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18003c580
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x18002f630
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rsi, rcx
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor r13d, r13d
mov ebp, r13d
mov rdx, qword [rsi + 0x10]
mov edi, r13d
test rdx, rdx
jle 0x18002f2cb
nop dword [rax]
test rdi, rdi
js 0x18002f2c4
cmp rdi, rdx
jge 0x18002f2c4
mov rax, qword [rsi + 8]
mov rbx, qword [rax + rdi*8]
mov qword [rsp + 0x68], rbx
test rbx, rbx
je 0x18002f2b1
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18002f29f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], r13
mov rcx, rbx
call qword [sym.imp.mfc100.dll_Ordinal_889]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void____ptr64_]
inc ebp
inc rdi
mov rdx, qword [rsi + 0x10]
movsxd rax, ebp
cmp rax, rdx
jl 0x18002f270
jmp 0x18002f2cb
call qword [sym.imp.mfc100.dll_Ordinal_2022]
int3
or r8, 0xffffffffffffffff
xor edx, edx
mov rcx, rsi
call qword [sym.imp.mfc100.dll_Ordinal_12357]
lea rcx, [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
mov rcx, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.mfc100.dll_Ordinal_1209]
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov rdi, rcx
mov rcx, qword [rcx + 0x6b8]
test rcx, rcx
je 0x18002f691
mov dword [rdi], 1
mov edx, Ordinal_2002
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x18002f686
mov rcx, qword [rdi + 0x6b8]
xor edx, edx
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov qword [rdi + 0x6b8], 0
lea rcx, [rdi + 0x58]
call fcn.18001ae10
nop
lea rax, vtable.CFrameQueue.0
mov qword [rdi + 0x58], rax
lea rcx, [rdi + 0x68]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rdi + 0x58]
call fcn.18001ae10
nop
lea rcx, [rdi + 8]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x18002f230
Function at 0x1800309a0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor esi, esi
cmp dword [rcx + 0x530], 1
mov rdi, rcx
jne 0x180030a26
add rcx, 0x5b0
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rdi + 0x5b0]
mov dword [rdi + 0x530], esi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r8, qword [rdi + 8]
lea rdx, str._s:_Stop_record.
lea ecx, [rsi + 2]
call fcn.180035240
mov rcx, qword [rdi + 0x540]
mov edx, Ordinal_2002
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rsp + 0x30]
cmp eax, 0x102
jne 0x180030a26
mov rcx, qword [rdi + 0x540]
lea edx, [rax - 3]
mov rcx, qword [rcx + 0x58]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0x160]
test rcx, rcx
je 0x180030a3f
call qword [sym.imp.ca_core.dll_Ordinal_23]
mov qword [rdi + 0x160], rsi
mov rcx, rdi
call fcn.1800310c0
mov rcx, qword [rdi + 0x588]
test rcx, rcx
je 0x180030a60
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [rdi + 0x588], rsi
mov rcx, qword [rdi + 0x5a0]
test rcx, rcx
je 0x180030a79
call qword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_]
mov qword [rdi + 0x5a0], rsi
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret