joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002eccc
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18002ed26
mov r11b, 0x23
lea rdi, [0x180085bc0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x18002ed10
cmp rdx, 2
jb 0x18002ed10
cmp byte [r10], r11b
jne 0x18002ed10
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x18002ecee
jmp 0x18002ed67
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18002ed67
mov r11b, 0x23
lea rdi, [0x180085bc0]
cmp dl, r11b
jne 0x18002ed4b
cmp byte [r10], r11b
jne 0x18002ed4b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x18002ed39
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x18002ee9c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x18002eebc
and qword [r8], 0
lea rdx, [0x18008ab84]
call fcn.18002ed78
mov rbx, rax
test rax, rax
je 0x18002efad
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18002efa4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18002efa4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18002efa4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18002efa4
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x18002efa4
mov rax, qword [0x18010e360]
test rax, rax
je 0x18002ef41
inc dword [rax + 0x3bc]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x18002efa4
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x18002ef91
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18010e360]
test rax, rax
je 0x18002ef86
dec dword [rax + 0x3bc]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18002efad
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x18002ef9f
mov qword [rsi], rbp
mov rax, rdi
jmp 0x18002efaf
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180030a10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
movsxd rdx, dword [rcx + 0xc0]
mov r9d, 4
mov rax, qword [rcx + 0xc8]
mov r8d, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x38]
not r8d
movzx eax, byte [rdx]
inc rdx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x180085bc0]
xor r8d, dword [rax + rcx*4]
sub r9, 1
jne 0x180030a39
not r8d
mov ecx, r8d
call fcn.180030c24
mov eax, r8d
add rsp, 0x28
ret
Function at 0x180030a70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18009a020]
xor rax, rsp
mov qword [rsp + 0x30], rax
movss xmm0, dword [rdx]
mov r8, rcx
subss xmm0, dword [rcx + 0x10]
movss xmm1, dword [rdx + 8]
mov r9d, 0x10
subss xmm1, dword [rcx + 0x10]
cvttss2si eax, xmm0
movss xmm0, dword [rdx + 4]
subss xmm0, dword [rcx + 0x14]
mov dword [rsp + 0x20], eax
cvttss2si eax, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm0, dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0xc0]
mov dword [rsp + 0x24], eax
cvttss2si eax, xmm1
mov dword [rsp + 0x28], eax
cvttss2si eax, xmm0
mov dword [rsp + 0x2c], eax
mov rax, qword [r8 + 0xc8]
lea r8, [rsp + 0x20]
mov edx, dword [rax + rcx*4 - 4]
not edx
movzx eax, byte [r8]
inc r8
movzx ecx, dl
xor rcx, rax
shr edx, 8
lea rax, [0x180085bc0]
xor edx, dword [rax + rcx*4]
sub r9, 1
jne 0x180030aec
not edx
mov ecx, edx
call fcn.180030c24
mov eax, edx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18007f4c0
add rsp, 0x48
ret
Function at 0x1800383e4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18009a020]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x18010e360]
mov r10d, 8
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + 0x1a80]
movsxd rcx, dword [r9 + 0xc0]
mov rax, qword [r9 + 0xc8]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x20]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x180085bc0]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x18003842b
not r8d
lea rdx, [rsp + 0x20]
lea rcx, [r9 + 0xc0]
mov dword [rsp + 0x20], r8d
call fcn.18003e7f8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18007f4c0
add rsp, 0x38
ret

Function at 0x180038478
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x38
mov rax, qword [0x18009a020]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x18010e360]
mov r10d, 4
mov dword [rsp + 0x20], ecx
mov r9, qword [rax + 0x1a80]
movsxd rcx, dword [r9 + 0xc0]
mov rax, qword [r9 + 0xc8]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x20]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x180085bc0]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x1800384be
not r8d
lea rdx, [rsp + 0x20]
lea rcx, [r9 + 0xc0]
mov dword [rsp + 0x20], r8d
call fcn.18003e7f8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18007f4c0
add rsp, 0x38
ret

Function at 0x18003d268
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x18010e360]
cmp byte [rbx + 0x3080], 0
je 0x18003d329
cmp qword [rbx + 0x3088], 0
lea rbp, [rax + 0x10]
lea rdi, [rbx + 0x3090]
je 0x18003d31b
mov r9d, dword [rdi + 4]
test r9d, r9d
jns 0x18003d2d3
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18003eb28
mov rcx, qword [rsp + 0x40]
and dword [rdi], 0
mov rdx, rcx
mov rcx, rdi
mov r8, rbp
call fcn.18002f818
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3088]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x18010e358]
movsxd r8, eax
mov rax, qword [rbx + 0x3098]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18003d329
mov rdx, rcx
mov r8, rbp
mov rcx, rdi
call fcn.18002f818
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x18003d940
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x18010e360]
mov rbx, rcx
and dword [rax + 0x304c], 0
test rcx, rcx
je 0x18003d9a9
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.18003d9b4
lea rdx, [0x18008ab88]
mov rcx, rbx
mov rdi, rax
call fcn.18002ed78
mov rbx, rax
test rax, rax
je 0x18003d9a9
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18006b2a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x18006b2d0
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x18006b348
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x18006b2e7
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18006b2e9
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18006b342
test ecx, ecx
jle 0x18006b322
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18006b342
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18006b342
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x18006b364
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18006b384
xor eax, eax
jmp 0x18006b46d
cmp qword [rcx + 0x68], 0
je 0x18006b396
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x18006b46d
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18006b3ad
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18006b3af
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18006b3e1
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18006b467
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18006b418
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18006b442
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x18006b467
cmp rdi, rbx
ja 0x18006b41f
test rdi, rdi
je 0x18006b467
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18006b83c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18009a020]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x18006b875
xor eax, eax
jmp 0x18006b995
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x18006b8af
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x18006b8af
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x18006b995
cmp qword [rbx + 0x80], 0
je 0x18006b993
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18006b8ea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18006b90b
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x18006b990
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18006b959
sub eax, 1
je 0x18006b959
cmp eax, 2
jne 0x18006b993
movsx ecx, byte [rbp - 0x30]
jmp 0x18006b8f7
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x18006b984
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x18006b993
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18007f4c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18006c114
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x18009a020]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18006c183
cmp byte [rcx + 0x71], 0
je 0x18006c183
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18006c1d8
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18006c19d
sub eax, 1
je 0x18006c1a1
cmp eax, 2
jne 0x18006c1d8
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18007f4c0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18006c1cf
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18006c1d8
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18006c185
xor al, al
jmp 0x18006c185

Function at 0x18007b200
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18007b420
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18007b307
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18007b264
mov rax, qword [0x18009a008]
cmp qword [rsp + 0x20], rax
ja 0x18007b264
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007b226
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18007b293
jmp 0x18007b307
cmp dword [rsp + 0x50], 0x10000
jne 0x18007b2ea
cmp qword [rsp + 0x48], 0x10000
jb 0x18007b2ea
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007b2d8
mov rax, qword [rsp + 0x28]
jmp 0x18007b309
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18007b302
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18007b420
mov qword [rsp + 0x20], rax
jmp 0x18007b226
xor eax, eax
add rsp, 0x68
ret
Function at 0x18007b310
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18007b460
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18007b413
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18007b36b
mov rax, qword [0x18009a008]
cmp qword [rsp + 0x20], rax
ja 0x18007b36b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007b32d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18007b39a
jmp 0x18007b413
cmp dword [rsp + 0x50], 0x10000
jne 0x18007b3f1
cmp qword [rsp + 0x48], 0x10000
jb 0x18007b3f1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007b3df
mov rax, qword [rsp + 0x28]
jmp 0x18007b415
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18007b40e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18007b460
mov qword [rsp + 0x20], rax
jmp 0x18007b32d
xor eax, eax
add rsp, 0x68
ret
Function at 0x18007b4b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18007ba40
mov qword [rsp + 0x28], 0
cmp qword [0x18010d848], 0
jne 0x18007b4f8
cmp qword [0x18010d840], 0
je 0x18007b4f8
mov rax, qword [0x18010d840]
mov qword [0x18010d848], rax
cmp qword [0x18010d848], 0
je 0x18007b59e
mov rax, qword [0x18010d848]
cmp qword [rax + 0x10], 0
je 0x18007b59e
mov rax, qword [0x18010d848]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18007b59e
mov rax, qword [0x18010d848]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18007b59e
mov rax, qword [0x18010d848]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18007b564
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18007b56b
xor eax, eax
jmp 0x18007b719
mov rax, qword [0x18010d848]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x18007b719
mov rax, qword [0x18010d840]
mov qword [0x18010d848], rax
jmp 0x18007b5c0
mov rax, qword [0x18010d848]
mov rax, qword [rax + 8]
mov qword [0x18010d848], rax
cmp qword [0x18010d848], 0
je 0x18007b60d
cmp qword [0x18010d848], 0
je 0x18007b60b
mov rax, qword [0x18010d848]
cmp qword [rax + 0x10], 0
je 0x18007b60b
mov rax, qword [0x18010d848]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18007b60b
mov rax, qword [0x18010d848]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18007b60b
jmp 0x18007b53c
jmp 0x18007b5ae
mov rcx, qword [rsp + 0x60]
call fcn.18007d8c0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18007b720
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18007b717
mov rax, qword [rsp + 0x48]
mov qword [0x18010d848], rax
mov rax, qword [0x18010d848]
mov dword [rax], 0x52727464
mov rax, qword [0x18010d848]
mov qword [rax + 0x10], 0
mov rax, qword [0x18010d848]
mov rcx, qword [0x18010d840]
mov qword [rax + 8], rcx
mov rax, qword [0x18010d848]
mov qword [0x18010d840], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18010d848]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18007b6c8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18007b702
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18007b6be
mov rax, qword [0x18010d848]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18007b53c
xor eax, eax
add rsp, 0x58
ret
Function at 0x18007f3c8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18007f44c
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180083980]
cmp byte [rcx + rax], 0
je 0x18007f44c
dec r8
sub rdx, 1
jne 0x18007f432
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1404443ec
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs rsi, 0x180000000
jmp 0x1404444cc
mov r15b, byte [rsp]
xchg rsi, rdi
bsf r13, r15
mov bp, 0xd24c
call fcn.14044433f
lea rdx, [rcx + rcx]
lea rdi, [rsi + r15]
clc
jb 0x140444493
jae 0x14044447d
mov bl, 0xaa
invalid
bswap rax
rcr eax, 8
jmp 0x140444499
bswap rax
rcr eax, 8
dec r8d
lea rsi, [r15 + riz + 0xc]
jmp 0x1404444bb
mov r15b, 7
rdtsc
cmc
jmp 0x140444519
jmp 0x14044420c
mov edx, esp
dec r13d
jp 0x140444503
rdtsc
xchg r10b, r15b
jmp 0x140444541
rdtsc
jmp 0x14044453e
jl 0x1404444c7
jge 0x14044420c
mov ebx, dword [rsp]
btc r15d, edi
jl 0x140444561
jge 0x140444561
rol dword [rcx + 0x20], 1
shl dword [rdx - 0x3c], cl
push rdx
shl byte [rdi - 0x35ac19ae], 0x65
xchg esp, eax
invalid
xchg r10b, r15b
add r8, rsi
mov ebp, dword [rsp]
cpuid
jmp 0x140444521
xor r9w, 0x47e
jne 0x14044457f
mov r13b, r11b
bt bx, r8w
jmp fcn.140444569
add r8, qword [r14 + riz]
mov dl, 0x4c
jmp 0x14044454b
mov r13b, r11b
bt bx, r8w
jmp fcn.140444569

Function at 0x1404445f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushfq
dec r10d
jmp 0x1404446d8
jl 0x14044468e
jge 0x14044468e
add r15b, r12b
mov edx, dword [rsp]
mov bx, 0x168b
bsf cx, r11w
jmp 0x1404446f9
jno 0x14044470f
sub rsp, 0xe
lea rsp, [rsp + 6]
call fcn.140444762
xchg ebx, eax
or ah, byte [rbp + 0x48ee47d4]
sub esp, 0xe
sub rsp, 0xe
lea rsp, [rsp + 6]
mov r10b, r15b
jmp 0x140444e1a
inc r10b
mov edi, r15d
xchg bx, di
xchg r13w, dx
call fcn.1404447f3
and bl, byte [rbp - 0x54]
mov edi, 0x24148b66
mov dx, word [rsp]
xchg r13d, edi
mov r13d, 0x9ac58de8
xchg di, cx
mov si, 0xd0c1
jmp 0x1404447c7
lea rsp, [rsp + 7]
jmp 0x140444d04
mov bp, bx
rdtsc
pop qword [rsp + 7]
jmp 0x14044481e
setle bpl
mov bp, bx
rdtsc
pop qword [rsp + 7]
lea rsp, [rsp + 7]
lea rsp, [rsp + 0x10]
not r10b
xchg edi, eax
mov rsi, rdi
jmp 0x1404447dd
pushfq
sub rsp, 0x17
je 0x140444cf1
setle bpl
jmp 0x140444938

Function at 0x1404446b9
Capabilities:
Execute anti-debugging instructions

Disassembly:
setp cl
sub rsp, 9
jl 0x1404446f2
lea rsp, [rsp + 1]
jmp 0x1404446dc
lea rsp, [rsp + 1]
jmp 0x1404446dc