joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801205d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a6a]
test eax, eax
jne 0x18012062f
mov rax, qword [rbp + 0x1a0]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x18012062f
mov byte [0x180226a6a], 1
movzx eax, byte [0x180226a6a]
test eax, eax
je 0x1801206e2
mov rdx, qword [rbp + 0x1a8]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
nop
mov dword [rbp + 0x164], 1
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x148]
call fcn.1801188f0
mov rcx, rax
call fcn.18011b430
nop
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x1801206a7
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x1801206e2
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1801206e0
mov rax, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a6a], 0
jmp 0x18012069b
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x1801208c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a3f]
test eax, eax
jne 0x18012091f
mov rax, qword [rbp + 0x160]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x18012091f
mov byte [0x180226a3f], 1
movzx eax, byte [0x180226a3f]
test eax, eax
je 0x1801209b9
mov rdx, qword [rbp + 0x168]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x18012094f
mov byte [0x180226a3f], 0
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x18012097e
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x1801209b9
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1801209b7
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a3f], 0
jmp 0x180120972
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1801216a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a6b]
test eax, eax
jne 0x1801216ff
mov rax, qword [rbp + 0x1a0]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x1801216ff
mov byte [0x180226a6b], 1
movzx eax, byte [0x180226a6b]
test eax, eax
je 0x1801217b2
mov rdx, qword [rbp + 0x1a8]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
nop
mov dword [rbp + 0x164], 1
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x148]
call fcn.1801188f0
mov rcx, rax
call fcn.18011b430
nop
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x180121777
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x1801217b2
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1801217b0
mov rax, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a6b], 0
jmp 0x18012176b
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x180121c80
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a6c]
test eax, eax
jne 0x180121cdf
mov rax, qword [rbp + 0x160]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x180121cdf
mov byte [0x180226a6c], 1
movzx eax, byte [0x180226a6c]
test eax, eax
je 0x180121d79
mov rdx, qword [rbp + 0x168]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x180121d0f
mov byte [0x180226a6c], 0
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x180121d3e
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x180121d79
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x180121d77
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a6c], 0
jmp 0x180121d32
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x180122e90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a3c]
test eax, eax
jne 0x180122eef
mov rax, qword [rbp + 0x1a0]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x180122eef
mov byte [0x180226a3c], 1
movzx eax, byte [0x180226a3c]
test eax, eax
je 0x180122fa2
mov rdx, qword [rbp + 0x1a8]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
nop
mov dword [rbp + 0x164], 1
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x148]
call fcn.1801188f0
mov rcx, rax
call fcn.18011b430
nop
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x180122f67
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x180122fa2
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x180122fa0
mov rax, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a3c], 0
jmp 0x180122f5b
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x180123900
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a3e]
test eax, eax
jne 0x18012395f
mov rax, qword [rbp + 0x1a0]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x18012395f
mov byte [0x180226a3e], 1
movzx eax, byte [0x180226a3e]
test eax, eax
je 0x180123a12
mov rdx, qword [rbp + 0x1a8]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
nop
mov dword [rbp + 0x164], 1
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x148]
call fcn.1801188f0
mov rcx, rax
call fcn.18011b430
nop
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x1801239d7
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x180123a12
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x180123a10
mov rax, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a3e], 0
jmp 0x1801239cb
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180127330
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a6d]
test eax, eax
jne 0x18012738f
mov rax, qword [rbp + 0x160]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x168]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x18012738f
mov byte [0x180226a6d], 1
movzx eax, byte [0x180226a6d]
test eax, eax
je 0x180127429
mov rdx, qword [rbp + 0x168]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x1801273bf
mov byte [0x180226a6d], 0
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x1801273ee
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x180127429
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x180127427
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a6d], 0
jmp 0x1801273e2
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x180127440
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a3d]
test eax, eax
jne 0x18012749f
mov rax, qword [rbp + 0x1a0]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x18012749f
mov byte [0x180226a3d], 1
movzx eax, byte [0x180226a3d]
test eax, eax
je 0x180127552
mov rdx, qword [rbp + 0x1a8]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
nop
mov dword [rbp + 0x164], 1
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x148]
call fcn.1801188f0
mov rcx, rax
call fcn.18011b430
nop
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x180127517
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x180127552
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x180127550
mov rax, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a3d], 0
jmp 0x18012750b
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180128410
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a68]
test eax, eax
jne 0x18012846f
mov rax, qword [rbp + 0x1a0]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x18012846f
mov byte [0x180226a68], 1
movzx eax, byte [0x180226a68]
test eax, eax
je 0x180128522
mov rdx, qword [rbp + 0x1a8]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
nop
mov dword [rbp + 0x164], 1
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x148]
call fcn.1801188f0
mov rcx, rax
call fcn.18011b430
nop
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x1801284e7
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x180128522
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x180128520
mov rax, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a68], 0
jmp 0x1801284db
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret

Function at 0x180128e00
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rcx, [0x180238882]
call fcn.180141e90
nop
movzx eax, byte [0x180226a69]
test eax, eax
jne 0x180128e5f
mov rax, qword [rbp + 0x1a0]
movsxd rax, dword [rax]
lea rcx, [0x18021dd90]
mov rdx, qword [rbp + 0x1a8]
mov rcx, qword [rcx + rax*8]
call fcn.1800e5be0
movzx eax, al
test eax, eax
je 0x180128e5f
mov byte [0x180226a69], 1
movzx eax, byte [0x180226a69]
test eax, eax
je 0x180128f12
mov rdx, qword [rbp + 0x1a8]
lea rcx, str.Tus_Ata
call fcn.1800e5be0
nop
mov dword [rbp + 0x164], 1
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x148]
call fcn.1801188f0
mov rcx, rax
call fcn.18011b430
nop
lea rax, [0x18018f930]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 8]
add rax, 0x298
mov qword [rbp + 0x48], rax
jmp 0x180128ed7
mov rax, qword [rbp + 0x28]
add rax, 4
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x48]
cmp qword [rbp + 0x28], rax
je 0x180128f12
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x68]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x180128f10
mov rax, qword [rbp + 0x1a0]
mov rcx, qword [rbp + 0x68]
mov ecx, dword [rcx]
mov dword [rax], ecx
mov byte [0x180226a69], 0
jmp 0x180128ecb
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180134d30
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x6b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x112
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x6d8]
mov rax, qword [0x18021f4c0]
xor rax, rbp
mov qword [rbp + 0x678], rax
lea rcx, [0x180239962]
call fcn.180141e90
nop
lea rax, [rbp + 0x10]
mov rdi, rax
xor eax, eax
mov ecx, 0x400
rep stosb byte [rdi], al
mov dword [rbp + 0x424], 0
mov dword [rsp + 0x20], 2
lea r9, [rbp + 0x424]
mov r8d, 0x400
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x6a0]
call sub.KERNEL32.dll_K32EnumProcessModulesEx
nop
mov eax, dword [rbp + 0x424]
xor edx, edx
mov ecx, 8
div rcx
mov dword [0x1802284a0], eax
lea rcx, [rbp - 0x30]
lea rdx, [0x180194920]
call fcn.180141c60
mov rcx, qword [rbp + 0x678]
xor rcx, rbp
call fcn.1801420e0
lea rsp, [rbp + 0x688]
pop rdi
pop rbp
ret
Function at 0x180135040
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x18021f4c0]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x180239960]
call fcn.180141e90
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x1801350a7
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1801350ae
mov al, 1
jmp 0x18013521e
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.180010ec0
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.180010ec0
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.180010ef0
movzx eax, al
test eax, eax
je 0x180135111
xor al, al
jmp 0x18013521e
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x180135184
cmp dword [rbp + 0x160], 1
je 0x18013518f
cmp dword [rbp + 0x160], 3
je 0x18013520d
jmp 0x18013521c
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1801351df
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1801351df
xor al, al
jmp 0x18013521e
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1801351fa
mov dword [rbp + 0x154], 1
jmp 0x180135204
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x18013521e
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x18013521e
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1801952c0]
call fcn.180141c60
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.1801420e0
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180138100
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x180239960]
call fcn.180141e90
nop
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x180138158
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x18013826a
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x180138203
cmp qword [rbp + 0x28], 0
jle 0x180138203
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1801381a1
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.18000f090
nop
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rbp + 0x130], 0
jle 0x180138259
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x180138259
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x18013c220
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
cmp dword [0x180229650], 0
je 0x18013c234
xor eax, eax
jmp 0x18013c49d
cmp qword [0x180229648], 0
je 0x18013c24a
mov rax, qword [0x180229648]
jmp 0x18013c49d
mov r8d, 0x48
xor edx, edx
lea rcx, [0x180229600]
call sub.VCRUNTIME140D.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x180229600], rax
xor r8d, r8d
xor edx, edx
lea rcx, [0x180195de8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x180229608], rax
cmp qword [0x180229608], 0
jne 0x18013c303
mov dword [0x180229650], 1
cmp qword [0x180229608], 0
je 0x18013c2af
mov rcx, qword [0x180229608]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x180229610], 0
mov qword [0x180229618], 0
mov qword [0x180229620], 0
mov qword [0x180229628], 0
mov qword [0x180229630], 0
mov qword [0x180229638], 0
mov qword [0x180229640], 0
xor eax, eax
jmp 0x18013c49d
lea rdx, str.ImagehlpApiVersionEx
mov rcx, qword [0x180229608]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180229610], rax
lea rdx, str.SymInitialize
mov rcx, qword [0x180229608]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180229618], rax
lea rdx, str.SymSetOptions
mov rcx, qword [0x180229608]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180229620], rax
lea rdx, str.SymGetOptions
mov rcx, qword [0x180229608]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180229628], rax
lea rdx, str.SymLoadModule64
mov rcx, qword [0x180229608]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180229630], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, qword [0x180229608]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180229638], rax
lea rdx, str.SymFromName
mov rcx, qword [0x180229608]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180229640], rax
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x28]
call sub.VCRUNTIME140D.dll_memset
mov eax, recv
mov word [rsp + 0x28], ax
cmp qword [0x180229610], 0
je 0x18013c40e
cmp qword [0x180229618], 0
je 0x18013c40e
cmp qword [0x180229630], 0
je 0x18013c40e
cmp qword [0x180229638], 0
je 0x18013c40e
cmp qword [0x180229640], 0
jne 0x18013c413
jmp 0x18013c28e
lea rcx, [rsp + 0x28]
call qword [0x180229610]
movzx eax, word [rsp + 0x28]
cmp eax, 0xc
jge 0x18013c42d
jmp 0x18013c28e
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x180229600]
call qword [0x180229618]
test eax, eax
jne 0x18013c448
jmp 0x18013c28e
cmp qword [0x180229628], 0
je 0x18013c488
cmp qword [0x180229620], 0
je 0x18013c488
call qword [0x180229628]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0xfffffff8
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
or eax, 0x2704
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x20]
call qword [0x180229620]
lea rax, [0x180229600]
mov qword [0x180229648], rax
mov rax, qword [0x180229648]
add rsp, 0x38
ret