joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000cf30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rsi, rdx
mov ecx, dword [0x18008ec90]
movzx r15d, cl
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rdx, 0x100000001b3
imul r15, rdx
movzx eax, byte [0x18008ec91]
xor r15, rax
imul r15, rdx
movzx eax, byte [0x18008ec92]
xor r15, rax
imul r15, rdx
movzx eax, byte [0x18008ec93]
xor r15, rax
imul r15, rdx
mov rax, qword [0x180091050]
and rax, r15
add rax, rax
mov rdx, qword [0x180091038]
mov rbx, qword [rdx + rax*8 + 8]
mov r14, qword [0x180091028]
cmp rbx, r14
jne 0x18000cfc5
mov rbx, r14
mov rbp, r14
jmp 0x18000d005
mov rax, qword [rdx + rax*8]
cmp ecx, dword [rbx + 0x10]
je 0x18000cfde
nop
cmp rbx, rax
je 0x18000cfff
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
jne 0x18000cfd0
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [0x180091030], rax
je 0x18000d186
lea rax, [0x180091028]
mov qword [rsp + 0x20], rax
xor r12d, r12d
mov qword [rsp + 0x28], r12
lea ecx, [r12 + 0x20]
call fcn.1800402d0
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [0x18008ec90]
mov dword [rdi + 0x10], eax
mov qword [rdi + 0x18], r12
mov rdx, qword [0x180091030]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x18000d069
cvtsi2ss xmm0, rcx
jmp 0x18000d07e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x180091058]
xorps xmm1, xmm1
test rcx, rcx
js 0x18000d094
cvtsi2ss xmm1, rcx
jmp 0x18000d0a9
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x180091020]
seta al
test al, al
je 0x18000d119
call fcn.18000e2b0
mov rcx, qword [0x180091050]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x180091038]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x180091028]
cmp rax, rbx
je 0x18000d105
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x18000d102
mov rbx, rax
cmp rax, rdx
je 0x18000d15c
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18000d0f1
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov rdx, qword [0x180091030]
mov r8, qword [rbx + 8]
inc rdx
mov qword [0x180091030], rdx
mov qword [rdi], r14
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x180091038]
mov rax, qword [0x180091050]
and rax, r15
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x180091028]
jne 0x18000d163
mov qword [rcx + rax*8], rdi
jmp 0x18000d175
mov qword [rsp + 0x20], rax
jmp 0x18000d10a
cmp rdx, rbp
jne 0x18000d16e
mov qword [rcx + rax*8], rdi
jmp 0x18000d17a
cmp qword [rcx + rax*8 + 8], r8
jne 0x18000d17a
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x18000cfe5
lea rcx, str.unordered_map_set_too_long
call fcn.18003f1e4
int3
Function at 0x18000e2b0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180091030]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180091058]
js 0x18000e2d4
cvtsi2ss xmm0, rcx
jmp 0x18000e2e9
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180091020]
call fcn.18006b324
movss xmm1, dword [0x180083218]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000e31b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000e31b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000e34d
cmp rbx, 0x200
jae 0x18000e34a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18000e34d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x18000e360
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18000e50e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180091028]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180091038]
lea rdx, [rdi + rdi]
call fcn.18000c600
mov rax, qword [0x180091028]
lea r9, [rdi - 1]
mov qword [0x180091050], r9
mov qword [0x180091058], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18000e503
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180091038]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18000e44f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18000e4c4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000e48c
mov r10, qword [rdx]
cmp r10, rax
je 0x18000e486
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18000e4c4
cmp r9, rdx
je 0x18000e4a0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18000e4d8
cmp r9, rdx
jne 0x18000e491
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18000e4fe
mov r9, qword [0x180091050]
jmp 0x18000e400
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000e4c4
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18003f1e4
int3
Function at 0x18000e360
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180091030]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180091058]
js 0x18000e2d4
cvtsi2ss xmm0, rcx
jmp 0x18000e2e9
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180091020]
call fcn.18006b324
movss xmm1, dword [0x180083218]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000e31b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000e31b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000e34d
cmp rbx, 0x200
jae 0x18000e34a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18000e34d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x18000e360
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18000e50e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180091028]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180091038]
lea rdx, [rdi + rdi]
call fcn.18000c600
mov rax, qword [0x180091028]
lea r9, [rdi - 1]
mov qword [0x180091050], r9
mov qword [0x180091058], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18000e503
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180091038]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18000e44f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18000e4c4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000e48c
mov r10, qword [rdx]
cmp r10, rax
je 0x18000e486
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18000e4c4
cmp r9, rdx
je 0x18000e4a0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18000e4d8
cmp r9, rdx
jne 0x18000e491
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18000e4fe
mov r9, qword [0x180091050]
jmp 0x18000e400
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000e4c4
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18003f1e4
int3
Function at 0x18000e7b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx r15d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
movzx eax, byte [r8 + 1]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 2]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 3]
xor r15, rax
imul r15, rcx
mov rcx, qword [0x180091050]
and rcx, r15
add rcx, rcx
mov rax, qword [0x180091038]
mov rbx, qword [rax + rcx*8 + 8]
mov r14, qword [0x180091028]
cmp rbx, r14
jne 0x18000e83c
mov rbx, r14
mov rbp, r14
jmp 0x18000e87d
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x18000e856
cmp rbx, rcx
je 0x18000e877
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x18000e848
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [0x180091030], rax
je 0x18000ea0f
lea rax, [0x180091028]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.1800402d0
mov rdi, rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [r12]
movups xmmword [rax + 0x10], xmm0
mov rdx, qword [0x180091030]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x18000e8de
cvtsi2ss xmm0, rcx
jmp 0x18000e8f3
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x180091058]
xorps xmm1, xmm1
test rcx, rcx
js 0x18000e909
cvtsi2ss xmm1, rcx
jmp 0x18000e91e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x180091020]
seta al
test al, al
je 0x18000e999
call fcn.18000e2b0
mov rcx, qword [0x180091050]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x180091038]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x180091028]
cmp rax, rbx
jne 0x18000e965
mov qword [rsp + 0x28], 0
jmp 0x18000e985
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x18000e982
mov rbx, rax
cmp rax, rdx
je 0x18000e9dc
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18000e971
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov rdx, qword [0x180091030]
mov r8, qword [rbx + 8]
inc rdx
mov qword [0x180091030], rdx
mov qword [rdi], r14
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x180091038]
mov rax, qword [0x180091050]
and rax, r15
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x180091028]
jne 0x18000e9ec
mov qword [rcx + rax*8], rdi
jmp 0x18000e9fe
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x18000e98a
cmp rdx, rbp
jne 0x18000e9f7
mov qword [rcx + rax*8], rdi
jmp 0x18000ea03
cmp qword [rcx + rax*8 + 8], r8
jne 0x18000ea03
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x18000e85d
lea rcx, str.unordered_map_set_too_long
call fcn.18003f1e4
int3
Function at 0x18000fe90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000feed
lea rbx, [0x18007e9b0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18000fed4
cmp r10, 2
jb 0x18000fed4
cmp byte [r9], r8b
jne 0x18000fed4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18000feb0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000ff2f
lea rbx, [0x18007e9b0]
cmp r8b, 0x23
jne 0x18000ff13
cmp byte [r9], r8b
jne 0x18000ff13
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18000ff00
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180010070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18001008a
mov qword [r8], 0
lea rdx, [0x18007e798]
call fcn.18000ff40
mov rbx, rax
test rax, rax
jne 0x1800100aa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.180052fa0
mov esi, eax
cmp eax, 0xffffffff
je 0x180010178
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1800524c4
test eax, eax
jne 0x180010178
mov rcx, rbx
call fcn.180052fa0
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180010178
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1800524c4
test eax, eax
jne 0x180010178
cmp rdi, 0xffffffffffffffff
je 0x180010178
mov rax, qword [0x180090e50]
test rax, rax
je 0x18001011a
inc dword [rax + 0x3b0]
mov rcx, rdi
call fcn.180053760
mov rsi, rax
test rax, rax
je 0x180010178
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18004f944
mov rcx, rbx
cmp rax, rdi
je 0x180010166
call fcn.18004ac20
mov rax, qword [0x180090e50]
test rax, rax
je 0x18001015c
dec dword [rax + 0x3b0]
mov rcx, rsi
call fcn.18004f428
jmp 0x180010180
call fcn.18004ac20
test r14, r14
je 0x180010173
mov qword [r14], rdi
mov rax, rsi
jmp 0x180010182
mov rcx, rbx
call fcn.18004ac20
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180015dd0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180015e20
lea r11, [0x18007e9b0]
nop dword [rax]
cmp r9b, 0x23
jne 0x180015e03
cmp byte [r8], r9b
jne 0x180015e03
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180015df0
mov rcx, qword [0x180090e50]
not eax
movsxd rdx, dword [rcx + 0x1be8]
mov r9, qword [rcx + 0x1bf0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180015e81
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180015e79
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x180015e7c
mov rdx, r8
test rdx, rdx
jne 0x180015e50
cmp r9, r10
je 0x180015e90
cmp dword [r9], eax
jne 0x180015e90
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x18003dde0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x18003de44
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18003de32
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18003de2b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18003ddff
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x180090e68]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18003de54
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, ecx
imul rdi, rax, 0x38
add rdi, qword [0x180091110]
mov rdx, qword [rdi]
mov cl, byte [rdi + 0x20]
mov rsi, rdx
lea rbx, [rdx - 5]
and cl, 1
je 0x18003de8d
mov rsi, rbx
movzx eax, cl
lea r9, [rsp + 0x38]
test cl, cl
mov r8d, 0x40
cmove rbx, rdx
lea rbp, [rax*2 + 5]
mov rcx, rbx
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18003dec0
mov eax, 0xa
jmp 0x18003df0d
mov byte [rbx], 0xe9
mov eax, dword [rdi + 8]
sub eax, esi
sub eax, 5
mov dword [rbx + 1], eax
test byte [rdi + 0x20], 1
je 0x18003dedc
mov rax, qword [rdi]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rdi + 0x20], 6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18003e1c0
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18003e1d7
cmp r8b, 0x90
je 0x18003e1d7
cmp r8b, 0xcc
jne 0x18003e1f9
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18003e1f5
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x18003e1f9
add edx, r10d
cmp edx, r9d
jb 0x18003e1e5
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x18003e560
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x18003e5aa
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x180091100]
lea r12, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r12
cmovbe r12, qword [rbp - 0x50]
sub r12, 0xfff
xor esi, esi
test rbx, rbx
je 0x18003e5e8
cmp rbx, r14
jb 0x18003e5e3
cmp rbx, r12
jae 0x18003e5e3
cmp qword [rbx + 8], rsi
jne 0x18003e73f
mov rbx, qword [rbx]
jmp 0x18003e5ca
mov r15, rdi
cmp rdi, r14
jb 0x18003e66c
mov r13d, dword [rbp - 0x38]
xor edx, edx
mov rax, r15
div r13
sub r15, rdx
sub r15, r13
cmp r15, r14
jb 0x18003e663
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003e663
cmp dword [rbp - 0x10], 0x10000
je 0x18003e633
mov r15, qword [rbp - 0x28]
cmp r15, r13
jb 0x18003e663
jmp 0x18003e5ff
test r15, r15
je 0x18003e663
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18003e704
cmp r15, r14
jae 0x18003e5f0
test rbx, rbx
jne 0x18003e704
cmp rdi, r12
ja 0x18003e73f
mov r15d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov r14d, r15d
div r15
mov eax, r15d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r12
ja 0x18003e73f
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003e73f
cmp dword [rbp - 0x10], 0x10000
je 0x18003e6da
xor edx, edx
lea edi, [r15 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div r14
sub rdi, rdx
cmp rdi, r12
jmp 0x18003e693
test rdi, rdi
je 0x18003e73f
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x18003e666
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], esi
mov edx, 0x40
mov qword [rcx], rsi
mov rax, rcx
mov qword [rbx + 8], rcx
add rdx, 0x40
add rcx, 0x40
mov rsi, rax
cmp rdx, 0xfc0
jbe 0x18003e710
mov rax, qword [0x180091100]
mov qword [rbx], rax
mov qword [0x180091100], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180052d20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.180040ea0
sub rsp, rax
mov rax, qword [0x18008e070]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.180058514
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x180052d6f
mov rax, rbp
jmp 0x180052e77
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x180000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x906d0]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.18005f7a4
mov r13, rax
lea rax, [0x180000000]
mov rcx, qword [rax + rbx*8 + 0x906d0]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x180052e73
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180052e73
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.18005f7a4
test rax, rax
js 0x180052e73
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x180052e73
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x180052e65
lea r8, [0x180000000]
cmp rcx, rdx
jae 0x180052e65
cmp byte [rcx], 0xd
jne 0x180052e4b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x180052e5a
cmp byte [rcx + 1], 0xa
jne 0x180052e5a
inc rcx
jmp 0x180052e5a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x8e460]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x180052e2d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x180052e77
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.180040040
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18005dd74
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x18005dda6
call fcn.18004e280
mov dword [rax], 0x16
call fcn.1800528e8
jmp 0x18005dec5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18005dec5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x18005dec5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x18005ddd5
lock or dword [rcx + 0x14], 0x10
jmp 0x18005dec5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x18005dde9
call fcn.18005df94
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.180058514
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.18005efcc
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x18005deb3
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x18005de7e
mov rcx, rsi
call fcn.180058514
cmp eax, edi
je 0x18005de69
mov rcx, rsi
call fcn.180058514
cmp eax, 0xfffffffe
je 0x18005de69
mov rcx, rsi
call fcn.180058514
movsxd rbx, eax
lea r14, [0x1800906d0]
mov rcx, rsi
sar rbx, 6
call fcn.180058514
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x18005de70
lea rdx, [0x18008e410]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18005de7e
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x18005dea2
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x18005dea2
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x18005dea2
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x18005dec8
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret