joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63e14660
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63e14759
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rcx, [rbx + 1]
test rcx, rcx
jle 0x63e14745
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp], rcx
nop dword [rax]
call dbg.main._cgo_cmalloc
xorps xmm15, xmm15
mov r14, qword [0x63f6feb0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x18]
cmp rcx, rdx
mov rbx, rdx
cmovl rdx, rcx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
cmp rdi, rsi
jne 0x63e146f3
cmp rcx, rbx
jmp 0x63e14728
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rsi
mov rax, rsi
mov rbx, rdi
mov rcx, rdx
call dbg.runtime.memmove
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x18]
cmp rax, rcx
mov rbx, rcx
mov rsi, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x20]
jae 0x63e14738
mov byte [rsi + rcx], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rcx
mov rcx, rbx
nop
call dbg.runtime.panicIndex
lea rax, [0x63e3f300]
lea rbx, [0x63e8ec30]
call dbg.runtime.gopanic
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call dbg.runtime.morestack_noctxt
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp dbg.main._Cfunc_CString

Function at 0x63e16ed0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
test rax, rax
mov qword [0x63f73ef0], rax
je 0x63e16f05
lea rcx, [0x63f73f00]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x3d
mov edx, 1
lea rcx, str.runtime:_failed_to_create_runtime_initialization_wait_event._n
mov r9, rax
call sym.fwrite
call sym.abort
nop

Function at 0x63e17080
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call sym._cgo_maybe_run_preinit
lea rcx, [0x63f73f00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [0x63f73f00]
mov dword [0x63f73ee8], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x63f73ef0]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x63e170c3
add rsp, 0x28
ret
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x3b
mov edx, 1
lea rcx, str.runtime:_failed_to_signal_runtime_initialization_complete._n
mov r9, rax
call sym.fwrite
call sym.abort
nop
nop
Function at 0x63e171f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x18
call sym.malloc
test rax, rax
je 0x63e1722a
mov rdx, qword [rbx]
mov rcx, rax
mov qword [rax], rdx
mov rdx, qword [rbx + 8]
mov qword [rax + 8], rdx
mov rdx, qword [rbx + 0x10]
mov qword [rax + 0x10], rdx
add rsp, 0x20
pop rbx
jmp dbg._cgo_sys_thread_start
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x2b
mov edx, 1
lea rcx, str.runtime_cgo:_out_of_memory_in_thread_start_n
mov r9, rax
call sym.fwrite
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x63e172b0
Capabilities:
Create thread

Disassembly:
mov rdx, rcx
lea rcx, [dbg.threadentry]
jmp sym._cgo_beginthread

Function at 0x63e17690
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x63f74504]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x63e17818
mov rax, qword [0x63f74508]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x63e176dc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x63e17765
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x63e176c0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x63e1784d
mov rax, qword [0x63f74508]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x63f74508]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x63e17830
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x63e1775e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x63e177c0
add dword [0x63f74504], 1
cmp edi, 8
jae 0x63e17793
test dil, 4
jne 0x63e17804
test edi, edi
je 0x63e17788
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x63e1781f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x63e17788
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x63e177ac
jmp 0x63e17788
add rsi, qword [0x63f74508]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x63e1775e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x63e17788
xor esi, esi
jmp 0x63e176e7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x63e17788
mov rax, qword [0x63f74508]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]
Function at 0x63e17fa0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x63f747e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x63f747c0]
test rbx, rbx
je 0x63e17ff4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x63e17feb
test rsi, rsi
je 0x63e17feb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x63e17fd0
lea rcx, [0x63f747e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x63e18230
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x63e18240
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x63e18250
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x63e18291
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x63e18288
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x63e18293
add rax, 0x28
cmp rax, r9
jne 0x63e18274
xor eax, eax
ret

Function at 0x63e18330
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x63f174f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x63e1839d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x63e1839d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x63e1839d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x63e18394
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x63e1839f
add rax, 0x28
cmp rax, r9
jne 0x63e18380
xor eax, eax
add rsp, 0x28
ret

Function at 0x63e184a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x63f174f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x63e184c0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x63e184b8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x63e1851d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x63e18514
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x63e18524
add rax, 0x28
cmp rax, r9
jne 0x63e18500
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x63e18540
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x63f174f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x63e185ae
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x63e185ae
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x63e185ae
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x63e185ae
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x63e185a5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x63e185b5
add rcx, 0x28
cmp rcx, rax
jne 0x63e18590
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x63e185c8
jmp 0x63e185ae
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x63e185d6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x63e185ae
test r9d, r9d
jg 0x63e185c0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret

Function at 0x63e18a40
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1800128d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18008d080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
lea rcx, str.cfg_Hx.cfg
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180012954
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 0x10c0
lea rdx, [0x18008d110]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
test eax, eax
jne 0x180012969
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180059520
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180059520
add rsp, 0x50
pop rbx
ret

Function at 0x180012990
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18008d080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], 0
lea rcx, str.cfg_Hx.cfg
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180012a23
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x10c0
jne 0x180012a38
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, eax
lea rdx, [0x18008d110]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180012a38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180059520
add rsp, 0x50
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180059520
add rsp, 0x50
pop rbx
ret

Function at 0x180012ed0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x180012ee0
xor eax, eax
add rsp, 0x38
ret
mov eax, 0x345a
cmp word [rcx], ax
jne 0x180012f09
xor eax, eax
lea r8, [0x180012e50]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180017580
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x18001765b
nop dword [rax]
cmp rbx, qword [section..data]
jb 0x1800175ce
cmp rbx, qword [0x18008d008]
ja 0x1800175ce
sub rbx, 0x8000000
jmp 0x180017652
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18001765b
cmp dword [rsp + 0x40], 0x10000
jne 0x180017636
cmp qword [rsp + 0x38], 0x10000
jb 0x180017636
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x18001765d
sub rbx, 0x10000
jmp 0x180017652
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x1800175b0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180017670
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x180017692
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x18001774d
nop dword [rax + rax]
cmp rbx, qword [section..data]
jb 0x1800176be
cmp rbx, qword [0x18008d008]
ja 0x1800176be
add rbx, 0x8000000
jmp 0x180017744
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18001774d
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x180017729
cmp rcx, 0x10000
jb 0x180017729
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x18001774f
add rbx, 0x10000
jmp 0x180017744
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x180017744
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x1800176a0
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180017760
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x180017782
mov edi, 0x80000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x18001779e
mov rsi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x1800177b5
cmp byte [rcx + 1], 0x25
jne 0x1800177f9
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x1800177c1
cmp al, 0xe9
jne 0x1800177f9
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, rbx
cmp rcx, rbx
jae 0x1800177e4
cmp rcx, 0xffffffff80000000
jae 0x1800177db
lea rsi, [rcx + 0x7ff80000]
jmp 0x1800177f9
mov rsi, 0xfffffffffff80000
jmp 0x1800177f9
lea rdi, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x1800177f9
mov edi, 0x80000
mov rdx, qword [0x18008e4c8]
mov rax, qword [0x18008e4c0]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x180017820
test rax, rax
je 0x180017837
mov rdx, rax
mov qword [0x18008e4c8], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x180017837
cmp rcx, rdi
jb 0x180017837
cmp rcx, rsi
jbe 0x18001798a
mov qword [0x18008e4c8], rax
mov rdx, rax
test rax, rax
je 0x180017882
mov rcx, rax
nop dword [rax]
test rax, rax
je 0x18001786c
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x18001786c
cmp rax, rdi
jb 0x18001786c
cmp rax, rsi
jbe 0x18001798a
mov rdx, qword [rdx + 8]
mov qword [0x18008e4c8], rdx
mov rcx, rdx
mov rax, rdx
test rdx, rdx
jne 0x180017850
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x1800178ac
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.180017580
mov rdx, rax
test rax, rax
jne 0x180017938
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x1800178d2
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.180017670
mov rdx, rax
test rax, rax
jne 0x180017938
cmp rbx, 0x40000000
jbe 0x1800178f2
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.180017670
mov rdx, rax
test rax, rax
jne 0x180017938
cmp rbx, rbp
jae 0x18001790e
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.180017580
mov rdx, rax
test rax, rax
jne 0x180017938
mov rdx, rbx
mov rcx, rdi
call fcn.180017580
mov rdx, rax
test rax, rax
jne 0x180017938
mov rdx, rsi
mov rcx, rbx
call fcn.180017670
mov rdx, rax
test rax, rax
je 0x1800179c1
mov dword [rdx], 0x52727464
lea rcx, [rdx + 0xffa8]
xor r8d, r8d
mov qword [0x18008e4c8], rdx
mov qword [rdx + 0x10], r8
mov r9d, 0x2a7
mov rax, qword [0x18008e4c0]
mov qword [rdx + 8], rax
lea rax, [rdx + 0xff60]
mov qword [0x18008e4c0], rdx
mov qword [rcx], r8
lea rcx, [rcx - 0x60]
mov r8, rax
sub rax, 0x60
sub r9, 1
jne 0x180017972
mov qword [rdx + 0x10], r8
mov rax, qword [rdx + 0x10]
cmp rax, rdi
jb 0x1800179c1
cmp rax, rsi
ja 0x1800179c1
mov rcx, qword [rax + 0x48]
movdqa xmm0, xmmword [0x18005c6c0]
mov qword [rdx + 0x10], rcx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp 0x1800179c3
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180017c10
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x180017c3e
xor al, al
jmp 0x180017c80
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x180017c4f
xor al, al
jmp 0x180017c80
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x180017c76
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x180017c76
mov al, 1
jmp 0x180017c80
xor al, al
add rsp, 0x50
pop rbx
ret
add rsp, 0x50
pop rbx
ret
Function at 0x180018160
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
cmp dword [0x18008e4d8], 0
jne 0x180018207
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x18008e4d8], ecx
jne 0x180018207
mov qword [rsp + 0x38], rbx
mov rbx, qword [0x18008e4c0]
mov qword [rsp + 0x20], rdi
xor edi, edi
mov qword [0x18008e4f0], rdi
mov qword [0x18008e4e8], rdi
mov qword [0x18008e4e0], rdi
test rbx, rbx
je 0x1800181f0
nop word [rax + rax]
lea r9, [rsp + 0x30]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800181e8
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1800181c0
jmp 0x1800181f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x38]
mov eax, edi
mov dword [0x18008e4dc], edi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, 0x10dd
add rsp, 0x28
ret
Function at 0x180018820
Capabilities:
Suspend thread

Disassembly:
push rdi
sub rsp, 0x20
mov eax, dword [0x18008e4dc]
mov rdi, rcx
test eax, eax
jne 0x1800188c5
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
jne 0x18001884a
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rbx
call fcn.180059540
mov rbx, rax
test rax, rax
jne 0x180018868
mov edi, 8
jmp 0x18001888b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1800188a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov edx, 0x10
mov rcx, rbx
call fcn.1800595a8
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov dword [0x18008e4dc], edi
mov qword [0x18008e4e0], 0
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x18008e4e8]
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rdi
mov qword [0x18008e4e8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18002ed30
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
xor ecx, ecx
jmp fcn.18002ed40

Function at 0x18002ed40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18008d080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x18008e500]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4dc5], 0
jne 0x18002eda8
cmp byte [rbx + 0x4dc6], 0
jne 0x18002eda8
movsx r9d, word [rbx + 0x5fe8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1800344c0
test sil, 2
je 0x18002eee0
jmp 0x18002ee41
movss xmm1, dword [rbx + 0x39e0]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x18005e6d8]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x1800842c0]
addss xmm0, dword [rbx + 0x110]
addss xmm1, dword [rbx + 0x114]
or dword [rbx + 0x4a90], 1
mov qword [rbx + 0x4aa8], rax
movss dword [rbx + 0x4aa0], xmm0
mov dword [rbx + 0x4a94], 1
movss dword [rbx + 0x4aa4], xmm1
movss xmm0, dword [rbx + 0x3a3c]
mov rax, qword [0x18008e500]
mulss xmm0, dword [0x18005c928]
or dword [rax + 0x4a90], 0x40
movss dword [rax + 0x4af0], xmm0
movsx r9d, word [rbx + 0x5fe8]
call fcn.1800344c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x18002ee91
lea r11, [0x18005cec0]
cmp r9b, 0x23
jne 0x18002ee74
cmp byte [r8], r9b
jne 0x18002ee74
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18002ee61
not ecx
call fcn.180032a70
test rax, rax
je 0x18002eee0
cmp byte [rax + 0xca], 0
je 0x18002eee0
mov byte [rax + 0xcf], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xec], 1
mov edx, 0x10
inc word [rbx + 0x5fe8]
movsx r9d, word [rbx + 0x5fe8]
call fcn.1800344c0
or edi, 0x2030347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.18002c210
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180059520
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1800329d0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x18008e500]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180032a33
mov qword [rsp], rbx
lea rbx, [0x18005cec0]
nop dword [rax]
cmp r9b, 0x23
jne 0x180032a13
cmp byte [r8], r9b
jne 0x180032a13
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180032a00
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x60b0]
not eax
mov r8, qword [r10 + 0x60b8]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x180032a5f
cmp dword [r8 + 8], eax
je 0x180032a66
add r8, 0x48
cmp r8, rcx
jne 0x180032a50
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret