joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800144c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov byte [rsp + 0x22], 0x9c
movsx ax, byte [str.Unable_to_read_a_f]
mov word [rsp + 0x2c], ax
movzx eax, byte [0x1800c3290]
mov byte [rsp + 0x23], al
mov dword [rsp + 0x44], 0x7a
movsx ax, byte [0x1800c31ae]
mov word [rsp + 0x30], ax
movzx eax, byte [0x1800c322f]
movzx eax, al
mov dword [rsp + 0x48], eax
movzx eax, byte [0x1800c322b]
movsx rax, al
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x24], 3
movzx eax, byte [0x1800c322a]
mov word [rsp + 0x34], ax
mov dword [rsp + 0x4c], 0x22
mov byte [rsp + 0x25], 0xb6
mov eax, dword [0x1800c32a8]
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x70], 0xb55e
movzx eax, byte [0x1800c31ff]
mov word [rsp + 0x38], ax
mov dword [rsp + 0x54], 0x4539
mov rax, qword [0x1800c32d0]
mov word [rsp + 0x3c], ax
movzx eax, byte [0x1800c31ad]
mov byte [rsp + 0x20], al
mov byte [rsp + 0x26], 0x21
movzx eax, byte [0x1800c322a]
mov byte [rsp + 0x27], al
mov rax, qword [0x1800c3288]
mov byte [rsp + 0x28], al
movzx eax, byte [0x1800c3213]
mov byte [rsp + 0x21], al
mov byte [rsp + 0x29], 0x4e
movsx rax, word [0x1800c32ac]
mov qword [rsp + 0x78], rax
mov rax, qword [0x1800c3288]
mov byte [rsp + 0x2a], al
mov qword [rsp + 0x80], 0x6b046bb0
mov dword [rsp + 0x58], 0xf92ea46a
movzx eax, byte [0x1800c322b]
movsx rax, al
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], 0xf1
mov eax, dword [0x1800c3298]
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], 0x7921
movzx eax, byte [rsp + 0x21]
movabs rcx, 0xd22411a77a71
add rax, rcx
mov byte [0x1800c31af], al
mov eax, dword [0x1800c32c4]
mov byte [rsp + 0x20], al
mov r9, qword [rsp + 0xc0]
mov r8d, dword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
mov rcx, 0xffffffffffffffff
call fcn.1800119e0
mov dword [rsp + 0x40], eax
movzx eax, word [rsp + 0x2c]
movzx eax, ax
and eax, 0xc4
mov byte [rsp + 0x20], al
mov eax, dword [rsp + 0x40]
add rsp, 0xa8
ret
Function at 0x180016620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov qword [rsp + 0x68], 0x4b53
mov rax, qword [0x1800c32b8]
mov word [rsp + 0x30], ax
mov qword [rsp + 0x70], 0x55952d84
mov eax, 0xdb15
mov word [rsp + 0x34], ax
mov rax, qword [0x1800c32b8]
mov byte [rsp + 0x20], al
movzx eax, byte [0x1800c322b]
movsx ax, al
mov word [rsp + 0x28], ax
mov qword [rsp + 0x60], 0xedcd
mov rax, qword [0x1800c3278]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x3c], 0xe188
mov rax, qword [0x1800c32d0]
mov qword [rsp + 0x78], rax
movzx eax, byte [0x1800c31fe]
movsx eax, al
mov dword [rsp + 0x4c], eax
movzx eax, byte [0x1800c322a]
mov byte [rsp + 0x21], al
mov qword [rsp + 0x80], 9
mov eax, dword [0x1800c32c0]
mov eax, eax
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x50], 0x24
movzx eax, word [0x1800c3290]
mov word [rsp + 0x38], ax
mov rax, qword [0x1800c32a0]
mov qword [rsp + 0x90], rax
mov rax, qword [0x1800c3288]
mov byte [rsp + 0x22], al
mov rax, qword [0x1800c32b8]
mov dword [rsp + 0x54], eax
mov eax, dword [0x1800c3280]
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x98], 0x1d37
mov eax, 0xad1ee82b
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x58], 0x3461b7d9
mov qword [rsp + 0xa8], 0xe107
mov byte [rsp + 0x23], 0x36
mov byte [rsp + 0x24], 0xd3
movzx eax, byte [0x1800c322a]
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0x25], 0xe6
mov dword [rsp + 0x5c], 0x87
mov qword [rsp + 0xb8], 0xc8
mov rax, qword [0x1800c32b8]
movzx ecx, byte [0x1800c31eb]
movsx rcx, cl
movabs rdx, 0x4c72912904fe0
add rcx, rdx
add rax, rcx
mov byte [0x1800c31eb], al
mov r9d, dword [rsp + 0xe0]
mov r8, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xd0]
mov rcx, 0xffffffffffffffff
call fcn.180014680
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x60]
sar rax, 2
mov dword [rsp + 0x3c], eax
movzx eax, word [rsp + 0x28]
movzx eax, ax
test eax, eax
je 0x1800167eb
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x2c], eax
jmp 0x1800167f3
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x2c], eax
movzx eax, byte [rsp + 0x2c]
mov byte [0x1800c31fe], al
mov eax, dword [rsp + 0x48]
add rsp, 0xc8
ret
Function at 0x1800892d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xc8
mov dword [rsp + 0x90], 0xd958f05f
movzx eax, byte [0x1800c3b97]
movsx eax, al
mov dword [rsp + 0x6c], eax
mov byte [rsp + 0x20], 0x24
mov dword [rsp + 0x70], 0xdb
movzx eax, byte [0x1800c3b56]
mov qword [rsp + 0xa0], rax
movzx eax, byte [0x1800c3b6f]
movzx eax, al
mov word [rsp + 0x30], ax
movzx eax, word [0x1800c3c68]
movzx eax, ax
mov dword [rsp + 0x40], eax
movzx eax, word [0x1800c3c84]
mov word [rsp + 0x2c], ax
movzx eax, byte [0x1800c3c28]
mov byte [rsp + 0x23], al
mov byte [rsp + 0x25], 0xa2
mov dword [rsp + 0x5c], 0x9622daf6
mov eax, 0xc9608ea3
mov qword [rsp + 0x80], rax
movzx eax, byte [0x1800c3b2b]
mov dword [rsp + 0x94], eax
movzx eax, byte [0x1800c3b2b]
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x74], 0xe501bc23
mov byte [rsp + 0x22], 0xef
mov eax, dword [0x1800c3c80]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x78], 0x10
mov byte [rsp + 0x26], 0xb7
mov byte [rsp + 0x24], 5
mov byte [rsp + 0x21], 0x44
mov dword [rsp + 0x38], 0x6277b2f1
movzx eax, byte [0x1800c3b97]
mov byte [rsp + 0x27], al
mov byte [rsp + 0x28], 0xb8
movzx eax, byte [0x1800c3b97]
movsx ax, al
mov word [rsp + 0x64], ax
mov byte [rsp + 0x29], 0x68
mov eax, 0xd7
mov word [rsp + 0x68], ax
mov byte [rsp + 0x2a], 0xe0
mov eax, 0xcfa55e8d
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x9c], 0x3d52214c
mov rax, qword [rsp + 0xd0]
mov qword [0x180ecfc08], rax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 1
je 0x1800895b5
cmp dword [rsp + 0x34], 2
je 0x180089604
cmp dword [rsp + 0x34], 3
je 0x18008963b
jmp 0x1800896b9
call fcn.180088d90
movzx eax, word [0x1800c3c58]
movzx eax, ax
sub eax, 0xe8d2
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x1800895eb
mov rax, qword [0x1800c3c28]
mov qword [rsp + 0x88], rax
jmp 0x1800895f9
movsx rax, byte [rsp + 0x23]
mov qword [rsp + 0x88], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x5c], eax
movzx eax, byte [0x1800c3b2f]
movzx eax, al
movzx ecx, byte [rsp + 0x24]
movzx ecx, cl
add eax, ecx
mov ecx, dword [0x1800c3c1c]
add eax, ecx
mov dword [0x1800c3c54], eax
mov eax, dword [rsp + 0x74]
add eax, 0xd56c
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [0x1800c3c54]
movzx ecx, byte [rsp + 0x21]
movsx ecx, cl
cmp eax, ecx
jb 0x180089657
mov dword [rsp + 0x3c], 1
jmp 0x18008965f
mov dword [rsp + 0x3c], 0
mov eax, dword [0x1800c3c54]
cmp eax, 0x3d
jb 0x180089674
mov dword [rsp + 0x60], 1
jmp 0x18008967c
mov dword [rsp + 0x60], 0
mov eax, dword [rsp + 0x60]
cmp dword [rsp + 0x3c], eax
jle 0x18008969c
mov dword [rsp + 0x40], 0x61
mov eax, 0xc27
mov word [0x1800c3c04], ax
jmp 0x1800896b9
movzx eax, byte [rsp + 0x21]
movsx rax, al
movabs rcx, 0x5abd8cd3ce275
add rax, rcx
mov qword [0x1800c3c28], rax
mov eax, 1
add rsp, 0xc8
ret
Function at 0x180001cf0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x180036060]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rax, qword gs:[0x60]
xor r11d, r11d
mov r12d, ecx
mov ebp, r11d
mov r10, qword [rax + 0x18]
add r10, 0x20
mov r9, qword [r10]
cmp r9, r10
je 0x180001d8e
lea rbx, str.ntdll.dll
nop word [rax + rax]
mov r9, qword [r9]
mov rcx, rbx
mov r8, qword [r9 + 0x50]
movzx edx, byte [r8]
test dl, dl
je 0x180001d7f
movzx eax, dl
sub r8, rbx
movzx edx, al
cmp al, byte [rcx]
jne 0x180001d7f
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x180001d68
cmp dl, byte [rcx]
je 0x180001d8a
cmp r9, r10
jne 0x180001d50
jmp 0x180001d8e
mov rbp, qword [r9 + 0x20]
movsxd rax, dword [rbp + 0x3c]
mov ebx, r11d
mov ecx, dword [rax + rbp + 0x88]
add rcx, rbp
mov r14d, dword [rcx + 0x1c]
mov edi, dword [rcx + 0x20]
add r14, rbp
mov r15d, dword [rcx + 0x24]
add rdi, rbp
mov esi, dword [rcx + 0x14]
add r15, rbp
test esi, esi
je 0x180001e68
nop
mov r10d, dword [rdi]
mov rdx, r11
add r10, rbp
lea rax, [r10 + 2]
nop dword [rax]
cmp byte [rax - 2], r11b
je 0x180001e12
cmp byte [rax - 1], r11b
je 0x180001e0f
cmp byte [rax], r11b
je 0x180001e09
cmp byte [rax + 1], r11b
je 0x180001e03
cmp byte [rax + 2], r11b
je 0x180001dfd
add rdx, 5
add rax, 5
cmp rdx, 0x32
jb 0x180001dd0
jmp 0x180001e1d
add rdx, 4
jmp 0x180001e12
add rdx, 3
jmp 0x180001e12
add rdx, 2
jmp 0x180001e12
inc rdx
mov r8d, 0x129387
test rdx, rdx
je 0x180001e55
mov r8d, 0x129387
mov r9d, r11d
nop word [rax + rax]
movsx eax, byte [r10]
lea r10, [r10 + 1]
imul ecx, r8d, 0x5afed
inc r9d
add ecx, eax
movsxd rax, r9d
and ecx, 0xbcedfa
add r8d, ecx
cmp rax, rdx
jb 0x180001e30
cmp r8d, r12d
je 0x180001e7b
inc ebx
add rdi, 4
cmp ebx, esi
jb 0x180001dc0
mov r8, qword [0x1800388a0]
test r8, r8
jne 0x180001e92
xor eax, eax
jmp 0x180001f33
mov eax, ebx
movzx ecx, word [r15 + rax*2]
mov r8d, dword [r14 + rcx*4]
add r8, rbp
mov qword [0x1800388a0], r8
jmp 0x180001e6f
lea rax, [r8 + 0x1e]
mov ecx, r11d
lea rdx, [rsp]
cmp rdx, rax
ja 0x180001ed4
lea rax, [rsp + 0x1e]
cmp rax, r8
jb 0x180001ed4
lea rax, [rsp]
mov r9, r8
sub r9, rax
lea rdx, [rsp]
nop word [rax + rax]
movzx eax, byte [r9 + rdx]
inc ecx
mov byte [rdx], al
lea rdx, [rdx + 1]
cmp ecx, 0x1f
jb 0x180001ec0
jmp 0x180001f10
mov eax, dword [r8 + 0x18]
movups xmm0, xmmword [r8]
mov dword [rsp + 0x18], eax
movzx eax, word [r8 + 0x1c]
movsd xmm1, qword [r8 + 0x10]
mov word [rsp + 0x1c], ax
movzx eax, byte [r8 + 0x1e]
mov byte [rsp + 0x1e], al
movups xmmword [rsp], xmm0
movsd qword [rsp + 0x10], xmm1
inc ecx
cmp ecx, 0x1f
jb 0x180001f03
nop word [rax + rax]
movsxd rax, r11d
cmp byte [rsp + rax + 1], 5
jne 0x180001f21
cmp byte [rsp + rax + 2], 0xc3
je 0x180001f2c
inc r11d
cmp r11d, 0x1f
jb 0x180001f10
jmp 0x180001f33
movzx eax, r11b
add rax, r8
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.180006080
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180001f60
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 8], ecx
push rbx
push rbp
push rdi
push r12
push r14
sub rsp, 0x40
mov rax, qword gs:[0x60]
xor r14d, r14d
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x180001fb2
nop dword [rax + rax]
mov rbx, qword [rbx]
lea rdx, str.ntdll.dll
mov rcx, qword [rbx + 0x50]
call fcn.18000cb84
test eax, eax
je 0x180001fae
cmp rbx, rdi
jne 0x180001f90
jmp 0x180001fb2
mov r14, qword [rbx + 0x20]
movsxd rax, dword [r14 + 0x3c]
xor ebp, ebp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov ecx, dword [rax + r14 + 0x88]
mov r12d, dword [rax + r14 + 0xa0]
add rcx, r14
add r12, r14
mov eax, dword [rcx + 0x1c]
mov edx, dword [rcx + 0x24]
add rax, r14
mov qword [rsp + 0x78], rax
add rdx, r14
mov eax, dword [rcx + 0x20]
add rax, r14
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x80], rax
cmp dword [r12], ebp
je 0x180002168
mov r15d, dword [rcx + 0x14]
mov r9d, 0x775a
nop dword [rax + rax]
xor ebx, ebx
test r15d, r15d
je 0x180002159
mov r13d, dword [r12]
mov rdi, rdx
mov rsi, rax
nop word [rax + rax]
mov r11d, dword [rsi]
add r11, r14
xor edx, edx
lea rax, [r11 + 2]
nop dword [rax]
cmp byte [rax - 2], 0
je 0x180002092
cmp byte [rax - 1], 0
je 0x18000208f
cmp byte [rax], 0
je 0x180002089
cmp byte [rax + 1], 0
je 0x180002083
cmp byte [rax + 2], 0
je 0x18000207d
add rdx, 5
add rax, 5
cmp rdx, 0x32
jb 0x180002050
jmp 0x18000209d
add rdx, 4
jmp 0x180002092
add rdx, 3
jmp 0x180002092
add rdx, 2
jmp 0x180002092
inc rdx
mov r10d, 0x129387
test rdx, rdx
je 0x1800020db
mov r8, r11
mov r10d, 0x129387
xor r9d, r9d
nop dword [rax]
movsx eax, byte [r8]
lea r8, [r8 + 1]
imul ecx, r10d, 0x5afed
inc r9d
add ecx, eax
movsxd rax, r9d
and ecx, 0xbcedfa
add r10d, ecx
cmp rax, rdx
jb 0x1800020b0
mov r9d, 0x775a
movzx eax, word [rdi]
mov rcx, qword [rsp + 0x78]
mov r8d, dword [rcx + rax*4]
cmp r8d, r13d
jne 0x180002136
movzx eax, byte [r11]
mov rdx, r11
mov rcx, r11
test al, al
je 0x180002112
nop word [rax + rax]
cmp al, byte [rcx]
jne 0x180002112
movzx eax, byte [rdx + 1]
inc rdx
inc rcx
test al, al
jne 0x180002100
cmp r10d, dword [rsp + 0x70]
jne 0x18000212e
movzx ecx, byte [rcx]
lea rax, [r14 + r8]
mov qword [0x1800388a0], rax
movzx eax, byte [rdx]
cmp eax, ecx
je 0x180002168
cmp word [r11], r9w
jne 0x180002136
inc ebp
inc ebx
add rsi, 4
add rdi, 2
cmp ebx, r15d
jb 0x180002040
mov rax, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
add r12, 0xc
cmp dword [r12], 0
jne 0x180002020
mov r15, qword [rsp + 0x28]
movzx eax, bpl
mov r13, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800021e0
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
xor edi, edi
mov r10, qword [rax + 0x18]
add r10, 0x20
mov r9, qword [r10]
cmp r9, r10
je 0x18000225e
lea r11, str.ntdll.dll
nop dword [rax + rax]
mov r9, qword [r9]
mov rcx, r11
mov r8, qword [r9 + 0x50]
movzx edx, byte [r8]
test dl, dl
je 0x18000224f
movzx eax, dl
sub r8, r11
movzx edx, al
cmp al, byte [rcx]
jne 0x18000224f
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x180002238
cmp dl, byte [rcx]
je 0x18000225a
cmp r9, r10
jne 0x180002220
jmp 0x18000225e
mov rdi, qword [r9 + 0x20]
movsxd rax, dword [rdi + 0x3c]
xor r11d, r11d
mov ecx, dword [rax + rdi + 0x88]
add rcx, rdi
mov ebp, dword [rcx + 0x1c]
mov ebx, dword [rcx + 0x20]
add rbp, rdi
mov r14d, dword [rcx + 0x24]
add rbx, rdi
mov esi, dword [rcx + 0x14]
add r14, rdi
test esi, esi
je 0x18000232e
nop dword [rax]
mov r10d, dword [rbx]
add r10, rdi
xor edx, edx
lea rax, [r10 + 2]
nop dword [rax]
cmp byte [rax - 2], 0
je 0x1800022e2
cmp byte [rax - 1], 0
je 0x1800022df
cmp byte [rax], 0
je 0x1800022d9
cmp byte [rax + 1], 0
je 0x1800022d3
cmp byte [rax + 2], 0
je 0x1800022cd
add rdx, 5
add rax, 5
cmp rdx, 0x32
jb 0x1800022a0
jmp 0x1800022e7
add rdx, 4
jmp 0x1800022e2
add rdx, 3
jmp 0x1800022e2
add rdx, 2
jmp 0x1800022e2
inc rdx
test rdx, rdx
je 0x18000231e
mov r8d, 0x129387
xor r9d, r9d
movsx eax, byte [r10]
lea r10, [r10 + 1]
imul ecx, r8d, 0x5afed
inc r9d
add ecx, eax
movsxd rax, r9d
and ecx, 0xbcedfa
add r8d, ecx
cmp rax, rdx
jb 0x1800022f0
cmp r8d, 0x6d26981
je 0x18000234c
inc r11d
add rbx, 4
cmp r11d, esi
jb 0x180002290
mov rax, qword [0x180038898]
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
movzx ecx, word [r14 + r11*2]
mov eax, dword [rbp + rcx*4]
add rax, rdi
mov qword [0x180038898], rax
jmp 0x180002335
Function at 0x180002370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x66940]
mov eax, 0x66a40
call fcn.180006900
sub rsp, rax
mov rax, qword [0x180036060]
xor rax, rsp
mov qword [rbp + 0x66930], rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x70]
call fcn.180008770
lea rcx, [rsp + 0x70]
call fcn.180003670
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
test byte [rbp + rcx - 0x80], 6
jne 0x180002436
mov ebx, 1
nop dword [rax]
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x70]
call fcn.1800038a0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
je 0x1800023d0
mov eax, ebx
dec ebx
test eax, eax
jg 0x1800023d0
lea rcx, [rbp - 0x80]
call fcn.180003fa0
test rax, rax
jne 0x180002436
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
mov eax, 6
mov edx, 2
cmp qword [rbp + rcx - 0x48], 0
cmovne eax, edx
or eax, dword [rbp + rcx - 0x80]
and eax, 0x17
mov dword [rbp + rcx - 0x80], eax
and eax, dword [rbp + rcx - 0x7c]
jne 0x18000254a
xor r8d, r8d
xor eax, eax
lea rdx, [rbp + 0x90]
lea r9, str.mweirhjqpoejakk______
nop dword [rax]
xor ecx, ecx
cmp rax, 0x15
cmovne rcx, rax
movzx eax, byte [rcx + r9]
xor byte [rdx], al
lea rax, [rcx + 1]
inc r8d
lea rdx, [rdx + 1]
cmp r8d, 0x668a0
jb 0x180002450
lea rax, [rbp + 0x90]
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x88], 0x668a0
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
lea r8, [rbp + 0x88]
lea rdx, [rsp + 0x68]
mov rcx, 0xffffffffffffffff
call fcn.18000502b
lea rax, [rbp + 0x90]
call rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x6c], edx
lea rcx, [rbp - 0x80]
call fcn.1800033b0
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x6c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x20]
call fcn.180005aec
nop
mov rcx, qword [rbp + 0x66930]
xor rcx, rsp
call fcn.180006080
mov rbx, qword [rsp + 0x66a50]
add rsp, 0x66a40
pop rbp
ret
test al, 4
je 0x180002557
lea rdx, str.ios_base::badbit_set
jmp 0x18000256b
test dl, al
lea rdx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800012e0
mov r8, rax
lea rcx, [rsp + 0x40]
call fcn.180001b90
lea rdx, [0x180033af8]
lea rcx, [rsp + 0x40]
call fcn.180007f44
int3
Function at 0x180002c30
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180002c52
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x180002ccc
mov rdi, r14
mov rcx, rbx
call fcn.180004080
test rax, rax
jle 0x180002ca4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.180008020
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180002cbc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180002cc4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180002c66
sub r14, rdi
jmp 0x180002db9
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180002ce3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180002ce5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180002d1a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180008020
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180002db6
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x180002d55
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x180002d91
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18000d938
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x180002dcf
cmp rbp, rax
ja 0x180002d61
mov r8, rdi
test rdi, rdi
je 0x180002db6
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18000d938
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x180002db9
Function at 0x1800031d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180036060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1800031fd
xor eax, eax
jmp 0x180003343
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180003237
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180003237
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180003343
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180003336
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000327a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180003289
movsx ecx, dil
jmp 0x1800032dd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
je 0x1800032f7
sub eax, 1
je 0x1800032f7
cmp eax, 2
jne 0x180003336
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.18000c7f4
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000333b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180003324
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.18000d654
cmp rsi, rax
jne 0x180003336
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18000333b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180006080
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140001d24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001d6e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001d6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001d6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001d6e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001d6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001d70
xor al, al
add rsp, 0x28
ret

Function at 0x1400079f8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140007a67
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007a67
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007a67
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007a67
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007a67
cmp dword [rcx + 0x84], 0xe
jbe 0x140007a67
cmp dword [rcx + 0xf8], 0
je 0x140007a67
mov ecx, ebx
call fcn.140007b18
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400078f4
nop
cmp dword [rbp + 0x20], 0
je 0x140007ab5
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007ac0
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400079f8

Function at 0x140007bfc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400079f8