joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000e51e
mov word [rbp + 0x50], 0x7446
mov word [rbp + 0x58], 0x7446
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e3a4
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000e390
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000e3d5
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000e3c0
cmp rdi, rbx
jne 0x14000e4f2
mov r13, rsi
mov word [rbp - 0x50], 0x7446
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000e416
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000e402
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000e518
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x740027
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000e488
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x74003c
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000e488
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x740027
mov dword [rbp - 0x42], 0x740007
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x740027
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000e4e5
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x74003c
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000e4e5
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x740027
mov dword [rbp - 0x32], 0x740007
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000e4f2
inc r14
jmp 0x14000e3f0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000e51e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000e360
mov rax, qword [rbp - 8]
jmp 0x14000e520
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e550
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x70
mov dword [rbp - 0x20], 0x31000d
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x3b0022
mov dword [rbp - 0x18], 0x200035
mov dword [rbp - 0x14], 0x20002d
mov dword [rbp - 0x10], 0x4c0037
call fcn.140004fd0
mov rcx, rax
call 0x14000e550
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x64
mov dword [rbp - 0x20], 0x31000d
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x3b0022
mov dword [rbp - 0x18], 0x200035
mov dword [rbp - 0x14], 0x53005c
call fcn.1400022a0
mov rcx, rax
call 0x14000e550
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x28
mov dword [rbp - 0x1c], 0x190014
mov dword [rbp - 0x18], 0x6c001c
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000e550
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000e5b2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000bd90
test al, al
jne 0x14000e5c4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000e580
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18001f910
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rcx, rcx
je 0x18001f970
mov r8, qword [rcx]
test r8, r8
je 0x18001f970
mov r8, qword [r8 + 0x10]
mov eax, 0xffffffff
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r8 + rcx], 0
jne 0x18001f930
test ecx, ecx
je 0x18001f96d
mov r9d, ecx
lea r10, [0x1801cc180]
nop dword [rax + rax]
movsx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, eax
shr eax, 8
xor rdx, rcx
movzx ecx, dl
xor eax, dword [r10 + rcx*4]
sub r9, 1
jne 0x18001f950
not eax
ret
xor eax, eax
ret

Function at 0x18001f980
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x18001f98d
xor eax, eax
jmp 0x18001fa06
mov r9, qword [rcx]
test r9, r9
jne 0x18001f999
xor eax, eax
jmp 0x18001fa06
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x18001f9a6
xor eax, eax
jmp 0x18001fa06
mov r10, r9
mov qword [rsp + 8], r9
xor edx, edx
mov r8d, 0xffffffff
lea r11, [0x1801cc180]
mov dword [rsp], edx
mov ecx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x18001f9d0
cmp edx, eax
jae 0x18001f9fc
movsx eax, byte [r10]
xor rax, rcx
movzx ecx, al
shr r8d, 8
xor r8d, dword [r11 + rcx*4]
inc r10
mov qword [rsp + 8], r10
inc edx
jmp 0x18001f9bd
not r8d
mov eax, r8d
jmp 0x18001fa06
add rsp, 0x18
ret

Function at 0x180025940
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp byte [0x18028456c], 0
jne 0x1800259a0
lea rcx, [rsp + 0x30]
mov byte [0x18028456c], 1
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
xorps xmm1, xmm1
cvtsi2ss xmm0, qword [rsp + 0x38]
cvtsi2ss xmm1, qword [rsp + 0x30]
movss dword [0x180284944], xmm0
movss dword [0x180284604], xmm1
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x30]
subss xmm0, dword [0x180284604]
divss xmm0, dword [0x180284944]
add rsp, 0x28
ret
Function at 0x180026d40
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
call fcn.180022e90
mov rcx, rax
call fcn.180022d20
mov rbx, rax
test rax, rax
je 0x180026fea
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180021e50
cmp dword [rsp + 0x20], 0
je 0x180026fea
mov ecx, dword [rsp + 0x60]
test ecx, ecx
je 0x180026fea
add rbx, 0xb0
mov qword [rsp + 0x80], rdi
xor r9d, r9d
movabs rdi, 0x7fffffff0000
cmp rbx, 0x40000
jbe 0x180026db6
lea rax, [rbx + 8]
cmp rax, rdi
jae 0x180026db6
mov rdx, qword [rbx]
jmp 0x180026db9
mov rdx, r9
cmp byte [0x1802846d7], r9b
je 0x180026dfa
lea r8, [rdx + 0x2d8]
cmp r8, 0x40000
jbe 0x180026dde
lea rax, [r8 + 4]
cmp rax, rdi
jae 0x180026dde
mov dword [r8], r9d
add rdx, 0x2dc
cmp rdx, 0x40000
jbe 0x180026dfa
lea rax, [rdx + 4]
cmp rax, rdi
jae 0x180026dfa
mov dword [rdx], r9d
cmp ecx, 0xfffffffe
je 0x180026f2e
cmp ecx, 0xffffffff
je 0x180026ec3
cmp ecx, 2
je 0x180026e70
cmp ecx, 3
jne 0x180026f8b
cmp byte [0x1802846e3], r9b
je 0x180026f8b
cmp rbx, 0x40000
jbe 0x180026f8b
lea rax, [rbx + 8]
cmp rax, rdi
jae 0x180026f8b
mov rcx, qword [rbx]
add rcx, 0x1fc
cmp rcx, 0x40000
jbe 0x180026f8b
lea rax, [rcx + 4]
cmp rax, rdi
jae 0x180026f8b
mov dword [rcx], 0x3db851ec
jmp 0x180026f8b
cmp byte [0x1802846dc], r9b
je 0x180026f8b
cmp rbx, 0x40000
jbe 0x180026f8b
lea rax, [rbx + 8]
cmp rax, rdi
jae 0x180026f8b
mov rcx, qword [rbx]
add rcx, 0x290
cmp rcx, 0x40000
jbe 0x180026f8b
lea rax, [rcx + 1]
cmp rax, rdi
jae 0x180026f8b
mov byte [rcx], 1
jmp 0x180026f8b
cmp byte [0x1802846ec], r9b
je 0x180026f8b
cmp rbx, 0x40000
jbe 0x180026f8b
lea rax, [rbx + 8]
cmp rax, rdi
jae 0x180026f8b
mov rcx, qword [rbx]
mov rdx, rcx
lea r8, [rcx + 0x3a0]
cmp r8, 0x40000
jbe 0x180026f10
lea rax, [r8 + 4]
cmp rax, rdi
jae 0x180026f10
mov dword [r8], 0x3f800000
lea rcx, [rdx + 0x3b0]
cmp rcx, 0x40000
jbe 0x180026f8b
lea rax, [rcx + 1]
cmp rax, rdi
jae 0x180026f8b
mov byte [rcx], 1
jmp 0x180026f8b
cmp byte [0x1802846de], r9b
je 0x180026f8b
cmp rbx, 0x40000
jbe 0x180026f8b
lea rax, [rbx + 8]
cmp rax, rdi
jae 0x180026f8b
mov rcx, qword [rbx]
mov rdx, rcx
lea r8, [rcx + 0x3a0]
cmp r8, 0x40000
jbe 0x180026f6c
lea rax, [r8 + 1]
cmp rax, rdi
jae 0x180026f6c
mov byte [r8], 1
lea rcx, [rdx + 0x3a4]
cmp rcx, 0x40000
jbe 0x180026f8b
lea rax, [rcx + 4]
cmp rax, rdi
jae 0x180026f8b
mov dword [rcx], 0x3f800000
cmp byte [0x1802846fd], r9b
je 0x180026fe2
mov ecx, dword [0x180284908]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180026fe2
cmp dword [0x18028471c], 1
jne 0x180026fe2
cmp rbx, 0x40000
jbe 0x180026fe2
lea rax, [rbx + 8]
cmp rax, rdi
jae 0x180026fe2
mov rcx, qword [rbx]
add rcx, 0x1fc
cmp rcx, 0x40000
jbe 0x180026fe2
lea rax, [rcx + 4]
cmp rax, rdi
jae 0x180026fe2
mov dword [rcx], 0x3c23d70a
mov rdi, qword [rsp + 0x80]
add rsp, 0x70
pop rbx
ret
Function at 0x180026ff0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x98
cmp byte [0x1802848ac], 0
je 0x180027273
mov ecx, dword [0x1802848f8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180027273
mov rcx, qword [0x1802846b0]
test rcx, rcx
je 0x180027273
mov qword [rsp + 0xa0], rbx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0xb0], rdi
mov r8d, Ordinal_50
mov qword [rsp + 0x90], r14
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x60], xmm8
call fcn.180022740
call fcn.180022e90
mov rcx, rax
call fcn.18001f7f0
mov edi, dword [0x1802844c0]
mov rbx, rax
mov r14d, 4
test rax, rax
jne 0x18002709d
xorps xmm0, xmm0
xorps xmm1, xmm1
xorps xmm2, xmm2
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm2
jmp 0x18002710b
mov rax, qword gs:[0x58]
mov rcx, qword [rax + rdi*8]
mov eax, dword [r14 + rcx]
cmp dword [0x1802bb1b8], eax
jle 0x1800270eb
lea rcx, [0x1802bb1b8]
call fcn.18019a5c8
cmp dword [0x1802bb1b8], 0xffffffff
jne 0x1800270eb
mov ecx, 0x56e64b7d
call fcn.1800131d0
lea rcx, [0x1802bb1b8]
mov rdx, qword [rax]
mov qword [0x1802bb058], rdx
call fcn.18019a55c
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [0x1802bb058]
movss xmm2, dword [rsp + 0x28]
movss xmm1, dword [rsp + 0x24]
movss xmm0, dword [rsp + 0x20]
movss xmm6, dword [rsp + 0x34]
movss xmm8, dword [rsp + 0x30]
subss xmm1, xmm6
subss xmm2, dword [rsp + 0x38]
subss xmm0, xmm8
mulss xmm1, xmm1
mulss xmm0, xmm0
mulss xmm2, xmm2
addss xmm0, xmm1
addss xmm0, xmm2
comiss xmm0, dword [0x1801d5e0c]
ja 0x18002724d
movss xmm0, dword [0x1802bac0c]
addss xmm0, dword [0x1801d5c38]
mov qword [rsp + 0xa8], rsi
mov rsi, qword gs:[0x58]
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x50], xmm9
movaps xmm1, xmm0
movss dword [0x1802bac0c], xmm0
movaps xmm0, xmm1
call fcn.18019c2f0
addss xmm6, dword [0x1801d5c2c]
movaps xmm7, xmm8
movaps xmm9, xmm0
addss xmm7, dword [0x1801d5cac]
shufps xmm9, xmm0, 1
mulss xmm9, dword [0x1801d5cac]
subss xmm7, xmm8
addss xmm9, xmm8
mulss xmm7, xmm0
addss xmm7, dword [rsp + 0x38]
call fcn.180022e90
mov rbx, rax
test rax, rax
jne 0x1800271d2
xor ecx, ecx
jmp 0x18002721f
mov rax, qword [rsi + rdi*8]
mov ecx, dword [r14 + rax]
cmp dword [0x1802bae7c], ecx
jle 0x180027214
lea rcx, [0x1802bae7c]
call fcn.18019a5c8
cmp dword [0x1802bae7c], 0xffffffff
jne 0x180027214
mov ecx, 0x42722fff
call fcn.1800162f0
lea rcx, [0x1802bae7c]
mov qword [0x1802bb3e0], rax
call fcn.18019a55c
mov rax, qword [0x1802bb3e0]
mov rcx, qword [rax + rbx]
unpcklps xmm9, xmm6
lea rdx, [rsp + 0x40]
movsd qword [rsp + 0x40], xmm9
movss dword [rsp + 0x48], xmm7
call fcn.180021650
movaps xmm9, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x70]
mov rsi, qword [rsp + 0xa8]
movaps xmm6, xmmword [rsp + 0x80]
mov r14, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0x60]
add rsp, 0x98
ret
Function at 0x18002bbe0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x18002bc58
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x18002bc58
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x18002bc45
nop
cmp rbx, rcx
jae 0x18002bc58
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18002bc30
cmp rbx, rcx
jae 0x18002bc58
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x18002bc5a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800427b0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
movdqa xmm1, xmmword [0x1801d6090]
xorps xmm0, xmm0
mov r8, qword [0x180282370]
mov rcx, 0xffffffffffffffff
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x40], 0
movdqu xmmword [rsp + 0x50], xmm1
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1800427e5
movabs rax, 0x7fffffffffffffff
sub rax, r8
cmp rax, rcx
jb 0x1800429df
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
lea r9, [0x180282360]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x60]
cmova r9, qword [0x180282360]
mov qword [rsp + 0x28], rdx
movzx edx, byte [rsp + 0xb0]
mov qword [rsp + 0x20], r8
lea r8, [0x180282360]
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm7
call fcn.180010050
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 5
jb 0x1800428b4
mov qword [rsp + 0xa0], rbx
lea rax, [rcx + 5]
cmp rdx, 0xf
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
mov r8d, 5
cmova rbx, qword [rsp + 0x60]
lea rdx, str..cold
add rbx, rcx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 5], 0
lea rax, [rsp + 0x60]
mov rbx, qword [rsp + 0xa0]
jmp 0x1800428d3
lea r9, str..cold
mov qword [rsp + 0x20], 5
mov edx, 5
lea rcx, [rsp + 0x60]
call fcn.18000fec0
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x180042926
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180042921
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180042964
call fcn.18019a9ec
mov rdx, qword [rsp + 0x78]
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
cmp rdx, 0xf
jbe 0x180042970
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004296b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004296b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18019a9ec
cmp qword [rsp + 0x58], 0xf
lea rcx, [rsp + 0x40]
cmova rcx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1800429c7
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800429c2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800429c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18019a9ec
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0xa8
ret
call fcn.18000fd20
int3
Function at 0x18007d150
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, qword [0x1802b6738]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x18007d1eb
mov rax, qword [rdi]
test rax, rax
je 0x18007d1d1
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x18007d1d1
test rsi, rsi
je 0x18007d1d1
xor eax, eax
lea r9, [rsp + 0x40]
mov r8d, ebx
mov dword [rsp + 0x40], eax
mov rdx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x18007d1d1
cmp dword [rsp + 0x40], ebx
je 0x18007d1eb
mov rcx, rdi
call fcn.18007d0f0
xor al, al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov al, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180080de0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x180080df0
xor al, al
add rsp, 0x38
ret
xor eax, eax
lea r8, [0x18007fbb0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180080e1d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x180081860
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180081888
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800818ae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800818b0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180081909
test ecx, ecx
jle 0x1800818e9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180081909
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180081909
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x180081930
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180081961
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x18008197f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18008199b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18008199d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800819d9
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180081a6e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180081a14
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180081a4e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180081a6e
cmp rbx, rax
ja 0x180081a20
test rbx, rbx
je 0x180081a6e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180081eb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180081ed4
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180081f0b
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
add rcx, rdx
cmp rdx, rcx
jae 0x180081f0b
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x18008203c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180081f4e
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180081f79
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x180082041
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180081fee
sub eax, 1
je 0x180081fee
cmp eax, 2
jne 0x18008203c
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x180082041
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x18008201f
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18008203c
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180082041
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret