joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18012518a
Capabilities:
Authenticate hmac

Disassembly:
sub rsp, 0x38
shl ah, cl
sub al, 0xf5
movzx eax, word [rcx + 0x3a]
cmp ax, 0x46
jmp 0x18012519f
jne 0x1801251c0
test byte [rcx], 8
jne 0x180125458
mov byte [rcx + 0x24], 7
add rsp, 0x38
jmp 0x1801251bb
jmp fcn.180125463
cmp ax, 0x4e
jmp 0x1801251c9
jne 0x180125233
test byte [rcx], 8
jmp 0x1801251d7
jne 0x180125458
mov byte [rcx + 0x24], 8
cwde
or ah, 0x72
mov rax, qword [rcx + 8]
clc
test sp, ax
xor r9d, r9d
cmc
sub r8d, r8d
test r10b, r8b
stc
sub edx, edx
mov byte [rax + 0x30], 1
mov dword [rax + 0x2c], 0x16
btc ax, 0x75
ror al, cl
mov ax, 0x792c
mov rax, qword [rcx + 8]
test r14b, 0xa7
cmc
clc
xor ecx, ecx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call fcn.1801228a3
sub al, al
jmp 0x18012545e
cmp dword [rcx + 0x34], 0
jmp 0x18012523c
jne 0x1801251e5
cmp ax, 0x49
je 0x180125395
cmp ax, 0x4c
jmp 0x180125255
je 0x180125384
cmp ax, 0x54
jmp 0x180125264
je 0x180125373
cmp ax, 0x68
jmp 0x180125273
je 0x18012533a
cmp ax, 0x6a
jmp 0x180125282
je 0x180125329
cmp ax, 0x6c
jmp 0x180125291
je 0x1801252ed
cmp ax, 0x74
jmp 0x1801252a0
je 0x1801252e1
cmp ax, 0x77
je 0x1801252d0
cmp ax, 0x7a
jmp 0x1801252b9
jne 0x180125458
mov dword [rcx + 0x34], 6
jmp 0x1801252cb
jmp 0x180125458
mov dword [rcx + 0x34], 0xc
jmp 0x1801252dc
jmp 0x180125458
mov dword [rcx + 0x34], 7
jmp 0x180125458
mov rax, qword [rcx + 0x10]
cmp word [rax], 0x6c
jmp 0x1801252fa
jne 0x180125317
add rax, 2
mov qword [rcx + 0x10], rax
mov eax, 4
jmp 0x180125312
jmp 0x18012531c
mov eax, 3
mov dword [rcx + 0x34], eax
jmp 0x180125324
jmp 0x180125458
mov dword [rcx + 0x34], 5
jmp 0x180125335
jmp 0x180125458
mov rax, qword [rcx + 0x10]
clc
cmp word [rax], 0x68
jne 0x180125364
add rax, 2
jmp 0x180125352
mov qword [rcx + 0x10], rax
nop
cbw
mov eax, 1
jmp 0x18012531c
mov eax, 2
jmp 0x18012536e
jmp 0x18012531c
mov dword [rcx + 0x34], 0xd
jmp 0x18012537f
jmp 0x180125458
mov dword [rcx + 0x34], 8
jmp 0x180125390
jmp 0x180125458
mov r8, qword [rcx + 0x10]
movzx eax, word [r8]
cmp ax, 0x33
jmp 0x1801253a6
jne 0x1801253e0
cmp word [r8 + 2], 0x32
jmp 0x1801253b7
jne 0x1801253e0
lea rax, [r8 + 4]
jmp 0x1801253c6
mov dword [rcx + 0x34], 0xa
jmp 0x1801253d2
mov qword [rcx + 0x10], rax
jmp 0x1801253db
jmp 0x180125458
cmp ax, 0x36
jmp 0x1801253e9
jne 0x18012541e
cmp word [r8 + 2], 0x34
jmp 0x1801253fa
jne 0x180125458
lea rax, [r8 + 4]
mov dword [rcx + 0x34], 0xb
jmp 0x180125410
mov qword [rcx + 0x10], rax
jmp 0x180125419
jmp 0x180125458
sub ax, 0x58
test rsp, rcx
cmp bl, r12b
cmp ax, 0x20
ja 0x180125458
movabs rdx, 0x120821001
clc
bt rdx, rax
jmp 0x180125446
jae 0x180125458
mov dword [rcx + 0x34], 9
shr al, 0x83
shr al, cl
mov al, 1
test dil, 0x4e
add rsp, 0x38
ret
Function at 0x180131700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
test r15, 0x6ec71b0b
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
movsx rbp, dx
jmp 0x180131728
push r15
test si, r9w
shr dil, cl
sub rsp, 0x50
movsx eax, dx
mov rax, qword [rsp + 0x80]
mov rbp, r8
sete dil
mov rcx, qword [rcx]
movzx rdi, r14w
bswap rdi
mov dil, 0xeb
mov rdi, rdx
mov edx, dword [rsp + 0x88]
jmp 0x180131763
xorps xmm0, xmm0
mov qword [r11 - 0x30], rax
cmp r15, 0x5c850f5d
sub r8d, r8d
jmp 0x180131779
mov qword [r11 - 0x38], r9
jmp 0x180131786
lea r9, [r11 - 0x18]
movups xmmword [rsp + 0x40], xmm0
call fcn.180140b91
mov r15d, dword [rsp + 0x44]
movzx ecx, r10w
btc r14w, 0x7b
rcl rdx, 0x85
xor r8d, r8d
bts r9w, dx
cmp dword [rsp + 0x40], 0x2d
mov r9d, eax
movsx dx, r13b
movzx r14w, r8b
setge bl
mov eax, dword [rsp + 0xa0]
mov rdx, rbp
jmp 0x1801317d3
mov r14, qword [rsp + 0xa8]
mov r8b, 0x63
movsx ecx, bx
movsxd rcx, ecx
sete r8b
bt bx, 0x70
sub ecx, 0x29a707a8
sub bx, r14w
sub rdx, r8
dec ch
movsx rcx, sp
mov qword [rsp + 0x30], r14
inc bl
mov dword [rsp + 0x28], eax
dec r15d
xor bh, 0x4b
and bx, r12w
rcl cx, cl
mov dword [rsp + 0x20], r9d
rol r9w, cl
cmp rbp, 0xffffffffffffffff
mov rcx, 0x24f10dcb
movsx cx, dl
movzx r9, r14w
lea rbx, [r8 + rdi]
cmovge r8, r10
xchg r8b, r9b
mov r8d, dword [rsp + 0x88]
movzx cx, r9b
bswap r9w
cmove rdx, rbp
not ch
lea r9, [rsp + 0x40]
mov ch, 0x2e
jmp 0x180131863
mov rcx, rbx
call fcn.180140942
test eax, eax
jmp 0x180131872
je 0x180131885
mov byte [rdi], 0
jmp 0x180131880
jmp 0x18013197d
mov eax, dword [rsp + 0x44]
jmp 0x18013188e
dec eax
cmp eax, 0xfffffffc
jmp 0x180131898
jl 0x180131916
cmp eax, dword [rsp + 0x88]
jmp 0x1801318aa
jge 0x180131916
cmp r15d, eax
jge 0x1801318e3
mov al, byte [rbx]
jmp 0x1801318c0
inc rbx
cmp r11b, 0x78
clc
test al, al
jmp 0x1801318cf
jne 0x1801318b9
mov byte [rbx - 2], al
movzx r8, r9w
movsxd r8, r9d
movzx edx, r11w
mov r8d, dword [rsp + 0x88]
not ch
lea r9, [rsp + 0x40]
movsxd rdx, ebp
mov qword [rsp + 0x28], r14
mov rdx, rbp
xchg ecx, ecx
mov rcx, rdi
jmp 0x180131907
mov byte [rsp + 0x20], 1
call fcn.180131407
jmp 0x18013197d
mov r9b, byte [rsp + 0x90]
lea rax, [rsp + 0x40]
movzx r8w, r11b
cmovnp ecx, r14d
mov r8d, dword [rsp + 0x88]
movzx cx, r15b
not cx
mov rdx, rbp
bswap ecx
not cx
mov ecx, r15d
mov qword [rsp + 0x38], r14
mov rcx, rdi
jmp 0x180131954
mov byte [rsp + 0x30], 1
jmp 0x18013195e
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x98]
jmp 0x18013196f
mov dword [rsp + 0x20], eax
jmp 0x180131978
call fcn.180130e4c
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
movsx r15, cx
movzx r15d, bx
seto r15b
pop r15
ret
Function at 0x1801333ef
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xor bpl, r11b
adc bpl, r12b
mov qword [rsp + 0x18], rsi
add esi, 0x6db10181
push rdi
sub rsp, 0x30
setle bpl
mov bl, r11b
cmovne esi, r11d
mov ebx, r9d
not dil
mov sil, 0x7c
movzx rsi, cx
mov rdi, r8
jmp 0x180133438
mov esi, edx
movzx dx, r15b
lea r9, [0x180072c38]
mov rbp, rcx
lea r8, [0x180072c30]
bswap edx
lea rdx, str.GetLocaleInfoEx
mov ecx, 8
jmp 0x180133463
call fcn.180132e37
test rax, rax
jmp 0x180133470
je 0x1801334ae
movabs r10, 0xe375262d7cd44270
movsx ecx, r15w
cdq
setno r8b
mov r9d, ebx
mov r8, rdi
mov edx, esi
movzx ecx, di
setp ch
cmovg rcx, r11
mov rcx, rbp
jmp 0x1801334a3
call qword [0x18006c2b8]
jmp 0x1801334d5
sub edx, edx
xchg cx, cx
mov rcx, rbp
jmp 0x1801334bb
call fcn.180133a28
mov ecx, eax
cwd
mov r9d, ebx
mov r8, rdi
bswap dx
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x40]
not rbp
rol bpl, 0xca
mov rbp, qword [rsp + 0x48]
mov si, 0x21a8
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
movzx rdi, dx
not edi
pop rdi
jmp 0x1801334ff
ret
Function at 0x18013a9c2
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
clc
mov qword [rax + 8], rbx
cmp dx, r10w
mov qword [rax + 0x10], rbp
cmc
mov qword [rax + 0x18], rsi
cmp ebx, 0x7674b2e
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
sar bx, 0xd0
sub bx, r14w
mov rbx, rax
stc
cmp rax, r11
test eax, r13d
test rax, rax
jmp 0x18013aa09
jne 0x18013aa1b
xor eax, eax
jmp 0x18013aa16
jmp 0x18013ab81
mov rbp, rbx
cmp word [rax], si
je 0x18013aa53
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jmp 0x18013aa38
jne 0x18013aa2b
lea rbp, [rbp + rax*2]
add rbp, 2
clc
stc
cmp word [rbp], si
jne 0x18013aa27
mov qword [rsp + 0x38], rsi
sub rbp, rbx
bts r9d, esi
mov qword [rsp + 0x30], rsi
add rbp, 2
shl r9b, 0x19
sar rbp, 1
btc r9w, r11w
setae r9b
cmc
mov r8, rbx
mov r9b, 0x1a
test r10, rdi
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
cmp ecx, 0x227768f7
mov qword [rsp + 0x20], rsi
test bpl, al
cmp dl, dil
sub ecx, ecx
jmp 0x18013aaa3
call fcn.180137abc
movsxd r14, eax
clc
test eax, eax
jmp 0x18013aab3
jne 0x18013aacc
mov rcx, rbx
jmp 0x18013aac1
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18013aa0f
mov rcx, r14
jmp 0x18013aad4
call fcn.18013035b
mov rdi, rax
cmc
test bl, dil
test rax, rax
jmp 0x18013aae8
jne 0x18013aaff
xor ecx, ecx
jmp 0x18013aaf5
call fcn.1801302d9
jmp 0x18013aab9
mov qword [rsp + 0x38], rsi
not r8b
bts r8w, cx
mov r9d, ebp
rol r8, 0xd8
clc
mov qword [rsp + 0x30], rsi
xchg r8w, r8w
mov r8, rbx
jmp 0x18013ab25
mov dword [rsp + 0x28], r14d
stc
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
jmp 0x18013ab39
call fcn.180137abc
test eax, eax
jmp 0x18013ab45
jne 0x18013ab58
mov rcx, rdi
call fcn.1801302d9
jmp 0x18013ab67
xor ecx, ecx
call fcn.1801302d9
mov rsi, rdi
mov ecx, 0x40f77c32
mov rcx, rbx
jmp 0x18013ab6f
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
neg bx
ror r14b, cl
cmp r15d, esp
mov rbx, qword [rsp + 0x50]
sbb dil, r13b
mov rbp, qword [rsp + 0x58]
sub sil, 0x91
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
cmc
test cl, sil
add rsp, 0x40
xchg r14b, r14b
jmp 0x18013abb1
pop r14
ret
Function at 0x18013fde9
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
bsf di, sp
sub rsp, 0x20
bts di, sp
adc bx, r10w
sub esi, esi
jmp 0x18013fe14
mov rdi, rdx
sal bx, cl
mov rbx, rcx
test r15b, 0xb7
test rcx, rcx
jmp 0x18013fe29
je 0x18013fec5
cmp word [rcx], si
jmp 0x18013fe37
je 0x18013fec5
lea rdx, [0x180075ba8]
jmp 0x18013fe49
call fcn.18009a101
test eax, eax
jmp 0x18013fe55
je 0x18013fec5
lea rdx, [0x180075bc0]
jmp 0x18013fe67
mov rcx, rbx
call fcn.18009a101
test eax, eax
jmp 0x18013fe76
jne 0x18013feb3
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
jmp 0x18013fe92
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x18013fe9f
je 0x18013fefe
mov eax, dword [rsp + 0x30]
jmp 0x18013feae
jmp 0x18013ff21
mov rcx, rbx
jmp 0x18013febb
call fcn.18012bca1
jmp 0x18013ff21
mov ecx, dword [rdi + 8]
jmp 0x18013fed0
lea r8, [rsp + 0x30]
movsx r9, r10w
mov r9d, 2
not edx
mov edx, 0x20001004
jmp 0x18013feeb
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jmp 0x18013fef8
jne 0x18013ff05
xor eax, eax
jmp 0x18013ff21
mov eax, dword [rsp + 0x30]
stc
test r9d, r15d
cmc
test eax, eax
jmp 0x18013ff15
jne 0x18013ff21
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
movzx edi, cx
cmovo di, r9w
pop rdi
jmp 0x18013ff3d
ret

Function at 0x18013ff3e
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
sbb bh, 0x96
jmp 0x18013ff50
mov qword [rsp + 0x18], rsi
ror bx, 0x29
not sil
push rdi
sub rsp, 0x20
mov esi, edx
cmovs bx, bx
movsxd rbx, r15d
xchg bh, bl
mov ebx, ecx
call fcn.18012cb44
mov ecx, ebx
sar dil, 9
btc dx, r11w
lea r8, [rsp + 0x30]
test r13b, spl
and dl, r13b
and ecx, 0x3ff
cmova r9d, esi
bt dx, 0x64
mov r9d, 2
mov dl, dil
bt rdi, r12
bts ecx, 0xa
movsx dx, dl
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
cmp r12w, 0x1d2f
test r9w, r9w
test eax, eax
jmp 0x18013ffce
je 0x180140098
cmp ebx, dword [rsp + 0x30]
jmp 0x18013ffdd
je 0x180140089
test esi, esi
je 0x180140089
mov r10, qword [rdi + 0x98]
movzx r9d, r14w
mov r9d, edx
movzx r8d, word [r10]
cdqe
clc
inc ecx
lea rcx, [r10 + 2]
xadd ax, ax
bts ax, bx
sar ax, 0xd1
lea eax, [r8 - 0x41]
cmp r12b, 0x82
cmp bpl, bl
cmp ax, 0x19
jbe 0x180140037
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180140055
movzx r8d, word [rcx]
jmp 0x180140040
inc r9d
test bh, 0xea
stc
add rcx, 2
jmp 0x180140050
jmp 0x180140012
or rax, 0xffffffffffffffff
jmp 0x18014005e
inc rax
cmp word [r10 + rax*2], dx
jmp 0x18014006b
jne 0x18014005e
cmp r9d, eax
setne dl
cdqe
movzx rax, si
mov eax, edx
jmp 0x180140084
jmp 0x18014009a
mov eax, 1
jmp 0x180140093
jmp 0x18014009a
xor eax, eax
mov rbx, qword [rsp + 0x38]
and dil, bl
mov rsi, qword [rsp + 0x40]
bsf rdi, r15
jmp 0x1801400b4
add rsp, 0x20
pop rdi
jmp 0x1801400be
ret
Function at 0x180146eb6
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movzx ax, ah
movzx eax, r15w
lahf
mov qword [rsp + 0x18], rbp
movzx rax, r11w
push rsi
seto ah
push rdi
movsx rax, r10w
push r14
cdqe
not eax
mov eax, 0x1450
jmp 0x180146ee6
call fcn.18011635a
sub rsp, rax
xchg r14w, r10w
movsx ax, r9b
test r15, r13
mov rax, qword [0x180086020]
or r14d, 0x211f7ff1
sub sil, al
xor rax, rsp
seto bpl
mov qword [rsp + 0x1440], rax
mov rsi, 0x1521303f
sar edi, cl
movsxd rax, r13d
movsxd r10, edx
add sil, cl
sal r14b, cl
mov rdi, rcx
jmp 0x180146f3b
mov rax, r10
rcl edx, cl
movsx rdx, r15w
mov ebp, r9d
stc
sar rax, 6
btc rdx, 0x9e
rcr ch, cl
lea rcx, [0x180088750]
cmovne r14w, bp
sal r14w, 0xf
and r10d, 0x3f
sal r14, cl
xadd dl, r14b
sar r14b, 0xd0
lea rbp, [rbp + r8]
shld si, dx, 0xe7
and esi, r8d
mov rsi, r8
and dl, 0xcb
movsxd rdx, r12d
add rdx, 0x4bd77255
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
sal r14b, 0xa5
movsx r14w, r10b
and r14b, dl
mov r14, qword [rax + rdx*8 + 0x28]
test bx, 0x5abe
cmc
xor eax, eax
stc
cmp edx, 0x710843dc
mov qword [rdi], rax
test r12w, dx
mov dword [rdi + 8], eax
cmp r8, rbp
jmp 0x180146fca
jae 0x1801470cb
lea rbx, [rsp + 0x40]
cmc
cmp rsi, rbp
jmp 0x180146fde
jae 0x18014702c
mov al, byte [rsi]
inc rsi
test bpl, r8b
cmc
cmp al, 0xa
jmp 0x180146ff4
jne 0x18014700d
inc dword [rdi + 8]
jmp 0x180147002
mov byte [rbx], 0xd
jmp 0x18014700a
inc rbx
mov byte [rbx], al
inc rbx
nop
lea rax, [rsp + 0x143f]
test ch, cl
cmp rbx, rax
jmp 0x180147026
jb 0x180146fd6
and qword [rsp + 0x20], 0
cmovg dx, r12w
movsx ax, r12b
rdtsc
lea rax, [rsp + 0x40]
bswap rdx
sub ebx, eax
jmp 0x180147054
lea r9, [rsp + 0x30]
movzx r8d, r11w
cmovl r8w, r14w
mov r8d, ebx
lea rdx, [rsp + 0x40]
mov rcx, r14
jmp 0x180147072
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x18014707f
je 0x1801470ba
mov eax, dword [rsp + 0x30]
test r13, rbx
cmp dil, 0x62
add dword [rdi + 4], eax
test rcx, 0x697824b3
cmp eax, ebx
jmp 0x1801470a1
jb 0x1801470cb
cmp rsi, rbp
jmp 0x1801470af
jb 0x180146fd0
jmp 0x1801470cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rol rcx, 0x78
not cl
or ax, bx
mov rax, rdi
rcl cl, 0xb8
cmovo cx, dx
bt ecx, edi
mov rcx, qword [rsp + 0x1440]
test dx, 0x7e22
xor rcx, rsp
jmp 0x1801470ed
call fcn.1801152b0
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
movsxd rsi, esp
mov dil, cl
mov rbp, qword [r11 + 0x30]
cmovle si, r8w
movsxd r14, r15d
mov r14b, r8b
mov rsp, r11
movzx rsi, r10w
movzx si, r9b
pop r14
not di
pop rdi
movzx rsi, cx
pop rsi
jmp 0x18014712f
ret
Function at 0x180147130
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
xchg al, al
movsx rax, di
movsx ax, r14b
push rsi
push rdi
movsx ax, r15b
movsx rax, r14w
push r14
lahf
cwde
mov eax, 0x1450
call fcn.18011635a
sub rsp, rax
xor si, 0x5996
add r14w, 0x33bc
mov rax, qword [0x180086020]
sbb r10, rdi
sal bpl, cl
xor rax, rsp
mov qword [rsp + 0x1440], rax
cmp ax, ax
cmp r10w, 0x2061
movsxd r10, edx
movsxd rdx, r13d
shl dh, cl
mov rdi, rcx
adc dx, r10w
mov rax, r10
mov ebp, r9d
sar r14b, 0x26
sar rax, 6
bts edx, r9d
movzx edx, si
stc
lea rcx, [0x180088750]
and r10d, 0x3f
add rbp, r8
btr r14w, r10w
or si, 0x3765
adc edx, 0x347b0f90
mov rsi, r8
sub r14w, r12w
movsxd rdx, ebx
movzx r14w, r13b
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x1801471f1
xor eax, eax
mov qword [rdi], rax
cmp eax, 0x349c3d5e
cmp r9b, r12b
mov dword [rdi + 8], eax
jmp 0x180147206
cmp r8, rbp
jae 0x180147336
lea rbx, [rsp + 0x40]
cmp rsi, 0x629851ac
clc
cmp rsi, rbp
jmp 0x180147224
jae 0x180147284
movzx eax, word [rsi]
add rsi, 2
cmp ax, 0xa
jmp 0x18014723a
jne 0x180147263
add dword [rdi + 8], 2
xor cl, sil
mov ecx, 0xd
cmp ch, 0xb2
test r10w, 0x79c3
mov word [rbx], cx
clc
add rbx, 2
jmp 0x180147263
mov word [rbx], ax
ror ah, cl
add rbx, 2
lea rax, [rsp + 0x143e]
stc
cmc
cmp rbx, rax
jmp 0x18014727e
jb 0x18014721c
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
mov r9, r13
dec rdx
sub rbx, rax
test al, r11b
rcl dx, 0xcf
lea r9, [rsp + 0x30]
cqo
movsx cx, dil
sar rbx, 1
xor r8b, r14b
btr ecx, esi
movsx r8d, r15w
lea rdx, [rsp + 0x40]
sub cl, r12b
shr r8w, cl
add ebx, ebx
setge cl
mov r8b, bl
movsx r8w, cl
mov rcx, r14
not r8w
bswap r8w
movzx r8, bp
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1801472f0
je 0x180147323
mov eax, dword [rsp + 0x30]
add dword [rdi + 4], eax
test bl, 0xa0
test r8d, r9d
cmp eax, ebx
jmp 0x18014730a
jb 0x180147336
cmp rsi, rbp
jmp 0x180147318
jb 0x18014720f
jmp 0x180147336
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
shr ah, cl
btr rcx, r8
movzx ax, r12b
mov rax, rdi
mov rcx, qword [rsp + 0x1440]
test esp, 0x6a8e7bde
xor rcx, rsp
jmp 0x18014734f
call fcn.1801152b0
lea r11, [rsp + 0x1450]
movsx di, r15b
movzx si, sil
jmp 0x18014736b
mov rbx, qword [r11 + 0x20]
cmovg di, r11w
mov rbp, qword [r11 + 0x30]
movzx rdi, r9w
mov sil, 0x42
mov rsp, r11
pop r14
pop rdi
jmp 0x18014738f
pop rsi
jmp 0x180147395
ret
Function at 0x180147396
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
movsx ax, r8b
movzx ax, bl
cdqe
mov qword [rsp + 0x18], rbp
cwde
push rsi
push rdi
push r12
sets ah
movsx ax, bl
push r14
movsx ax, dil
mov ax, 0x667f
movzx rax, r8w
push r15
cbw
movsx rax, r11w
mov eax, 0x1470
jmp 0x1801473d8
call fcn.18011635a
sub rsp, rax
xadd ax, r15w
rcr r10b, cl
mov rax, qword [0x180086020]
test r13, rbx
xor rax, rsp
rcl r15b, cl
sar edi, 0xc2
cmovns r12d, ebp
mov qword [rsp + 0x1460], rax
rcl r12d, 0xfa
xchg ebx, ebx
movsx r10, di
movsxd r10, edx
movsx r15d, r14w
mov rbx, rcx
mov rax, r10
bt r15w, 0xa0
mov r14d, r9d
cqo
rcl edi, cl
sar rax, 6
inc r12b
lea rcx, [0x180088750]
mov dil, r15b
and r10d, 0x3f
add r14, r8
mov r15, r8
bts r12w, si
mov rdi, r8
sal rdx, cl
sbb dh, 0x54
add r12d, r10d
mov rax, qword [rcx + rax*8]
lea rdx, [r10 + r10*8]
mov r12, qword [rax + rdx*8 + 0x28]
jmp 0x18014746d
sub eax, eax
cmp r12b, r15b
stc
mov qword [rbx], rax
test bpl, 0x37
cmp r8, r14
jmp 0x180147482
mov dword [rbx + 8], eax
jmp 0x18014748a
jae 0x180147621
lea rax, [rsp + 0x50]
cmp rdi, r14
jmp 0x18014749d
jae 0x1801474f2
movzx ecx, word [rdi]
cmp bpl, r14b
stc
add rdi, 2
clc
cmp dl, bh
cmp cx, 0xa
jmp 0x1801474ba
jne 0x1801474d1
mov edx, 0xd
cmc
mov word [rax], dx
cmc
add rax, 2
test r10b, r11b
mov word [rax], cx
add rax, 2
btc cx, sp
lea rcx, [rsp + 0x6f8]
cmp rax, rcx
jmp 0x1801474ec
jb 0x180147495
and qword [rsp + 0x38], 0
xchg r9b, r8b
rol ecx, cl
lea rcx, [rsp + 0x50]
and qword [rsp + 0x30], 0
movsx r9d, si
lea r8, [rsp + 0x50]
ror r9, 0xa1
sub rax, rcx
mov dword [rsp + 0x28], 0xd55
cmp r8b, dil
lea rcx, [rsp + 0x700]
shr r9b, 0xaa
sar rax, 1
ror r9b, cl
sbb r9w, 0x6c91
mov qword [rsp + 0x20], rcx
rol cl, 0x82
btc cx, 0x65
mov r9d, eax
sal cl, 0xcd
ror cl, 0x72
mov ecx, 0xfde9
test bpl, 0x13
xor edx, edx
jmp 0x180147561
call fcn.180137abc
mov ebp, eax
stc
cmp r12b, r8b
test eax, eax
jmp 0x180147573
je 0x180147611
xor esi, esi
jmp 0x180147580
test eax, eax
jmp 0x180147587
je 0x1801475f7
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
cmp dil, r12b
mov ecx, esi
lea r9, [rsp + 0x40]
add r8, 0xb9662df
mov r8d, ebp
cmc
stc
lea rdx, [rdx + rcx]
cmovbe cx, cx
rol cl, cl
sar cx, cl
mov rcx, r12
jmp 0x1801475c6
sub r8d, esi
jmp 0x1801475ce
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1801475db
je 0x180147611
add esi, dword [rsp + 0x40]
test spl, 0x8e
cmc
cmp esi, ebp
jmp 0x1801475f1
jb 0x18014758d
mov eax, edi
sub eax, r15d
stc
mov dword [rbx + 4], eax
test r9d, edi
clc
cmp rdi, r14
jmp 0x18014760c
jmp 0x18014748a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
sar ax, cl
shld rax, r10, 0x20
mov rax, rbx
bsr cx, ax
rcl cx, 0x74
mov rcx, qword [rsp + 0x1460]
cmp cl, r12b
jmp 0x18014763c
xor rcx, rsp
jmp 0x180147644
call fcn.1801152b0
lea r11, [rsp + 0x1470]
movzx r12d, si
movzx rdi, r15w
movsx r14w, r10b
mov rbx, qword [r11 + 0x30]
xchg bpl, sil
mov rbp, qword [r11 + 0x40]
mov rsp, r11
mov r12w, 0x20e7
movzx r14, r10w
pop r15
cmovge di, r13w
pop r14
jmp 0x180147686
pop r12
movsx rsi, r10w
movsx di, al
mov si, 0xec3
pop rdi
movzx esi, dx
cmovle si, bp
pop rsi
jmp 0x1801476a2
ret
Function at 0x140008a70
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x140016de0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x140008ae8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x140008ae8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x140008ae8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140008ae8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x140008adc
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140008af0
add rdx, 0x28
cmp rdx, r10
jne 0x140008ac8
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x140008b00
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x140008b0e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140008ae5
test r8d, r8d
jg 0x140008af8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret

Function at 0x140001998
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019e2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019e4
xor al, al
add rsp, 0x28
ret
Function at 0x1800017b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x18009c010]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
lea rsi, [0x180000000]
xor ebx, ebx
cmp qword [rsi + rbx*8 + 0x9cce0], 0
jne 0x18000180d
mov r8, qword [rsi + rbx*8 + 0x914a0]
lea rdx, str.ERROR:_Could_not_find__s_
inc edi
lea rcx, str.PatternSolver::CheckMissingPatterns
call fcn.18004f5c0
inc rbx
cmp rbx, 0x2c
jl 0x1800017e5
test edi, edi
jle 0x1800018df
xor eax, eax
mov dword [rbp + 0x27], 0
mov qword [rbp + 0x1f], rax
lea rdx, [rbp + 0x27]
xorps xmm0, xmm0
mov qword [rbp - 0x65], 0x8011
lea rax, str.Launch_anyway_nThe_game_might_crash_or_have_missing_features_
mov dword [rbp + 0x2f], 1
mov qword [rbp + 0x33], rax
lea rcx, [rbp - 0x79]
lea rax, str.Exit
mov dword [rbp + 0x3b], 7
mov qword [rbp + 0x3f], rax
xor r9d, r9d
lea rax, str.Warning
mov dword [rbp - 0x79], 0xa0
mov qword [rbp - 0x5d], rax
xor r8d, r8d
lea rax, [0x180064930]
mov qword [rbp - 0x55], 0xffff
mov qword [rbp - 0x4d], rax
lea rax, str.Could_not_start_MK1Hook__n_nOne_or_more_code_patterns_could_not_be_found__this_might_indicate_that_game_version_is_not_supported_or_the_plugin_has_not_been_updated._n_nMK1Hook_officially_is_only_tested_with_latest_Steam_version._nCheck_log_for_more_details._n
mov qword [rbp - 0x45], rax
lea rax, [rbp + 0x2f]
mov qword [rbp - 0x39], rax
movups xmmword [rbp - 0x75], xmm0
mov dword [rbp - 0x3d], 2
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp - 0x21], xmm0
movups xmmword [rbp - 0x11], xmm0
movups xmmword [rbp - 1], xmm0
movups xmmword [rbp + 0xf], xmm0
call qword [sym.imp.COMCTL32.dll_Ordinal_345]
test eax, eax
js 0x1800018df
mov ecx, dword [rbp + 0x27]
sub ecx, 1
je 0x1800018df
cmp ecx, 6
jne 0x1800018df
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.180001180
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180061f80
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret