joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800725f0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, r8
mov rbx, rdx
mov rsi, rcx
lea rcx, [rsp + 0x50]
mov r8d, 0xb
mov rdx, rax
call fcn.1800722b0
mov dword [rsp + 0x30], 0x800
mov dword [rsp + 0x34], 0
movzx eax, byte [0x1801fba30]
mov rcx, qword [0x1801fb9b8]
test rcx, rcx
jne 0x180072658
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x180072799
mov rcx, rax
mov qword [0x1801fb9b8], rax
mov r8d, 0x800
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x180072799
mov r14, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x800
mov qword [rsp + 0x48], 0
mov rdi, qword [rsp + 0x50]
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x34]
mov rbp, qword [sym.imp.advapi32.dll_RegQueryValueExW]
lea r12, [rsp + 0x38]
nop word cs:[rax + rax]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call rbp
cmp eax, 0xea
jne 0x1800726f5
mov r8d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
sub rax, rdx
cmp rax, r8
jae 0x1800726b0
mov rcx, r12
call fcn.180165a60
mov r14, qword [rsp + 0x38]
jmp 0x1800726b0
test eax, eax
jne 0x180072726
mov eax, dword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x34]
cmp eax, 0xb
jbe 0x18007277b
movabs rax, 0xde00000002
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
cmp qword [rsp + 0x40], 0
jne 0x18007273d
jmp 0x18007274f
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
cmp qword [rsp + 0x40], 0
je 0x18007274f
mov rcx, qword [0x1801fb9b8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x58], 0
je 0x180072769
mov rcx, qword [0x1801fb9b8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x48]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x58], 0
jne 0x180072757
jmp 0x180072769
mov ecx, 1
mov edx, 0x800
call fcn.180166e20
ud2
Function at 0x180085670
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180085690
test al, 1
je 0x180085861
test al, 2
jne 0x180085861
test al, 8
jne 0x1800857b5
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008570d
xorps xmm6, xmm6
test eax, eax
jne 0x180085739
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.180085560
mov byte [rsi + 0xa8], 4
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180085799
test eax, eax
jne 0x1800857d3
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x1800857d3
test al, 0x10
je 0x1800857d3
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x180085861
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107750
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180085861
jne 0x180085854
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180085815
call fcn.1800775a0
lea rcx, [rsi + 0x30]
call fcn.180085560
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x180085834
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fb9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x180086500
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180086520
test al, 1
je 0x1800866f1
test al, 2
jne 0x1800866f1
test al, 8
jne 0x180086645
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008659d
xorps xmm6, xmm6
test eax, eax
jne 0x1800865c9
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.180085560
mov byte [rsi + 0xa8], 4
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180086629
test eax, eax
jne 0x180086663
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x180086663
test al, 0x10
je 0x180086663
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x1800866f1
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801067c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800866f1
jne 0x1800866e4
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800866a5
call fcn.180077500
lea rcx, [rsi + 0x30]
call fcn.180085560
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x1800866c4
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fb9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x180086fb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180086fc0
test al, 1
je 0x180087061
test al, 2
jne 0x180087061
test al, 8
jne 0x180086ffa
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.180086de0
jmp 0x180087014
test al, 0x10
je 0x180087014
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x180087061
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107750
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180087061
jne 0x180087057
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.180087070
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x1800877c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800877d0
test al, 1
je 0x180087871
test al, 2
jne 0x180087871
test al, 8
jne 0x18008780a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.180086de0
jmp 0x180087824
test al, 0x10
je 0x180087824
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x180087871
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801067c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180087871
jne 0x180087867
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.180087880
nop
add rsp, 0xa0
pop rsi
ret
ud2

Function at 0x1800889e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180088a00
test al, 1
je 0x180088bd2
test al, 2
jne 0x180088bd2
test al, 8
jne 0x180088b26
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180088a7d
xorps xmm6, xmm6
test eax, eax
jne 0x180088aa9
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800888f0
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180088b0a
test eax, eax
jne 0x180088b44
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x180088b44
test al, 0x10
je 0x180088b44
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180088bd2
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107750
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180088bd2
jne 0x180088bc5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180088b86
call fcn.1800775a0
lea rcx, [rsi + 0x30]
call fcn.1800888f0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180088ba5
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fb9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x180089900
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180089920
test al, 1
je 0x180089af2
test al, 2
jne 0x180089af2
test al, 8
jne 0x180089a46
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x18008999d
xorps xmm6, xmm6
test eax, eax
jne 0x1800899c9
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800888f0
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x180089a2a
test eax, eax
jne 0x180089a64
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x180089a64
test al, 0x10
je 0x180089a64
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180089af2
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801067c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180089af2
jne 0x180089ae5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180089aa6
call fcn.180077500
lea rcx, [rsi + 0x30]
call fcn.1800888f0
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180089ac5
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fb9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x18008da50
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008da60
test al, 1
je 0x18008daed
test al, 2
jne 0x18008daed
test al, 8
jne 0x18008da92
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18008d8b0
jmp 0x18008daa6
test al, 0x10
je 0x18008daa6
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18008daed
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107750
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008daed
jne 0x18008dae6
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.18008db00
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x18008e020
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008e030
test al, 1
je 0x18008e0bd
test al, 2
jne 0x18008e0bd
test al, 8
jne 0x18008e062
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.18008d8b0
jmp 0x18008e076
test al, 0x10
je 0x18008e076
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18008e0bd
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801067c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008e0bd
jne 0x18008e0b6
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.18008e0d0
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800a4c70
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a4c80
test al, 1
je 0x1800a4d0a
test al, 2
jne 0x1800a4d0a
test al, 8
jne 0x1800a4caf
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800a4ad0
jmp 0x1800a4cc3
test al, 0x10
je 0x1800a4cc3
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800a4d0a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107750
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a4d0a
jne 0x1800a4d03
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800a4d10
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x1800a52b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800a52c0
test al, 1
je 0x1800a534a
test al, 2
jne 0x1800a534a
test al, 8
jne 0x1800a52ef
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800a4ad0
jmp 0x1800a5303
test al, 0x10
je 0x1800a5303
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800a534a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801067c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800a534a
jne 0x1800a5343
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800a5350
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800aa0e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800aa100
test al, 1
je 0x1800aa2d2
test al, 2
jne 0x1800aa2d2
test al, 8
jne 0x1800aa226
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800aa17d
xorps xmm6, xmm6
test eax, eax
jne 0x1800aa1a9
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800aa020
mov qword [rsi + 0x30], 3
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800aa20a
test eax, eax
jne 0x1800aa244
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x1800aa244
test al, 0x10
je 0x1800aa244
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800aa2d2
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107750
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800aa2d2
jne 0x1800aa2c5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800aa286
call fcn.1800775a0
lea rcx, [rsi + 0x30]
call fcn.1800aa020
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800aa2a5
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fb9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1800aaf50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800aaf70
test al, 1
je 0x1800ab142
test al, 2
jne 0x1800ab142
test al, 8
jne 0x1800ab096
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800aafed
xorps xmm6, xmm6
test eax, eax
jne 0x1800ab019
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rbx + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe0]
mov qword [rax + 0xe0], 1
mov qword [rax + 0xe8], rdi
lea rcx, [rsi + 0x30]
call fcn.1800aa020
mov qword [rsi + 0x30], 3
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x110]
cmp eax, 1
je 0x1800ab07a
test eax, eax
jne 0x1800ab0b4
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc0]
lea rdx, [0x1801004d0]
call fcn.1800f3240
mov byte [rdi + 0x110], 1
mov eax, dword [0x1801fba34]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe0], xmm6
jmp 0x1800ab0b4
test al, 0x10
je 0x1800ab0b4
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800ab142
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801067c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800ab142
jne 0x1800ab135
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800ab0f6
call fcn.180077500
lea rcx, [rsi + 0x30]
call fcn.1800aa020
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800ab115
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1801fb9b8]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.kernel32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x1800b05a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b05b0
test al, 1
je 0x1800b0652
test al, 2
jne 0x1800b0652
test al, 8
jne 0x1800b05eb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800b0ba0
jmp 0x1800b0605
test al, 0x10
je 0x1800b0605
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800b0652
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107750
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b0652
jne 0x1800b0648
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800b0660
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800b0d40
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b0d50
test al, 1
je 0x1800b0df2
test al, 2
jne 0x1800b0df2
test al, 8
jne 0x1800b0d8b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800b0ba0
jmp 0x1800b0da5
test al, 0x10
je 0x1800b0da5
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800b0df2
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801067c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b0df2
jne 0x1800b0de8
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800b0e00
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800c2220
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800c2230
test al, 1
je 0x1800c22d2
test al, 2
jne 0x1800c22d2
test al, 8
jne 0x1800c226b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800c2090
jmp 0x1800c2285
test al, 0x10
je 0x1800c2285
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800c22d2
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180107750
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800c22d2
jne 0x1800c22c8
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800c22e0
nop
add rsp, 0xfa0
pop rsi
ret
ud2

Function at 0x1800c28c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800c28d0
test al, 1
je 0x1800c2972
test al, 2
jne 0x1800c2972
test al, 8
jne 0x1800c290b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800c2090
jmp 0x1800c2925
test al, 0x10
je 0x1800c2925
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800c2972
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1801067c0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800c2972
jne 0x1800c2968
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800c2980
nop
add rsp, 0xfa0
pop rsi
ret
ud2