joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ed7f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
cmp qword [r8 + 0x20], 0x10
jb 0x1401ed824
mov rdx, qword [r8 + 8]
jmp 0x1401ed828
lea rdx, [r8 + 8]
lea r13, [rcx + 8]
mov rdi, qword [r8 + 0x18]
mov rax, qword [0x14043ff58]
movsxd r14, dword [rax]
add r14, rax
mov r15d, dword [0x1403603f4]
movabs rbx, 0x7fffffffffffffff
cmp rdi, 0x10
mov qword [rbp - 8], rcx
jae 0x1401ed868
movups xmm0, xmmword [rdx]
movups xmmword [r13], xmm0
mov r12d, 0xf
jmp 0x1401ed8d1
mov qword [rbp - 0x10], rdx
mov r12, rdi
or r12, 0xf
cmp r12, rbx
cmovae r12, rbx
cmp r12, 0xfff
jb 0x1401ed8a0
lea rcx, [r12 + 0x28]
mov edx, 0xc2b36bea
call fcn.1400a24b0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1401ed8b2
lea rcx, [r12 + 1]
mov edx, 0xc2b36bea
call fcn.1400a24b0
mov rcx, rax
mov qword [r13], rcx
mov rax, qword [0x140478900]
lea r8, [rdi + rax]
inc r8
mov rdx, qword [rbp - 0x10]
call fcn.140335e20
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], r12
lea rdi, [0x14034fe38]
mov qword [rcx], rdi
mov r11d, dword [0x14043ff50]
lea edx, [r11 + 1]
mov dword [0x14043ff50], edx
xor eax, eax
mov r8d, 0
test r11d, edx
jne 0x1401ed935
xor r9d, r9d
mov eax, 0
mov r8d, 0
test r15d, r15d
jle 0x1401ed935
xor eax, eax
xor r8d, r8d
nop dword [rax]
movsxd r9, r9d
xor r8, qword [r14 + r9 + 8]
xor rax, qword [r14 + r9]
add r9d, 0x10
cmp r9d, r15d
jl 0x1401ed920
xorps xmm0, xmm0
movups xmmword [rcx + 0x40], xmm0
mov r14, qword [rsi + 0x18]
cmp qword [rsi + 0x20], 0x10
jb 0x1401ed94d
mov rsi, qword [rsi + 8]
jmp 0x1401ed951
add rsi, 8
lea r15, [rcx + 0x30]
cmp r14, 0x10
jae 0x1401ed96c
movups xmm0, xmmword [rsi]
movups xmmword [r15], xmm0
mov ebx, 0xf
jmp 0x1401ed9f5
mov r9, r14
or r9, 0xf
xor r10d, r10d
test r11d, edx
setne r10b
mov rdx, qword [0x140360418]
mov rcx, qword [0x140360410]
xor r11d, r11d
add r10, 0xffffffffffffffff
adc r11, 0xffffffffffffffff
sub rcx, rax
sbb rdx, r8
and rcx, r10
and rdx, r11
or rcx, rdx
add qword [0x140478900], rcx
cmp r9, rbx
cmovb rbx, r9
cmp rbx, 0xffe
jbe 0x1401ed9d6
lea rcx, [rbx + 0x28]
call fcn.14030debc
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x1401ed9e2
lea rcx, [rbx + 1]
call fcn.14030debc
mov rcx, rax
mov qword [r15], rcx
lea r8, [r14 + 1]
mov rdx, rsi
call fcn.140335e20
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], rbx
mov qword [rcx + 0x28], rdi
mov rax, rcx
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401f1f30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401f1f6c
test edx, edx
je 0x1401f1f9c
movzx eax, byte [0x14044049d]
cmp al, 0x5d
je 0x1401f1f64
mov cl, 0x1d
nop word cs:[rax + rax]
mov al, 0x83
lock cmpxchg byte [0x14044049d], cl
je 0x1401f1ffc
cmp al, 0x5d
jne 0x1401f1f50
lea rax, [0x140440490]
ret
test edx, edx
je 0x1401f1fcc
movzx eax, byte [0x14044046b]
cmp al, 0x39
je 0x1401f1f94
mov cl, 0xb5
nop dword [rax]
mov al, 0x3a
lock cmpxchg byte [0x14044046b], cl
je 0x1401f2031
cmp al, 0x39
jne 0x1401f1f80
lea rax, [0x140440460]
ret
movzx eax, byte [0x1404401b8]
cmp al, 0xa5
je 0x1401f1fc4
mov cl, 0xee
nop dword [rax]
mov al, 0x57
lock cmpxchg byte [0x1404401b8], cl
je 0x1401f2071
cmp al, 0xa5
jne 0x1401f1fb0
lea rax, [0x1404401b0]
ret
movzx eax, byte [0x140440180]
cmp al, 0x3e
je 0x1401f1ff4
mov cl, 0x52
nop dword [rax]
mov al, 0xb2
lock cmpxchg byte [0x140440180], cl
je 0x1401f20b1
cmp al, 0x3e
jne 0x1401f1fe0
lea rax, [0x140440170]
ret
xor eax, eax
lea rcx, [0x140440490]
lea rdx, [0x140360930]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x1401f2010
mov al, 0x5d
xchg byte [0x14044049d], al
lea rax, [0x140440490]
ret
xor eax, eax
lea rcx, [0x140440460]
lea rdx, [0x140360900]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x1401f2050
mov al, 0x39
xchg byte [0x14044046b], al
lea rax, [0x140440460]
ret
xor eax, eax
lea rcx, [0x1404401b0]
lea rdx, [0x140360640]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 8
jl 0x1401f2090
mov al, 0xa5
xchg byte [0x1404401b8], al
lea rax, [0x1404401b0]
ret
xor eax, eax
lea rcx, [0x140440170]
lea rdx, [0x140360610]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x1401f20d0
mov al, 0x3e
xchg byte [0x140440180], al
lea rax, [0x140440170]
ret
Function at 0x1401fbda0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov edi, r8d
mov rsi, rdx
test ecx, ecx
je 0x1401fbddc
mov rcx, rsi
test edi, edi
je 0x1401fbf85
call fcn.14030e0c8
jmp 0x1401fbf8a
cmp byte [rsi + 0x19], 0
jne 0x1401fbf8a
jmp 0x1401fbe0f
call fcn.1400a22e0
mov edx, 0x40
mov rcx, rsi
call fcn.1400a22e0
cmp byte [rbx + 0x19], 0
mov rsi, rbx
jne 0x1401fbf8a
mov rdx, qword [rsi + 0x10]
xor ecx, ecx
mov r8d, edi
xor r9d, r9d
call fcn.1401fbda0
mov rbx, qword [rsi]
mov r14, qword [rsi + 0x28]
test r14, r14
je 0x1401fbdf5
mov rax, qword [0x140441c08]
movsxd r15, dword [rax]
mov r12d, dword [0x1403616b4]
mov r13, qword [rsi + 0x30]
cmp r14, r13
je 0x1401fbf50
add r15, rax
jmp 0x1401fbec3
mov r11, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r11
cmp rcx, 0x20
jae 0x1401fbf9c
add rax, 0x28
movzx ecx, word [0x1403616b8]
and r8d, r9d
cmp r8d, 1
mov edx, 0
sbb edx, edx
sub ecx, r10d
test cx, dx
setne cl
or cl, byte [0x140477668]
and cl, 1
mov byte [0x140477668], cl
mov rdx, rax
mov rcx, r11
call fcn.1400a22e0
mov qword [r14 + 0x18], 0
mov qword [r14 + 0x20], 0xf
mov byte [r14 + 8], 0
add r14, 0x30
cmp r14, r13
je 0x1401fbf50
mov rax, qword [r14 + 0x20]
mov r8d, dword [0x140441c04]
lea r9d, [r8 - 0x2403c701]
add r9d, 0x2403c702
mov dword [0x140441c04], r9d
test r8d, r9d
je 0x1401fbef0
xor r10d, r10d
jmp 0x1401fbf10
xor ecx, ecx
mov r10d, 0
test r12d, r12d
jle 0x1401fbf10
xor r10d, r10d
movsxd rcx, ecx
xor r10w, word [r15 + rcx]
add ecx, 2
cmp ecx, r12d
jl 0x1401fbf00
cmp rax, 0xf
jbe 0x1401fbea1
mov rcx, qword [r14 + 8]
cmp byte [0x14047786c], 0
jne 0x1401fbe50
test byte [0x140477668], 1
jne 0x1401fbe50
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1401fbe9c
jmp 0x1401fbe50
mov rcx, qword [rsi + 0x28]
mov rdx, qword [rsi + 0x38]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401fbdf0
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1401fbfa1
add rdx, 0x27
mov rcx, rax
jmp 0x1401fbdf0
call fcn.14030e068
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1402ee57c
call fcn.1402ee57c
int3
Function at 0x14022fe20
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x158
mov rax, qword [0x1404678a8]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov edi, dword [rcx + 0x10]
mov esi, dword [rcx + 0x14]
mov r11d, dword [rcx + 0x18]
mov r10d, dword [rcx + 0x1c]
mov r13d, dword [rcx + 0x20]
mov r14d, dword [rcx + 0x24]
mov ebp, dword [rcx + 0x28]
mov ebx, dword [rcx + 0x2c]
movups xmm0, xmmword [rcx + 0x30]
movups xmm1, xmmword [rcx + 0x40]
movups xmm2, xmmword [rcx + 0x50]
mov qword [rsp + 0x48], rcx
movups xmm3, xmmword [rcx + 0x60]
movaps xmmword [rsp + 0x80], xmm3
movaps xmmword [rsp + 0x70], xmm2
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov eax, 0x10
nop word cs:[rax + rax]
mov ecx, dword [rsp + rax*4 + 0x48]
mov edx, ecx
rol edx, 0xf
mov r8d, ecx
rol r8d, 0xd
xor r8d, edx
shr ecx, 0xa
xor ecx, r8d
add ecx, dword [rsp + rax*4 + 0x34]
mov edx, dword [rsp + rax*4 + 0x14]
mov r8d, edx
rol r8d, 0x19
mov r9d, edx
rol r9d, 0xe
xor r9d, r8d
shr edx, 3
xor edx, r9d
add ecx, dword [rsp + rax*4 + 0x10]
add ecx, edx
mov dword [rsp + rax*4 + 0x50], ecx
inc rax
cmp rax, 0x40
jne 0x14022fea0
xor r15d, r15d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x34], r10d
mov r9d, r10d
mov dword [rsp + 0x30], r11d
mov r8d, r11d
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x28], edi
nop dword [rax + rax]
mov ecx, r13d
mov r12d, r14d
mov eax, ebp
mov edx, r13d
rol edx, 0x1a
mov r10d, r13d
rol r10d, 0x15
xor r10d, edx
mov edx, r13d
rol edx, 7
xor edx, r10d
mov r10d, r14d
and r10d, r13d
add r10d, ebx
mov ebx, r13d
not ebx
and ebx, ebp
add ebx, r10d
add ebx, edx
lea rdx, [0x140369200]
add ebx, dword [r15 + rdx]
add ebx, dword [rsp + r15 + 0x50]
mov r10d, edi
rol edi, 0x1e
mov edx, esi
mov esi, r10d
rol esi, 0x13
mov r11d, r8d
mov r8d, r10d
rol r8d, 0xa
xor esi, edi
xor r8d, esi
mov esi, r11d
or esi, edx
and esi, r10d
mov edi, r11d
and edi, edx
or edi, esi
add edi, r8d
mov r13d, r9d
add r13d, ebx
add edi, ebx
add r15, 4
mov ebx, ebp
mov ebp, r14d
mov r14d, ecx
mov r9d, r11d
mov r8d, edx
mov esi, r10d
cmp r15, 0x100
jne 0x14022ff20
add edi, dword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
mov dword [r8 + 0x10], edi
add r10d, dword [rsp + 0x2c]
mov dword [r8 + 0x14], r10d
add edx, dword [rsp + 0x30]
mov dword [r8 + 0x18], edx
add r11d, dword [rsp + 0x34]
mov dword [r8 + 0x1c], r11d
add r13d, dword [rsp + 0x38]
mov dword [r8 + 0x20], r13d
add ecx, dword [rsp + 0x3c]
mov dword [r8 + 0x24], ecx
add r12d, dword [rsp + 0x40]
mov dword [r8 + 0x28], r12d
add eax, dword [rsp + 0x44]
mov dword [r8 + 0x2c], eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14030df10
nop
add rsp, 0x158
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1402e1d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ecx, edx
mov rax, qword [0x1404678a8]
xor rax, rsp
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [0x1403835b0]
movaps xmmword [rsp + 0x20], xmm0
movabs rax, 0x1716151413121110
mov qword [rsp + 0x30], rax
mov word [rsp + 0x38], 0x1918
mov byte [rsp + 0x3a], 0x1a
mov r8d, 0x1b
nop word cs:[rax + rax]
mov eax, ecx
xor edx, edx
div r8d
movzx eax, byte [rsp + r8 + 0x1f]
movzx r9d, byte [rsp + rdx + 0x20]
mov byte [rsp + r8 + 0x1f], r9b
mov byte [rsp + rdx + 0x20], al
imul eax, ecx, 0x6255
add eax, 0x3619
movzx ecx, ax
dec r8
cmp r8, 1
ja 0x1402e1d70
xor eax, eax
lea rdx, [0x14047c100]
xor r8d, r8d
jmp 0x1402e1e08
mov r10d, r8d
and r10b, 7
mov ecx, r8d
and ecx, 7
mov r11d, 0xffffffff
shl r11d, cl
lea edi, [r9 + r8]
add ecx, r9d
mov ebx, 0xffffffff
shl ebx, cl
xor ebx, r11d
shr r8d, 3
mov byte [rdx + rsi*4], r8b
mov byte [rdx + rsi*4 + 3], r10b
mov byte [rdx + rsi*4 + 1], bl
mov byte [rdx + rsi*4 + 2], bh
inc rax
mov r8d, edi
cmp rax, 0x1b
je 0x1402e1e50
movzx esi, byte [rsp + rax + 0x20]
mov r9d, 6
cmp rsi, 0xf
ja 0x1402e1dc0
mov r9d, 5
cmp sil, 7
ja 0x1402e1dc0
mov r9d, 4
cmp sil, 3
ja 0x1402e1dc0
mov r9d, 3
cmp sil, 1
ja 0x1402e1dc0
cmp rsi, 1
mov r9d, 2
sbb r9d, 0
jmp 0x1402e1dc0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14030df10
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800025e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002687
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002687
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x19e3653d
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002682
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002660
cmp r8d, 0xa6f9acaf
je 0x18000268c
test r9d, r9d
jne 0x180002640
mov rax, qword [rax]
jmp 0x180002610
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r10
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.18000f4f0
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002755
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002755
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x16d455fa
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x180002750
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x180002730
cmp edx, 0x1831716e
je 0x18000275a
test r9d, r9d
jne 0x180002710
mov rcx, qword [rcx]
jmp 0x1800026e0
mov ecx, dword [r11 + 0x24]
mov r8, rsi
add rcx, r10
mov rdx, rbp
movzx r9d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800027a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002847
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002847
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x876d6e8d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002842
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002820
cmp r8d, 0x1e2689b1
je 0x18000284c
test r9d, r9d
jne 0x180002800
mov rax, qword [rax]
jmp 0x1800027d0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002c30
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002d07
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002d07
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x94226a01
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002d02
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002ce0
cmp r8d, 0xf7535733
je 0x180002d0c
test r9d, r9d
jne 0x180002cc0
mov rax, qword [rax]
jmp 0x180002c90
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180012b20]
addsd xmm8, qword [0x180012b20]
movups xmm9, xmmword [0x180012a58]
movups xmm10, xmmword [0x180019348]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.1800025e0
cmp word [rax], 0
je 0x180002d86
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002d70
xor edx, edx
add ecx, 1
je 0x180002d8a
mov rdx, rax
jmp 0x180002d8a
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800157e8]
movaps xmm0, xmmword [0x180012d90]
mov rbx, qword [0x180015838]
mov qword [rsp + 0x20], rax
mov rax, qword [0x180019810]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002e38
mov rax, qword [0x180015960]
lea r8, str.Canvas.K2_DrawText
add rax, 0x13efec8
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x180019810], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x180002e90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x100
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002f57
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002f57
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xff16467f
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002f52
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002f30
cmp r8d, 0xc1d3eb7d
je 0x180002f5c
test r9d, r9d
jne 0x180002f10
mov rax, qword [rax]
jmp 0x180002ee0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180012b20]
addsd xmm8, qword [0x180012b20]
movups xmm9, xmmword [0x180012a58]
movups xmm10, xmmword [0x180019348]
movaps xmm6, xmmword [rsi]
call fcn.1800025e0
cmp word [rax], 0
je 0x180002fd6
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002fc0
xor edx, edx
add ecx, 1
je 0x180002fda
mov rdx, rax
jmp 0x180002fda
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800157e8]
movaps xmm0, xmmword [0x180012d90]
mov rbx, qword [0x180015838]
mov qword [rsp + 0x20], rax
mov rax, qword [0x180019810]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movaps xmm0, xmmword [r14]
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x18000308b
mov rax, qword [0x180015960]
lea r8, str.Canvas.K2_DrawText
add rax, 0x13efec8
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x180019810], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r14
ret
Function at 0x1800019a0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x40
cmp edx, 1
jne 0x180001a43
call fcn.180001890
test al, al
jne 0x180001a4e
xor ecx, ecx
mov eax, 0x40000000
cpuid
mov r10d, ecx
mov r8d, eax
xor ecx, ecx
mov r9d, edx
mov r11d, ebx
mov eax, 1
cpuid
xor ecx, ecx
cpuid
cmp eax, r8d
jne 0x180001a4e
cmp ebx, r11d
jne 0x180001a4e
cmp ecx, r10d
jne 0x180001a4e
cmp edx, r9d
jne 0x180001a4e
xor ecx, ecx
mov eax, 0x4201337
cpuid
mov r8d, eax
mov r10d, ecx
xor ecx, ecx
mov eax, 0x40000000
mov r9d, edx
mov r11d, ebx
cpuid
cmp r8d, eax
jne 0x180001a4e
cmp r11d, ebx
jne 0x180001a4e
cmp r10d, ecx
jne 0x180001a4e
cmp r9d, edx
jne 0x180001a4e
xor eax, eax
lea r8, [0x180001220]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1400022e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000232e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000232e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000232e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000232e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000232e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002330
xor al, al
add rsp, 0x28
ret