joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001b565
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x140024620]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x14002ed70]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x140024610]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x14001b67a
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x140024620]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x14001b648
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x140024620]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x14001b689
lea rax, [0x140024620]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14001b6c5
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14001b733
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x140024610]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14001b77d
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x14001b77d
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x140024620]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x14001b76f
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x1400111d1
Capabilities:
Parse pe header

Disassembly:
jmp 0x140011c40
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a4]
call fcn.140011398
nop
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140011c82
xor eax, eax
jmp 0x140011cdb
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x140011cab
xor eax, eax
jmp 0x140011cdb
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x128]
mov qword [rcx], rax
mov eax, 1
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x140013b10
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001128f
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014e60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014e80
xor al, al
jmp 0x140014f01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014e93
xor al, al
jmp 0x140014f01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014ebd
xor al, al
jmp 0x140014f01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014ed1
xor al, al
jmp 0x140014f01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014ee3
xor al, al
jmp 0x140014f01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014eff
xor al, al
jmp 0x140014f01
mov al, 1
add rsp, 0x38
ret
Function at 0x140011406
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1400122a0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a4]
call fcn.140011398
nop
mov dword [rbp + 4], 0x811c9dc5
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
test eax, eax
je 0x140012306
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
mov dword [rbp + 4], eax
imul eax, dword [rbp + 4], 0x1000193
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
jmp 0x1400122c7
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x140012d50
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113c0
movzx eax, al
test eax, eax
jne 0x140012d70
mov ecx, 7
call fcn.140011339
nop
mov byte [rsp + 0x20], 0
call fcn.14001134d
mov byte [rsp + 0x21], al
cmp dword [0x14001edf8], 1
jne 0x140012d94
mov ecx, 7
call fcn.140011339
nop
jmp 0x140012dec
cmp dword [0x14001edf8], 0
jne 0x140012de7
mov dword [0x14001edf8], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.14001119a
test eax, eax
je 0x140012dc8
mov eax, 0xff
jmp 0x140012ef1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011343
mov dword [0x14001edf8], 2
jmp 0x140012dec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011325
call fcn.1400112b2
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012e49
mov rcx, qword [rsp + 0x30]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140012e49
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.1400112e9
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012e7d
mov rcx, qword [rsp + 0x38]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140012e7d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001137f
nop
call fcn.140012fa0
mov dword [rsp + 0x28], eax
call fcn.14001128f
movzx eax, al
test eax, eax
jne 0x140012e9c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012eab
call fcn.140011389
nop
xor edx, edx
mov cl, 1
call fcn.140011140
mov eax, dword [rsp + 0x28]
jmp 0x140012ef1
add rsp, 0x68
ret
Function at 0x180007290
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x1806ef188]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x20
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.18020a950
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x1806ef188]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x20
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x180007420
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x18000743c
cmp rcx, r8
jl 0x18000742f
mov qword [rdx + 0x80], rcx
test dword [0x1806e6a38], 1
je 0x18000746b
cmp byte [rsp + 0xd0], 0
je 0x18000746b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x180006f90
mov rsp, r8
jmp rax
Function at 0x180007470
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x1806ef188]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x20
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180007990
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x180011c50
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x180011c8d
test rdx, rdx
je 0x180011c8d
mov rax, qword [rax]
cmp rax, r9
jne 0x180011c70
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret
Function at 0x18019ee80
Capabilities:
Encode data using xor

Disassembly:
cmp edx, 8
jae 0x18019ee8f
cmp edx, 4
jae 0x18019eeec
jmp 0x18019ef64
mov eax, edx
shr eax, 3
add r8d, dword [rcx]
mov r10d, dword [rcx + 4]
xor r9d, r8d
rol r8d, 0x14
add r8d, r9d
rol r9d, 9
xor r9d, r8d
rol r8d, 0x1b
add r8d, r9d
rol r9d, 0x13
add r10d, r8d
mov r8d, r9d
xor r8d, r10d
rol r10d, 0x14
add r10d, r8d
rol r8d, 9
xor r8d, r10d
rol r10d, 0x1b
add r10d, r8d
rol r8d, 0x13
mov r9d, r8d
add rcx, 8
dec eax
mov r8d, r10d
jne 0x18019ee94
test dl, 4
je 0x18019ef0b
add r8d, dword [rcx]
xor r9d, r8d
rol r8d, 0x14
add r8d, r9d
rol r9d, 9
xor r9d, r8d
rol r8d, 0x1b
add r8d, r9d
rol r9d, 0x13
mov eax, edx
and rax, 7
mov eax, dword [rcx + rax - 4]
shr eax, 8
or eax, 0x80000000
mov ecx, edx
not ecx
shl ecx, 3
shr eax, cl
add eax, r8d
mov edx, r9d
xor edx, eax
rol eax, 0x14
add eax, edx
rol edx, 9
xor edx, eax
rol eax, 0x1b
add eax, edx
rol edx, 0x13
mov r8d, edx
xor r8d, eax
rol eax, 0x14
add eax, r8d
rol r8d, 9
xor r8d, eax
rol eax, 0x1b
add eax, r8d
mov r9d, r8d
rol r9d, 0x13
xor eax, r9d
ret
mov eax, 0x80
test dl, 1
je 0x18019ef7d
mov eax, edx
and rax, 2
movzx eax, byte [rcx + rax]
or eax, 0x8000
test dl, 2
je 0x18019ef26
shl eax, 0x10
movzx ecx, word [rcx]
or eax, ecx
jmp 0x18019ef26
Function at 0x180285d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0xa8]
test eax, eax
jne 0x180285da5
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180285040
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0x108]
mov rcx, rax
call fcn.180285040
mov rcx, rax
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.18028c700

Function at 0x180288900
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rbx, rbx
je 0x180288935
lea rcx, [0x180442c70]
cmp qword [rcx - 8], 0
jne 0x180288942
mov rcx, qword [0x1806d1b20]
mov rcx, qword [rcx + 0x10]
mov rdx, rbx
cmp dword [rcx], ecx
add rsp, 0x20
pop rbx
jmp 0x180289be0
call fcn.180282f90
mov rcx, rax
call fcn.180007080
call fcn.180002bc3
jmp 0x18028891b
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rbx, rdx
mov r8d, dword [rbx + 8]
mov edx, r8d
xor ecx, ecx
test r8d, r8d
jle 0x180289c1a
nop dword [rax]
mov eax, ecx
movzx eax, word [rbx + rax*2 + 0xc]
mov r10d, edx
shl r10d, 7
xor eax, r10d
add edx, eax
inc ecx
cmp r8d, ecx
jg 0x180289c00
mov r8d, edx
sar r8d, 0x11
sub edx, r8d
mov r8d, edx
sar r8d, 0xb
sub edx, r8d
mov r8d, edx
sar r8d, 5
mov edi, edx
sub edi, r8d
mov r8, qword [rsi + 8]
mov edx, edi
and edx, dword [rsi + 0x14]
cmp edx, dword [r8 + 8]
jae 0x180289cd6
mov rbp, qword [r8 + rdx*8 + 0x10]
test rbp, rbp
je 0x180289c98
cmp dword [rbp + 0x18], edi
jne 0x180289c8f
mov r8, qword [rbp + 8]
mov r8, qword [r8 + 8]
cmp byte [r8], r8b
cmp r8, rbx
je 0x180289cc9
mov edx, dword [r8 + 8]
mov ecx, dword [rbx + 8]
cmp edx, ecx
jne 0x180289c8f
lea rcx, [r8 + 0xc]
mov r8d, dword [r8 + 8]
add r8d, r8d
lea rdx, [rbx + 0xc]
call fcn.1801a5680
test eax, eax
jne 0x180289cc9
mov rbp, qword [rbp + 0x10]
test rbp, rbp
jne 0x180289c57
lea rcx, [0x18047d520]
call fcn.180006b00
mov rbp, rax
lea rcx, [rbp + 8]
mov rdx, rbx
call fcn.180006d10
mov rcx, rsi
mov rdx, rbp
mov r8d, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
jmp fcn.180289e90
mov rax, qword [rbp + 8]
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
call fcn.180239b30
int3
Function at 0x180289ce0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov esi, r8d
mov ecx, esi
xor eax, eax
test ecx, ecx
jle 0x180289d42
test rbx, rbx
je 0x180289d20
cmp dword [rbx + 8], ecx
jl 0x180289d20
mov edx, eax
movzx edx, word [rbx + rdx*2 + 0xc]
mov r8d, ecx
shl r8d, 7
xor edx, r8d
add ecx, edx
inc eax
cmp eax, esi
jl 0x180289d05
jmp 0x180289d42
cmp eax, dword [rbx + 8]
jae 0x180289e37
mov edx, eax
movzx edx, word [rbx + rdx*2 + 0xc]
mov r8d, ecx
shl r8d, 7
xor edx, r8d
add ecx, edx
inc eax
cmp eax, esi
jl 0x180289d20
mov eax, ecx
sar eax, 0x11
sub ecx, eax
mov eax, ecx
sar eax, 0xb
sub ecx, eax
mov eax, ecx
sar eax, 5
mov ebp, ecx
sub ebp, eax
mov rcx, qword [rdi + 8]
mov eax, ebp
and eax, dword [rdi + 0x14]
cmp eax, dword [rcx + 8]
jae 0x180289e37
mov rcx, qword [rcx + rax*8 + 0x10]
test rcx, rcx
je 0x180289dea
cmp dword [rcx + 0x18], ebp
jne 0x180289de1
mov rax, qword [rcx + 8]
mov rdx, qword [rax + 8]
mov r8d, dword [rdx + 8]
cmp r8d, esi
jne 0x180289de1
xor r10d, r10d
test r8d, r8d
jle 0x180289e2c
test rbx, rbx
je 0x180289dbd
cmp dword [rbx + 8], r8d
jl 0x180289dbd
mov r9d, r10d
movzx r11d, word [rdx + r9*2 + 0xc]
cmp r11w, word [rbx + r9*2 + 0xc]
jne 0x180289de1
inc r10d
cmp r8d, r10d
jg 0x180289da2
jmp 0x180289e2c
mov r9d, r10d
movzx r9d, word [rdx + r9*2 + 0xc]
cmp r10d, dword [rbx + 8]
jae 0x180289e37
mov r11d, r10d
cmp r9w, word [rbx + r11*2 + 0xc]
jne 0x180289de1
inc r10d
cmp r8d, r10d
jg 0x180289dbd
jmp 0x180289e2c
mov rcx, qword [rcx + 0x10]
test rcx, rcx
jne 0x180289d75
lea rcx, [0x18047d520]
call fcn.180006b00
mov r14, rax
mov rcx, rbx
mov r8d, esi
xor edx, edx
cmp dword [rcx], ecx
call fcn.180181820
lea rcx, [r14 + 8]
mov rdx, rax
call fcn.180006d10
mov rcx, rdi
mov rdx, r14
mov r8d, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
jmp fcn.180289e90
add rsp, 0x20
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
call fcn.180239b30
int3

Function at 0x180289e40
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 8]
mov edx, eax
xor r8d, r8d
test eax, eax
jle 0x180289e6e
nop dword [rax]
mov r10d, r8d
movzx r10d, word [rcx + r10*2 + 0xc]
mov r9d, edx
shl r9d, 7
xor r10d, r9d
add edx, r10d
inc r8d
cmp eax, r8d
jg 0x180289e50
mov eax, edx
sar eax, 0x11
sub edx, eax
mov eax, edx
sar eax, 0xb
sub edx, eax
mov eax, edx
sar eax, 5
mov ecx, edx
sub ecx, eax
mov eax, ecx
ret
Function at 0x1803c9b40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x1803c9bdd
xor eax, eax
cmp r8d, 4
jl 0x1803c9b91
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x1803c9bd8
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x1803c9bd1
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x1803c9bc9
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x1803c9bc1
add rax, 4
test r8d, r8d
jle 0x1803c9dba
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x1803c9bd8
inc rax
test r8d, r8d
jg 0x1803c9ba0
jmp 0x1803c9dba
add eax, 3
jmp 0x1803c9db5
add eax, 2
jmp 0x1803c9db5
inc eax
jmp 0x1803c9db5
jmp 0x1803c9db5
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x1803c9cf6
add rax, 0x10
cmp rax, r10
jbe 0x1803c9c00
mov eax, r8d
test al, 7
je 0x1803c9dba
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1803c9dba
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x1803c9dac
mov ecx, 0x20
jmp 0x1803c9daf
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x1803c9d9d
mov r8d, 0x20
jmp 0x1803c9da1
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x1803c9db5
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret