joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e0a8c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400e0b13
mov rsi, rbx
cmp word [rax], bp
je 0x1400e0ad2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400e0abc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400e0ab8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400dc818
mov rdi, rax
test rax, rax
je 0x1400e0b00
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400c1bc0
mov rbp, rdi
xor ecx, ecx
call fcn.1400d9960
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400e37a0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400d85a4
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400e3841
cmp ebx, dword [rsp + 0x30]
je 0x1400e383a
test esi, esi
je 0x1400e383a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400e3815
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400e3822
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400e37ff
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400e3826
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400e3843
mov eax, 1
jmp 0x1400e3843
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e73a4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400dbc38
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400dbc38
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400e74f4
cmp rax, 0xffffffffffffffff
je 0x1400e74f4
xor edi, edi
test rbp, rbp
jle 0x1400e749f
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400d9f4c
mov rbx, rax
test rax, rax
jne 0x1400e742c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400e7495
mov edx, 0x8000
mov ecx, r14d
call fcn.1400d532c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400d9658
cmp eax, 0xffffffff
je 0x1400e7475
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400e743c
mov edx, r15d
mov ecx, r14d
call fcn.1400d532c
jmp 0x1400e7495
cmp byte [rsi + 0x38], dil
je 0x1400e748c
cmp dword [rsi + 0x34], 5
jne 0x1400e748c
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recvfrom
cmp byte [rsi + 0x30], dil
je 0x1400e7495
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400d9960
jmp 0x1400e7508
jns 0x1400e7508
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400dbc38
cmp rax, 0xffffffffffffffff
jne 0x1400e74c0
cmp byte [rsi + 0x30], dil
je 0x1400e7508
mov edi, dword [rsi + 0x2c]
jmp 0x1400e7508
mov ecx, r14d
call fcn.1400e124c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400e7508
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recvfrom
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recvfrom
jmp 0x1400e7508
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400e7501
mov eax, dword [rsi + 0x2c]
jmp 0x1400e7506
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400dbc38
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400e82c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400e82e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400e82e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18002a7b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rcx, qword [0x1800821a8]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007f6c0]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18002a876
mov eax, dword [0x1800734b8]
xor r8d, r8d
mov dword [rsp + 0x90], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x1800734bc]
mov word [rsp + 0x94], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x18002a820
lea rdx, [rsp + 0x90]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x1800821a8], rax
xorps xmm1, xmm1
mov qword [rsp + 0x28], 0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
cvtss2sd xmm1, xmm6
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
cvtss2sd xmm0, xmm7
call fcn.18002be40
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x70
pop rbx
ret

Function at 0x18002a8d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdx, qword [0x1800821a0]
mov rbx, rcx
mov rdi, qword [0x18007f6e0]
movabs rcx, 0x7ffffffdfffe
lea rax, [rdx - 0x10000]
cmp rax, rcx
jbe 0x18002a980
mov eax, dword [0x1800734b0]
xor r8d, r8d
mov dword [rsp + 0x68], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x1800734b4]
mov word [rsp + 0x6c], ax
nop dword [rax]
nop dword [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x68], al
inc r8
cmp r8, 6
jb 0x18002a930
lea rdx, [rsp + 0x68]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rdx, rax
mov qword [0x1800821a0], rax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
mov rcx, rbx
mov qword [rsp + 0x40], 0
call fcn.18002be40
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x18002a9d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rcx, qword [0x1800821b0]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007f6c8]
movaps xmmword [rsp + 0x50], xmm6
movaps xmm6, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18002aa80
mov eax, dword [0x1800734c0]
xor r8d, r8d
mov dword [rsp + 0x78], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x1800734c4]
mov word [rsp + 0x7c], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x78], al
inc r8
cmp r8, 6
jb 0x18002aa30
lea rdx, [rsp + 0x78]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x1800821b0], rax
xorps xmm0, xmm0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rcx
cvtss2sd xmm0, xmm6
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x40], 0
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.18002be40
movaps xmm6, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x60
pop rbx
ret

Function at 0x18002abc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rcx, qword [0x1800821b0]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007f6d0]
movaps xmmword [rsp + 0x50], xmm6
movaps xmm6, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18002ac70
mov eax, dword [0x1800734c0]
xor r8d, r8d
mov dword [rsp + 0x78], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x1800734c4]
mov word [rsp + 0x7c], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x78], al
inc r8
cmp r8, 6
jb 0x18002ac20
lea rdx, [rsp + 0x78]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x1800821b0], rax
xorps xmm0, xmm0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rcx
cvtss2sd xmm0, xmm6
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x40], 0
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.18002be40
movaps xmm6, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x60
pop rbx
ret
Function at 0x18002acc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rcx, qword [0x1800821a8]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007f6b0]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18002ad86
mov eax, dword [0x1800734b8]
xor r8d, r8d
mov dword [rsp + 0x90], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x1800734bc]
mov word [rsp + 0x94], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x18002ad30
lea rdx, [rsp + 0x90]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x1800821a8], rax
xorps xmm1, xmm1
mov qword [rsp + 0x28], 0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
cvtss2sd xmm1, xmm6
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
cvtss2sd xmm0, xmm7
call fcn.18002be40
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x70
pop rbx
ret

Function at 0x18002ade0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rcx, qword [0x1800821a8]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007f6b8]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18002aea6
mov eax, dword [0x1800734b8]
xor r8d, r8d
mov dword [rsp + 0x90], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x1800734bc]
mov word [rsp + 0x94], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x18002ae50
lea rdx, [rsp + 0x90]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x1800821a8], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x30], rcx
movaps xmm1, xmm6
mov qword [rsp + 0x38], rbx
movaps xmm0, xmm7
mov qword [rsp + 0x40], 0
call fcn.18002be40
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbx
ret
Function at 0x18002aef0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rcx, qword [0x1800821a8]
movabs rdx, 0x7ffffffdfffe
mov rbx, qword [0x18007f6b8]
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18002afb6
mov eax, dword [0x1800734b8]
xor r8d, r8d
mov dword [rsp + 0x90], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x1800734bc]
mov word [rsp + 0x94], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x90], al
inc r8
cmp r8, 6
jb 0x18002af60
lea rdx, [rsp + 0x90]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x1800821a8], rax
xorps xmm1, xmm1
mov qword [rsp + 0x28], 0
xorps xmm0, xmm0
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rbx
cvtss2sd xmm1, xmm6
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], rax
cvtss2sd xmm0, xmm7
call fcn.18002be40
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
cvtsd2ss xmm0, xmm0
add rsp, 0x70
pop rbx
ret

Function at 0x18002b010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov r10, qword [0x1800821b8]
mov rbp, rcx
mov r14, qword [0x18007f688]
movabs rcx, 0x7ffffffdfffe
mov rbx, r9
mov rdi, r8
mov rsi, rdx
lea rax, [r10 - 0x10000]
cmp rax, rcx
jbe 0x18002b0d0
mov eax, dword [0x1800734c8]
xor r8d, r8d
mov dword [rsp + 0x30], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x1800734cc]
mov word [rsp + 0x34], ax
nop dword [rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x30], al
inc r8
cmp r8, 6
jb 0x18002b080
lea rdx, [rsp + 0x30]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov r10, rax
mov qword [0x1800821b8], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], 0
mov r9, rbx
mov qword [rsp + 0x20], rax
mov r8, rdi
mov qword [rsp + 0x38], r10
mov rdx, rsi
mov qword [rsp + 0x40], r14
mov rcx, rbp
mov qword [rsp + 0x48], 0
call fcn.18002be40
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x18002b3e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
movzx r11d, byte [rdx]
test r9b, r9b
je 0x18002b400
lea r10d, [r11 - 0x41]
lea eax, [r11 + 0x20]
cmp r10b, 0x19
movzx ebx, al
cmova ebx, r11d
jmp 0x18002b404
movzx ebx, r11b
test r8, r8
jne 0x18002b40e
mov rax, rcx
pop rbx
ret
movabs rax, 0x100000001b3
dec r8
imul rcx, rax
movsx rax, bl
inc rdx
xor rcx, rax
pop rbx
jmp fcn.18002b3e0
Function at 0x18002b600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r13
push r14
sub rsp, 0x40
mov r14, rcx
xor ecx, ecx
call fcn.18002b7e0
movabs rbx, 0x7ffffffdfffe
mov r13, rax
lea r8, [rax - 0x10000]
cmp r8, rbx
ja 0x18002b77f
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r15
test r14, r14
je 0x18002b757
mov rcx, rax
call fcn.18002bc10
lea rcx, [rax - 0x10000]
cmp rcx, rbx
ja 0x18002b757
movzx r12d, word [rax + 0x14]
xor ebx, ebx
movzx ebp, word [rax + 6]
add r12, rax
movzx edi, bx
cmp bx, bp
jae 0x18002b759
movabs rdx, 0xcbf29ce484222325
movabs r9, 0xaf63bd4c8601b7df
nop dword [rax]
movzx eax, di
lea rcx, [rax + rax*4]
mov esi, dword [r12 + rcx*8 + 0x20]
cmp dword [r12 + rcx*8 + 0x28], esi
mov r15d, dword [r12 + rcx*8 + 0x24]
cmovb esi, dword [r12 + rcx*8 + 0x28]
test r15d, r15d
je 0x18002b72e
test esi, esi
je 0x18002b72e
mov rax, qword [r12 + rcx*8 + 0x18]
mov r8, rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
test al, al
je 0x18002b6ea
nop dword [rax + rax]
inc r8
cmp byte [rsp + r8 + 0x20], bl
jne 0x18002b6e0
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x18002b6f4
add al, 0x20
test r8, r8
jne 0x18002b6fe
mov rax, rdx
jmp 0x18002b729
movsx rcx, al
lea rdx, [rsp + 0x21]
xor rcx, r9
dec r8
mov r9b, 1
call fcn.18002b3e0
movabs rdx, 0xcbf29ce484222325
movabs r9, 0xaf63bd4c8601b7df
cmp rax, r14
je 0x18002b73c
inc di
cmp di, bp
jb 0x18002b6a0
jmp 0x18002b759
mov r8, qword [rsp + 0x68]
lea rcx, [r15 + r13]
mov edx, esi
add rdx, r15
add rdx, r13
call fcn.18002b4c0
mov rbx, rax
jmp 0x18002b759
xor ebx, ebx
mov r15, qword [rsp + 0x30]
mov rax, rbx
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop r13
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop r14
pop r13
pop rbx
ret

Function at 0x18002b790
Capabilities:
Hash data using fnv

Disassembly:
movzx r11d, word [rdx]
test r9b, r9b
je 0x18002b7ac
lea eax, [r11 - 0x41]
cmp ax, 0x19
lea r10d, [r11 + 0x20]
cmova r10w, r11w
jmp 0x18002b7b0
movzx r10d, r11w
test r8, r8
jne 0x18002b7b9
mov rax, rcx
ret
movabs rax, 0x100000001b3
dec r8
imul rcx, rax
movzx eax, r10w
add rdx, 2
xor rcx, rax
jmp fcn.18002b790
Function at 0x18002ba30
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
lea rax, [rdx - 0x10000]
movabs r9, 0x7ffffffdfffe
mov rbx, rdx
mov r15, rcx
cmp rax, r9
ja 0x18002bbe9
xor ebp, ebp
mov r11d, ebp
cmp byte [rdx], bpl
je 0x18002bbe9
inc r11
cmp byte [r11 + rdx], bpl
jne 0x18002ba76
cmp r11, 1
jbe 0x18002bbe9
lea rax, [rcx - 0x10000]
cmp rax, r9
ja 0x18002bbe9
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002bbe9
mov ecx, dword [rcx + 0x3c]
add rcx, r15
cmp dword [rcx], 0x4550
jne 0x18002bbe9
lea rax, [rcx - 0x10000]
cmp rax, r9
ja 0x18002bbe9
lea rax, [rcx - 0xff78]
cmp rax, r9
ja 0x18002bbe9
mov ecx, dword [rcx + 0x88]
add rcx, r15
lea rax, [rcx - 0x10000]
cmp rax, r9
ja 0x18002bbe9
cmp dword [rcx + 0x10], ebp
je 0x18002bbe9
mov eax, dword [rcx + 0x1c]
test eax, eax
je 0x18002bbe9
mov edx, dword [rcx + 0x20]
test edx, edx
je 0x18002bbe9
mov r8d, dword [rcx + 0x24]
test r8d, r8d
je 0x18002bbe9
mov r13d, dword [rcx + 0x14]
test r13d, r13d
je 0x18002bbe9
cmp dword [rcx + 0x18], ebp
je 0x18002bbe9
lea rcx, [r15 + rax]
mov qword [rsp + 0x38], rcx
lea r14, [r15 + rdx]
lea rsi, [r15 + r8]
test r13d, r13d
je 0x18002bbe9
nop
movzx eax, word [rsi]
mov r12d, dword [rcx + rax*4]
test r12d, r12d
je 0x18002bbd6
mov edi, dword [r14]
add rdi, r15
lea rax, [rdi - 0x10000]
cmp rax, r9
ja 0x18002bbd6
mov rax, rbx
sub rdi, rbx
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax]
movzx r10d, byte [rdi + rax]
lea r8d, [rdx - 0x41]
lea ecx, [rdx + 0x20]
cmp r8b, 0x19
movzx r9d, cl
lea r8d, [r10 - 0x41]
cmova r9d, edx
lea ecx, [r10 + 0x20]
cmp r8b, 0x19
movzx edx, cl
cmova edx, r10d
cmp dl, r9b
jne 0x18002bbc7
inc rax
mov rcx, rax
sub rcx, rbx
cmp rcx, r11
jb 0x18002bb80
lea rax, [r15 + r12]
jmp 0x18002bbeb
mov rcx, qword [rsp + 0x38]
movabs r9, 0x7ffffffdfffe
inc ebp
add rsi, 2
add r14, 4
cmp ebp, r13d
jb 0x18002bb50
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18002bc10
Capabilities:
Parse pe header

Disassembly:
lea rax, [rcx - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rax, rdx
ja 0x18002bc3e
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18002bc3e
mov eax, dword [rcx + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
je 0x18002bc40
xor eax, eax
ret
Function at 0x18002bea0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x60
mov rbp, qword [0x18007f698]
lea r15, [rax + 0x20]
mov rbx, r8
mov qword [rax - 0x48], 0
mov r8, qword [0x1800821c8]
mov rsi, rcx
movabs rcx, 0x7ffffffdfffe
mov rdi, rdx
lea rax, [r8 - 0x10000]
cmp rax, rcx
jbe 0x18002bf61
mov eax, dword [0x180073540]
xor r8d, r8d
mov dword [rsp + 0x40], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x180073544]
mov word [rsp + 0x44], ax
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x40], al
inc r8
cmp r8, 6
jb 0x18002bf11
lea rdx, [rsp + 0x40]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov r8, rax
mov qword [0x1800821c8], rax
mov qword [rsp + 0x48], r8
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], r15
mov r8, rbx
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 0
call fcn.18002be40
add rsp, 0x60
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18002c030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov r8, qword [0x1800821d0]
mov rdi, rcx
mov rsi, qword [0x18007f690]
movabs rcx, 0x7ffffffdfffe
mov rbx, rdx
lea rax, [r8 - 0x10000]
cmp rax, rcx
jbe 0x18002c0e0
mov eax, dword [0x180073548]
xor r8d, r8d
mov dword [rsp + 0x70], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x18007354c]
mov word [rsp + 0x74], ax
nop dword [rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x70], al
inc r8
cmp r8, 6
jb 0x18002c090
lea rdx, [rsp + 0x70]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov r8, rax
mov qword [0x1800821d0], rax
mov qword [rsp + 0x30], r8
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov qword [rsp + 0x38], rsi
mov rcx, rdi
mov qword [rsp + 0x40], 0
call fcn.18002be40
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18002c130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov r10, qword [0x1800821c8]
mov rbp, rcx
mov r14, qword [0x18007f698]
movabs rcx, 0x7ffffffdfffe
mov rbx, r9
mov rdi, r8
mov rsi, rdx
lea rax, [r10 - 0x10000]
cmp rax, rcx
jbe 0x18002c1f0
mov eax, dword [0x180073540]
xor r8d, r8d
mov dword [rsp + 0x40], eax
movabs r9, 0x47ae147ae147ae15
movzx eax, word [0x180073544]
mov word [rsp + 0x44], ax
nop dword [rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [rsp + r8 + 0x40], al
inc r8
cmp r8, 6
jb 0x18002c1a0
lea rdx, [rsp + 0x40]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov r10, rax
mov qword [0x1800821c8], rax
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov r8, rdi
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov qword [rsp + 0x48], r10
mov rcx, rbp
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0
call fcn.18002be40
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret