joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800413a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [0x1800e4240]
xorps xmm0, xmm0
add rcx, 1
js 0x1800413c1
cvtsi2ss xmm0, rcx
jmp 0x1800413d6
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x1800e4230]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x1800d91cc]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x180041408
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x180041408
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x1800e4268]
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x18004143d
cmp rdx, 0x200
jae 0x18004143a
shl rdx, 3
cmp rdx, rcx
jae 0x18004143d
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
jbe 0x180041466
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [0x1800e4238]
lea rax, [rdx - 1]
or rax, 1
mov edi, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800e4248]
lea rdx, [rdi + rdi]
call fcn.1800406d8
mov rax, qword [0x1800e4238]
lea r9, [rdi - 1]
mov qword [0x1800e4260], r9
mov qword [0x1800e4268], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800415b4
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [r8 + rax + 0x10]
movabs r10, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r10
cmp r8, 4
jb 0x1800414ce
mov rdi, qword [0x1800e4248]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18004150c
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18004157a
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x18004154f
mov r10, qword [r10]
cmp r10, rax
je 0x180041505
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180041505
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x18004158e
cmp qword [rdi + r11*8], r10
jne 0x180041545
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800415b4
mov r9, qword [0x1800e4260]
jmp 0x1800414be
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18004157a
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.1800415ec
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800416c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], rcx
mov rbp, r8
mov r13, rdx
cmp rdx, r8
je 0x180041790
mov rax, qword [rcx + 8]
mov rsi, rdx
mov r14, qword [rdx + 8]
movabs r15, 0xcbf29ce484222325
mov r12, qword [rcx + 0x18]
xor edx, edx
mov qword [rsp + 0x20], rax
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r13 + 0x10]
inc rdx
xor r15, rax
imul r15, r8
cmp rdx, 4
jb 0x18004171a
and r15, qword [rcx + 0x30]
add r15, r15
mov rax, qword [r12 + r15*8]
mov qword [rsp + 0x30], rax
mov rax, qword [r12 + r15*8 + 8]
mov qword [rsp + 0x28], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.180040224
mov edx, 0x58
mov rcx, rbx
call fcn.18009bf9c
mov rdx, qword [rsp + 0x38]
dec qword [rdx + 0x10]
cmp rbx, qword [rsp + 0x28]
je 0x1800417b1
cmp rsi, rbp
jne 0x18004174a
cmp qword [rsp + 0x30], r13
jne 0x180041789
mov qword [r12 + r15*8], rsi
mov qword [r14], rsi
mov qword [rsi + 8], r14
lea r11, [rsp + 0x40]
mov rax, rbp
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [rsp + 0x30], r13
jne 0x1800417c6
mov r13, qword [rsp + 0x20]
mov qword [r12 + r15*8], r13
mov rax, r13
jmp 0x1800417c9
mov rax, r14
mov qword [r12 + r15*8 + 8], rax
cmp rsi, rbp
je 0x180041789
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movabs r13, 0x100000001b3
movzx eax, byte [rsi + r8 + 0x10]
inc r8
xor rcx, rax
imul rcx, r13
cmp r8, 4
jb 0x1800417ea
mov r15, qword [rdx + 0x30]
mov r13, qword [rsp + 0x20]
and r15, rcx
add r15, r15
mov rax, qword [r12 + r15*8 + 8]
mov qword [rsp + 0x28], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.180040224
mov edx, 0x58
mov rcx, rbx
call fcn.18009bf9c
mov rdx, qword [rsp + 0x38]
dec qword [rdx + 0x10]
cmp rbx, qword [rsp + 0x28]
je 0x180041853
cmp rsi, rbp
je 0x180041785
jmp 0x180041819
mov qword [r12 + r15*8], r13
mov qword [r12 + r15*8 + 8], r13
jmp 0x1800417ce
Function at 0x18004efcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x1800e0010]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rdi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov esi, dword [rbx + 0x14]
mov eax, esi
mov r14d, dword [rbx + 4]
cmp esi, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x18004f0ff
cmp esi, r14d
mov eax, r14d
cmovg eax, esi
cmp r9d, eax
jg 0x18004f0ff
cmp esi, r14d
jne 0x18004f062
sub rbx, 0x10
jmp 0x18004f149
mov edx, dword [rdi + 0x88]
xor r9d, r9d
cmp esi, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x18004f0c2
mov eax, dword [rdi + 4]
mov ecx, eax
neg ecx
cmp esi, r14d
jge 0x18004f090
dec eax
add eax, esi
and eax, ecx
sub eax, esi
jmp 0x18004f096
and ecx, esi
mov eax, esi
sub eax, ecx
cmp eax, dword [rdi + 8]
setge r10b
test edx, edx
je 0x18004f0b0
mov dl, r10b
mov rcx, rdi
call fcn.18004e868
test al, al
jne 0x18004f0fb
mov r8b, r10b
mov edx, r9d
mov rcx, rdi
call fcn.18004e79c
test al, al
jne 0x18004f0fb
mov ecx, dword [rdi + 0x60]
lea r9, [0x18004e984]
mov eax, dword [rdi + 0x64]
mov r8, rbx
mov dword [rsp + 0x28], eax
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rdi
cmp esi, r14d
jge 0x18004f0ee
call fcn.18004ec28
jmp 0x18004f0f3
call fcn.18004ed9c
test al, al
je 0x18004f059
mov al, 1
jmp 0x18004f163
mov eax, dword [rbx + 8]
lea r8, [rbx + 0x10]
mov ecx, dword [r8]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], esi
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [rsi + r9]
mov dword [r8], eax
mov eax, ecx
sar eax, 1
sar edx, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0xc], edx
mov dword [rbx + 0x14], eax
mov rbx, r8
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x18004f15a
mov ebp, dword [rbx]
jmp 0x18004f025
mov dword [rdi + 0x58], ebp
xor al, al
mov dword [rdi + 0x5c], r14d
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18009bc10
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18004f18c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x350
mov rax, qword [0x1800e0010]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov r14d, dword [rsp + 0x398]
mov rdi, rcx
mov dword [rsp + 0x48], eax
mov eax, dword [rcx + 0x5c]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x390]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3a0]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], r14d
mov esi, dword [rbx + 0x1c]
mov ecx, esi
mov ebp, dword [rbx + 4]
cmp esi, ebp
mov r8d, dword [rbx + 0x14]
mov eax, r8d
mov edx, dword [rbx + 0xc]
cmovg ecx, ebp
cmp r8d, edx
cmovg eax, edx
cmp eax, ecx
jl 0x18004f2dc
cmp esi, ebp
mov eax, ebp
cmovg eax, esi
cmp r8d, edx
cmovg edx, r8d
cmp edx, eax
jg 0x18004f2dc
cmp esi, ebp
jne 0x18004f242
sub rbx, 0x18
jmp 0x18004f2e8
mov edx, dword [rdi + 0x88]
xor r9d, r9d
cmp esi, ebp
setg r9b
inc r9d
cmp edx, r9d
je 0x18004f2a0
mov eax, dword [rdi + 4]
mov ecx, eax
neg ecx
cmp esi, ebp
jg 0x18004f26e
dec eax
add eax, esi
and eax, ecx
sub eax, esi
jmp 0x18004f274
and ecx, esi
mov eax, esi
sub eax, ecx
cmp eax, dword [rdi + 8]
setge r10b
test edx, edx
je 0x18004f28e
mov dl, r10b
mov rcx, rdi
call fcn.18004e868
test al, al
jne 0x18004f2d8
mov r8b, r10b
mov edx, r9d
mov rcx, rdi
call fcn.18004e79c
test al, al
jne 0x18004f2d8
mov ecx, dword [rdi + 0x60]
lea r9, [fcn.18004e9dc]
mov eax, dword [rdi + 0x64]
mov r8, rbx
mov dword [rsp + 0x28], eax
mov edx, 3
mov dword [rsp + 0x20], ecx
mov rcx, rdi
cmp esi, ebp
jg 0x18004f2cb
call fcn.18004ec28
jmp 0x18004f2d0
call fcn.18004ed9c
test al, al
je 0x18004f239
mov al, 1
jmp 0x18004f303
mov rcx, rbx
call fcn.18004e9dc
add rbx, 0x18
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x18004f2fa
mov r14d, dword [rbx]
jmp 0x18004f1fa
mov dword [rdi + 0x58], r14d
xor al, al
mov dword [rdi + 0x5c], ebp
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.18009bc10
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18004f634
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r14d, r14d
sub rax, 0x34
mov qword [rcx + 0x78], r14
mov qword [rcx + 0x28], rax
mov ebp, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r14w
lea r15d, [r14 + 1]
mov dword [rcx + 0x3c], r14d
mov esi, r14d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r14w
cmp r14w, word [rcx + 0xb8]
jge 0x18004f782
movzx r10d, r14w
mov edi, r14d
mov r8, qword [rbx + 0xd0]
mov r9d, ebp
mov dword [rbx + 0x88], r14d
movzx edx, r10w
mov qword [rbx + 0x80], r14
mov rcx, rbx
movzx r8d, word [rdi + r8]
call fcn.18004f32c
test al, al
jne 0x18004f81a
mov rax, qword [rbx + 0xd0]
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
movzx r10d, word [rdi + rax]
lea eax, [r8 - 1]
test edx, eax
jne 0x18004f711
cmp edx, dword [rbx + 0x60]
jl 0x18004f711
cmp edx, dword [rbx + 0x64]
jg 0x18004f711
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x18004f711
mov rax, qword [rbx + 0x70]
mov cl, byte [rax + 0x18]
xor cl, byte [r9 + 0x18]
test cl, 8
jne 0x18004f711
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x18004f734
test byte [r9 + 0x18], 8
je 0x18004f734
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x18004f745
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.18004e868
test al, al
jne 0x18004f81a
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x18004f768
mov qword [r9 + 0x28], rax
movsx eax, word [rbx + 0xb8]
add esi, r15d
add rdi, 2
add r10w, r15w
cmp esi, eax
jl 0x18004f69a
movzx r11d, word [rbx + 0x68]
mov rdx, qword [rbx + 0x78]
cmp r11w, r15w
jbe 0x18004f81f
test rdx, rdx
je 0x18004f81f
lea rdi, [rdx + 8]
cmp r11w, r15w
jbe 0x18004f7b6
movsxd rcx, dword [rdx + 0x1c]
mov rax, qword [rdx + 0x10]
lea r10, [rax + rcx*4]
jmp 0x18004f7b9
mov r10, r14
mov qword [rdi], r10
test byte [rdx + 0x18], 8
mov r10d, dword [rdx + 0x20]
mov r8d, r10d
mov eax, dword [rdx + 0x1c]
je 0x18004f7d4
dec r10d
add r10d, eax
jmp 0x18004f7eb
sub r8d, eax
add r8d, r15d
dec eax
mov dword [rdx + 0x20], r8d
movsxd rcx, eax
shl rcx, 2
add qword [rdx + 0x10], rcx
mov edx, r8d
mov rcx, rbx
call fcn.18004e8fc
test al, al
jne 0x18004f81a
lea edx, [r10 + 1]
mov rcx, rbx
call fcn.18004e8fc
test al, al
jne 0x18004f81a
mov rdx, qword [rdi]
mov eax, 0xffff
add r11w, ax
je 0x18004f823
jmp 0x18004f79e
mov al, r15b
jmp 0x18004f82e
mov qword [rbx + 0x78], r14
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18009aa28
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
mov r11, rdx
mov r9d, ecx
test rdx, rdx
je 0x18009aaad
lea rdi, [0x1800c3290]
not r9d
cmp r8d, 8
jb 0x18009aa84
mov edx, r8d
shr rdx, 3
add r8d, 0xfffffff8
mov ebx, 8
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rdi + rax*4]
sub rbx, 1
jne 0x18009aa60
sub rdx, 1
jne 0x18009aa57
test r8d, r8d
je 0x18009aaa7
movzx ecx, byte [r11]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rdi + rax*4]
add r8d, 0xffffffff
jne 0x18009aa89
not r9d
mov r10d, r9d
mov rbx, qword [rsp + 8]
mov eax, r10d
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1800f2550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1800f257c
xor al, al
jmp 0x1800f26a0
movdqa xmm0, xmmword [0x180112ae0]
movdqa xmm1, xmmword [0x180112af0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x180112b00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x180112b10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x1800f2692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1800f25f9
mov r11d, 2
jmp 0x1800f261d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1800f2613
mov r11d, 1
jmp 0x1800f261d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1800f26b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1800f265a
mov byte [rcx + 2], 0x3d
jmp 0x1800f266a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x1800f267c
mov byte [rcx], 0x3d
jmp 0x1800f2683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1800f25e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x1800f269b

Function at 0x180102cd0
Capabilities:
Encode data using xor

Disassembly:
and dil, dl
mov rdx, qword [rsp + 0x10]
mov rdx, qword [rdx]
not r12w
not r12
add di, r12w
lea r12, [rdi*2 + 0x11e6765d]
lea r12, [r12*4 + 0x22737f33]
cmp rdi, 0x76834e2e
lea rdx, [rdx + r12 - 0x3546fcd3]
bswap rdi
setae r12b
setl r12b
xchg qword [rsp + r12 - 0x6a0d5cd1], rdx
mov qword [rsp + 0x10], r12
push r15
movabs r15, 0x2fa5154310934c95
mov r12, qword [rsp + 0x20]
bswap r15
add qword [rsp + 8], 0x7fea98b2
and r15d, 0x420479f3
neg r15w
setg r15b
call fcn.18016a83c
xchg esi, eax
and eax, esp
mov eax, 0x3b9319dc
invalid
Function at 0x18015d936
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], 0xffffffffae43f4e3
push rbx
movabs rbx, 0x44056e59321513a6
xor ebx, 0x6b9f3df0
push r14
mov rbx, qword [rsp + 8]
movabs r14, 0x69b303366ce7559d
not r14w
cmp r14d, 0x546156b3
mov r14b, 0xda
not r14d
mov r14, qword [rsp]
je 0x18015d94a
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x20]
call fcn.18045368b

Function at 0x18023f66f
Capabilities:
Encode data using xor

Disassembly:
push 0x244860bf
push r11
mov qword [rsp + r12*4 - 0x1adc3a68], rbp
push r10
mov r11, qword [rsp + 0x20]
push rsi
call fcn.1802c340e

Function at 0x180240d10
Capabilities:
Encode data using xor

Disassembly:
dec dword [rdi]
xchg ecx, eax
and al, 0x30
xor byte [rsp + 0x30], 0xe0
or byte [rsp + 0x50], 0xfc
call fcn.1802a90b7
add qword [rsp + 0x30], 0x7fe64d68
add qword [rsp], 0xffffffffffe48ba6
call fcn.1802c677d
fsub qword [rax]
sbb byte [rcx + 0x53], 0xf2
lahf
jrcxz 0x180240cd4
xor byte [rsi + 0xd], bh
in al, 0x79
retf

Function at 0x18029f977
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
call fcn.18045368b
xor dword [rcx - 0x7d], ebp
pop rbx
and al, 0x51
push 0xfffffffffffffff5
sub esi, dword [rdx - 0x238fccb8]
mov edi, 0x385ef69
mov edi, dword [rax]
enter 0x68fc, 0xffffffffffffff9a
bnd call 0x1c720a895
sbb ecx, dword [rsi]
xor cl, byte [rbx]
mov ss, eax
jae 0x18029f98a
out 0x21, eax
jmp 0x18029f9bf
or ah, byte [rbx - 0x36]
out dx, eax
mov dh, ah
sub ebp, dword [rsi + rax - 0x4e238e2d]
invalid

Function at 0x1802a8a14
Capabilities:
Encode data using xor

Disassembly:
not di
not rdi
lea rsi, [rdi + rdi*4 + 0x7e6e56c1]
xchg qword [rsp + rdi + 0x1d15e874], rbx
seta r12b
add qword [rsp + 8], 0x7fd254d8
and al, 8
fcom dword [rdx + rdx*8 + 0x7f]
mov r12d, 0x28d33285
or r12, 0x3f6c2e3f
xor r12, rdi
mov qword [rsp + 0x20], rdi
or word [rsp + 0x20], si
mov rsi, qword [rsp + 0x18]
add qword [rsp], 0x7fda6ad1
not di
and qword [rsp + 0x20], 0x7c4c178d
or byte [rsp + 0x20], 0x64
add byte [rsp + 0x20], dil
mov rdi, qword [rsp + 0x38]
xor byte [rsp + 0x20], 0xc9
cmova r12d, dword [rsp + 0x21]
movsx r12d, word [rsp + 0x22]
call fcn.1803079dd
in eax, dx
mov cl, 0x22
rcr dword [rcx + 0x48], 0x6f
clc
pop rax
lodsb al, byte [rsi]
int1
loop 0x1802a8a30
mov esi, 0xff7d3d9
adc edx, dword [rsi]
cdq
lodsd eax, dword [rsi]
and dword [rdi], edi
xchg esi, eax
adc edx, dword [rdi + 0x704aca6a]
sub esp, dword [rbp + 0x4e]
invalid

Function at 0x1802ad852
Capabilities:
Encode data using xor

Disassembly:
and al, 0x78
call fcn.1802a79ba
call fcn.1802c0b01
pop rbp
fadd qword [rcx + 0x98a7bfe]
jne 0x1802ad814
jne 0x1802ad814
or byte [rcx + rbp*2 + 0x66605175], dh
mov byte [rdx - 0x180852e7], cl
mul edi
mov ah, byte [rdx + 0x75745c3a]
xor dl, ch
mov bh, 0x60
jne 0x1802ad871
xchg edi, eax
mov bl, 0x9c
mov ch, byte [rsi + 0x75614182]
add dl, byte [rdi]
xchg ecx, eax
mov dl, ah
jo 0x1802ad864
xchg edx, eax
mov dh, dh
fnstsw word [rbp + rdx*4 - 0x76]
xchg esp, eax
invalid
Function at 0x1802cba2a
Capabilities:
Create thread

Disassembly:
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rbx
lea r8, [0x1800c6340]
mov rcx, rax
lea rdx, str.CONOUT_
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
and qword [rsp + 0x28], 0
lea r8, [0x180036870]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180036cc6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180036cc6
mov eax, 1
add rsp, 0x30
pop rbx
ret
test word [rsp + 0x58], 0x65ef
not dword [rsp + 0x58]
je 0x180036c4f
mov byte [rsp + 0x58], 0xd0
and qword [rsp + 0x58], 0x67c22d2e
call fcn.18016581a
Function at 0x140006a80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
call qword [sym.imp.USER32.dll_OpenClipboard]
xor ebx, ebx
test eax, eax
je 0x140006b2b
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x140006b25
mov edi, dword [rsi + 8]
lea rcx, [rsp + 0x40]
mov rbp, qword [rsi]
inc edi
add rdi, rdi
mov qword [rsp + 0x40], rbx
mov r8, rdi
mov edx, 0x2002
call fcn.14000b1bc
test al, al
je 0x140006b1b
mov rsi, qword [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140006b1b
mov r8, rdi
mov rdx, rbp
mov rcx, rax
call fcn.14005c0a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, qword [rsp + 0x40]
lea ecx, [rbx + 0xd]
call qword [sym.imp.USER32.dll_SetClipboardData]
test rax, rax
je 0x140006b1b
mov qword [rsp + 0x40], rbx
mov bl, 1
lea rcx, [rsp + 0x40]
call fcn.14000b1e4
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rbp, qword [rsp + 0x38]
mov al, bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140007238
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rsi, rcx
call fcn.14000ab7c
mov r14d, eax
xor edi, edi
lea ebx, [rdi + 1]
cmp eax, ebx
je 0x14000729b
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140007281
mov al, bl
jmp 0x14000737f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140007333
test r14d, r14d
je 0x140007333
lea rcx, [rbp - 0x29]
call fcn.140002a00
nop
cmp r14d, ebx
setne r8b
lea rdx, [rbp - 0x29]
mov rcx, rsi
call fcn.14000a6a0
test al, al
je 0x14000732a
xor edx, edx
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000731c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400072de
mov bl, dil
jmp 0x14000731c
lea rcx, [rbp - 0x19]
call fcn.140007f7c
lea rcx, [rbp + 0xf]
call fcn.140002a00
nop
xor r8d, r8d
mov rdx, qword [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.140008258
test al, al
jne 0x14000730a
mov bl, dil
jmp 0x140007312
mov eax, dword [rbp + 7]
shr eax, 4
and bl, al
mov rcx, qword [rbp + 0xf]
call fcn.14005af1c
nop
mov rcx, qword [rbp - 0x29]
call fcn.14005af1c
jmp 0x14000727a
mov rcx, qword [rbp - 0x29]
call fcn.14005af1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140007344
xor al, al
jmp 0x14000737f
lea rcx, [rbp + 0x1f]
call fcn.140007f7c
lea rcx, [rbp + 0x47]
call fcn.140002a00
nop
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp + 0x1f]
call fcn.140008258
test al, al
je 0x140007373
mov edi, dword [rbp + 0x3f]
shr edi, 4
and dil, bl
mov rcx, qword [rbp + 0x47]
call fcn.14005af1c
mov al, dil
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret