joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006fe80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14006fd13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006fd13
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006fd13
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006fd13
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006fd13
cmp dword [rcx + 0x84], 0xe
jbe 0x14006fd13
cmp dword [rcx + 0xf8], 0
je 0x14006fd13
mov ecx, ebx
call fcn.14006fdb4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14006fba4
cmp dword [rbp + 0x20], 0
je 0x14006fd60
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14006fd68
int3
xor r8d, r8d
xor edx, edx
jmp 0x14006fcac
Function at 0x1400a1190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r12, r9
movzx r15d, r8b
mov r14, rdx
mov r10, rcx
mov r13, qword [rcx]
mov rbx, qword [r13 + 8]
mov rsi, r13
mov dil, 1
cmp byte [rbx + 0x19], 0
jne 0x1400a121e
mov rsi, rbx
test r15b, r15b
je 0x1400a11f3
mov rdx, r12
lea rcx, [rbx + 0x20]
call fcn.1400a1430
mov edi, eax
shr edi, 0x1f
xor dil, 1
jmp 0x1400a1205
lea rdx, [rbx + 0x20]
mov rcx, r12
call fcn.1400a1430
shr eax, 0x1f
movzx edi, al
test dil, dil
je 0x1400a120f
mov rbx, qword [rbx]
jmp 0x1400a1213
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x19], 0
je 0x1400a11d4
mov r10, qword [rsp + 0x70]
mov rbx, rsi
mov rcx, rsi
test dil, dil
je 0x1400a12dd
cmp rsi, qword [r13]
jne 0x1400a126a
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
mov r8b, 1
lea rdx, [rsp + 0x70]
mov rcx, r10
call fcn.1400a0980
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x1400a1332
cmp byte [rsi + 0x19], 0
je 0x1400a1279
mov rbx, qword [rsi + 0x10]
mov rcx, rbx
jmp 0x1400a12dd
mov rax, qword [rsi]
cmp byte [rax + 0x19], 0
jne 0x1400a12a2
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1400a129d
nop
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x1400a1290
mov rcx, rbx
jmp 0x1400a12dd
mov rax, qword [rsi + 8]
cmp byte [rax + 0x19], 0
jne 0x1400a12d1
mov rdx, rsi
nop
mov r8, rax
mov r9, rax
mov rcx, rdx
cmp rdx, qword [rax]
jne 0x1400a12d1
mov rbx, rax
mov rax, qword [rax + 8]
mov rdx, rbx
mov rcx, rbx
cmp byte [rax + 0x19], 0
je 0x1400a12b0
cmp byte [rbx + 0x19], 0
jne 0x1400a12dd
mov rbx, rax
mov rcx, rax
add rcx, 0x20
mov rdx, r12
call fcn.1400a1430
shr eax, 0x1f
test al, al
je 0x1400a1327
movzx eax, byte [rsp + 0x90]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], r12
mov r9, rsi
movzx r8d, dil
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1400a0980
mov rax, qword [rax]
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
jmp 0x1400a1332
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400df820
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1402710d8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rcx
lea r8, [0x1400df910]
xor edx, edx
xor ecx, ecx
call fcn.140075f88
mov qword [rbx + 8], rax
test rax, rax
jne 0x1400df8ec
movdqa xmm0, xmmword [0x140114810]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], al
lea r8d, [rax + 0x1e]
lea rdx, str.Cannot_create_new_thread___T_.
lea rcx, [rsp + 0x40]
call fcn.140027200
nop
lea rcx, [rsp + 0x40]
call fcn.1400dd6d0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400df8ec
mov rcx, qword [rsp + 0x40]
mov rax, rcx
inc rdx
cmp rdx, 0x1000
jb 0x1400df8e7
lea r8, [rdx + 0x27]
cmp r8, rdx
jbe 0x1400df8ff
mov rdx, r8
test al, 0x1f
jne 0x1400df8ff
mov rcx, qword [rcx - 8]
cmp rcx, rax
jae 0x1400df8ff
sub rax, rcx
sub rax, 8
cmp rax, 0x1f
ja 0x1400df8ff
call fcn.140064d50
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140065120
add rsp, 0x70
pop rbx
ret
call fcn.14006bbcc
int3
Function at 0x140102a90
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x14024bd60]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x140002130
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
mov r14, r8
push r13
mov r13, rdx
push r12
push rbp
push rdi
mov rdi, rcx
mov rcx, rdx
push rsi
mov rsi, r9
push rbx
sub rsp, 0x48
call fcn.140012890
mov rbx, qword [0x140018180]
mov qword [rsp + 0x38], rax
cmp dword [rbx + 0xec], 0
je 0x14000219c
lea rdx, [0x1400162f0]
mov ecx, 1
call qword [rbx + 0x1a8]
mov r12, rax
test rax, rax
jne 0x14000219f
mov rax, qword [rbx + 0x8b2]
mov ecx, 1
mov edx, dword [rax + 0x68]
call fcn.14000ec90
jmp 0x14000232f
xor r12d, r12d
xor ebp, ebp
mov r15d, 0x40
mov rax, qword [rdi + 8]
cmp word [rax + 2], bp
jbe 0x14000226e
movzx edx, bp
mov rcx, qword [rdi]
imul rax, rdx, 0x28
lea rax, [rcx + rax + 0x14]
cmp dword [rax + 0x10], 0
mov qword [rdi + 0x10], rax
jne 0x1400021d2
inc ebp
jmp 0x1400021a7
mov r8d, dword [rax + 0x24]
mov eax, 1
mov ecx, r8d
and ecx, 0xe0000000
je 0x140002236
mov eax, 0x10
cmp ecx, 0x20000000
je 0x140002236
mov eax, 2
cmp ecx, 0x40000000
je 0x140002236
mov eax, 0x20
cmp ecx, 0x60000000
je 0x140002236
mov eax, 8
cmp ecx, 0x80000000
je 0x140002236
mov eax, pe_nt_image_headers64
cmp ecx, 0xa0000000
je 0x140002236
cmp ecx, 0xc0000000
mov eax, 4
cmovne eax, r15d
bt r8d, 0x1a
jae 0x140002240
or ah, 2
shl rdx, 4
add rdx, qword [rdi + 0x3c]
mov ecx, 2
mov r9, qword [rdx + 8]
mov dword [rsp + 0x20], eax
mov r8, qword [rdx]
or rdx, 0xffffffffffffffff
call fcn.14000e4d0
test eax, eax
jne 0x1400021ce
jmp 0x14000232f
mov r9, qword [rdi + 0x4c]
test r9, r9
jne 0x14000227c
xor r15d, r15d
jmp 0x1400022a2
mov dword [rsp + 0x20], 2
mov r8, qword [rdi + 0x44]
or rdx, 0xffffffffffffffff
mov ecx, 2
call fcn.14000e4d0
test eax, eax
jne 0x140002277
jmp 0x14000232f
inc r15d
mov rax, qword [rdi + 8]
mov eax, dword [rax + 0xc]
cmp eax, r15d
jbe 0x1400022fb
mov ebp, r15d
mov rdx, qword [rdi + 0x20]
imul rbp, rbp, 0x12
lea rcx, [rdx + rbp]
cmp dword [rcx], 0
jne 0x1400022d0
imul rax, rax, 0x12
mov ecx, dword [rcx + 4]
add rax, rcx
lea rcx, [rdx + rax]
mov r8d, dword [rsp + 0x38]
mov rdx, r13
call fcn.14000e170
test eax, eax
jne 0x14000229f
add rbp, qword [rdi + 0x20]
mov rax, qword [rdi + 0x3c]
movzx edx, word [rbp + 0xc]
mov ecx, dword [rbp + 8]
shl rdx, 4
add rcx, qword [rax + rdx - 0x10]
jne 0x140002333
mov edx, dword [rsp + 0xb0]
mov ecx, 0x14
call fcn.14000ea00
mov edx, 2
mov r12, rax
mov rcx, rax
call fcn.14000e790
mov rcx, r12
mov rdx, r13
call fcn.14000e8c0
mov rcx, r12
call fcn.14000eaa0
xor eax, eax
jmp 0x140002394
mov rdx, qword [rdi + 8]
mov r9w, word [rdx + 2]
xor edx, edx
jmp 0x14000234f
mov r8, qword [rax]
cmp r8, rcx
jbe 0x140002357
inc rdx
add rax, 0x10
cmp r9w, dx
ja 0x140002340
jmp 0x14000232f
add r8, qword [rax + 8]
cmp rcx, r8
jae 0x140002348
imul rdx, rdx, 0x28
mov rax, qword [rdi]
lea rax, [rax + rdx + 0x14]
mov qword [rdi + 0x10], rax
test byte [rax + 0x27], 0x20
je 0x14000232f
mov r8, rsi
mov rdx, r14
call fcn.1400023b0
test r12, r12
je 0x14000238f
mov rcx, r12
call qword [rbx + 0x1b0]
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000b220
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140011bf0
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x140011bf0
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x140011bf0
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000b2e1
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x140011bf0
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000b790
cmp eax, 0xa6caa1c5
jne 0x14000b2cd
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x140011bf0
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140011bf0
mov rcx, r13
inc rsi
call fcn.14000b790
cmp eax, 0xffe885ef
jne 0x14000b271
jmp 0x14000b29e
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x140011c3a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140011c38
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140011c30
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x140011c30
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x140011c0e
xor eax, eax
ret

Function at 0x14000b350
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
xor r8d, r8d
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [0x140018180]
mov rax, qword [rbx + 0x83a]
test rax, rax
je 0x14000b402
mov r8d, dword [rbx + 0x7f0]
test r8d, r8d
jne 0x14000b402
movsxd rdx, dword [rax + 0x3c]
xor ecx, ecx
mov edx, dword [rax + rdx + 0x88]
add rdx, rax
mov edi, dword [rdx + 0x20]
mov r10d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x24]
mov ebp, dword [rdx + 0x18]
xor edx, edx
add r10, rax
add rdi, rax
add rsi, rax
cmp ebp, ecx
jbe 0x14000b3fb
mov r9d, dword [rdi + rcx*4]
cmp word [rax + r9], 0x775a
jne 0x14000b3f6
test rdx, rdx
movzx r9d, word [rsi + rcx*2]
jne 0x14000b3cc
mov edx, dword [r10 + r9*4]
add rdx, rax
jmp 0x14000b3f6
mov r9d, dword [r10 + r9*4]
mov r11, rdx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rdx
cmp rdx, r9
mov r9d, r12d
cmova r9d, r11d
test r8d, r8d
je 0x14000b3f3
cmp r8d, r9d
jbe 0x14000b3f6
mov r8d, r9d
inc rcx
jmp 0x14000b3a8
mov dword [rbx + 0x7f0], r8d
pop rbx
mov eax, r8d
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14000b740
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x14000b78d
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x14000b75c
test r9b, r9b
jne 0x14000b76f
ret
mov r11, r10
sub r11, rcx
cmp edx, r11d
jbe 0x14000b78d
cmp r9b, 1
adc r10, 0
cmp r9b, 0x60
jbe 0x14000b77e
test r8d, r8d
je 0x14000b77e
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x14000b74f
ret
Function at 0x14000b790
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000b7a6
imul eax, eax, 0x21
add eax, edx
jmp 0x14000b795
ret

Function at 0x14000d1c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x14000d1c4
mov r11d, 8
lea r10, str.cw
lea rbx, [0x1400181c0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x14000d242
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x14000d257
cmp esi, 4
jne 0x14000d257
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x14000d208
pop rbx
pop rsi
ret

Function at 0x14000d750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x14000d786
mov esi, edx
test edx, edx
jne 0x14000d78d
xor eax, eax
jmp 0x14000d873
movsxd rax, dword [rcx + 0x3c]
mov r12, rcx
xor ebx, ebx
add rax, rcx
mov r9d, dword [rax + 0x88]
mov eax, dword [rax + 0x8c]
lea r15, [rcx + r9]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x18]
mov r14d, dword [r15 + 0x20]
mov ebp, dword [r15 + 0x1c]
mov r13d, dword [r15 + 0x24]
mov dword [rsp + 0x2c], eax
add r14, rcx
cmp dword [rsp + 0x2c], ebx
jbe 0x14000d786
mov edi, dword [r14 + rbx*4]
mov r8d, 1
xor edx, edx
add rdi, r12
mov rcx, rdi
call fcn.14000b740
mov r8d, eax
lea rax, [rbx + 1]
cmp r8d, esi
jne 0x14000d86b
add rbx, rbx
add rbx, r12
movzx eax, word [rbx + r13]
lea rax, [r12 + rax*4]
mov eax, dword [rax + rbp]
add rax, r12
mov qword [rsp + 0x38], rax
cmp rax, r15
jae 0x14000d814
mov rax, qword [rsp + 0x38]
jmp 0x14000d873
mov esi, dword [rsp + 0x28]
add rsi, r12
add rsi, r15
cmp rax, rsi
jae 0x14000d80d
call fcn.140012890
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], ax
inc eax
mov word [rsp + 0x42], ax
mov rax, qword [0x140018180]
mov rax, qword [rax + 0x130]
test rax, rax
je 0x14000d786
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, r12
call rax
test eax, eax
jns 0x14000d80d
jmp 0x14000d786
mov rbx, rax
jmp 0x14000d7c5
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140011bf0
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140011bf0
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x140011bf0
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x140011bf0
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000b2e1
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x140011bf0
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000b790
cmp eax, 0xa6caa1c5
jne 0x14000b2cd
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x140011bf0
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140011bf0
mov rcx, r13
inc rsi
call fcn.14000b790
cmp eax, 0xffe885ef
jne 0x14000b271
jmp 0x14000b29e
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x140011c3a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140011c38
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140011c30
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x140011c30
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x140011c0e
xor eax, eax
ret
Function at 0x18000ff30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x1800eb5c7], 0
mov rdi, rdx
mov rsi, rcx
je 0x18001010f
xor eax, eax
mov dword [rbp - 0x20], 0xbcbfaa89
xor ebx, ebx
mov dword [rbp - 0x1c], 0xbca0bd97
mov edx, ebx
mov word [rbp - 0x18], 0xaea2
mov byte [rbp - 0x16], al
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xa
jb 0x18000ff80
mov rax, qword [rsi]
mov rcx, rsi
mov byte [rbp - 0x16], bl
mov rdx, qword [rax + 0x18]
call rdx
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x10]
mov rcx, rax
call rdx
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x180010062
movdqa xmm0, xmmword [0x180008080]
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0xe], al
mov edx, ebx
mov word [rbp - 0x10], 0xbbbb
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0x12
jb 0x18000ffe1
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xe], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
jne 0x18001005b
mov dword [rbp - 0x20], 0xa5bfa082
mov edx, ebx
mov dword [rbp - 0x1c], 0x8aacbcb0
mov dword [rbp - 0x18], 0xaab7bb95
mov word [rbp - 0x14], 0xbfbf
mov byte [rbp - 0x12], al
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xe
jb 0x180010030
lea rdx, [rbp - 0x20]
mov byte [rbp - 0x12], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x180010062
mov al, 1
jmp 0x180010111
mov dword [rbp - 0x20], 0xb8a3ae8c
mov edx, ebx
mov dword [rbp - 0x1c], 0xa1ba96b1
mov dword [rbp - 0x18], 0xa1a3bf
nop dword [rax]
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xb
jb 0x180010080
mov rax, qword [rsi]
mov rcx, rsi
mov byte [rbp - 0x15], bl
mov rdx, qword [rax + 0x18]
call rdx
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x10]
mov rcx, rax
call rdx
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x18001010f
movdqa xmm0, xmmword [0x180008130]
xor eax, eax
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0xe], al
mov word [rbp - 0x10], 0xbaa8
nop dword [rax + rax]
movsxd rax, ebx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rbx - 0x32]
inc ebx
xor byte [rcx], al
cmp ebx, 0x12
jb 0x1800100e0
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xe], 0
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
setne al
jmp 0x180010111
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x180010130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x1800eb5da], 0
mov rdi, rdx
mov rsi, rcx
je 0x18001029f
movdqa xmm0, xmmword [0x180008170]
xor eax, eax
xor ebx, ebx
mov byte [rbp - 0x10], al
mov r8d, ebx
movdqu xmmword [rbp - 0x20], xmm0
movsxd rax, r8d
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [r8 - 0x32]
inc r8d
xor byte [rcx], al
cmp r8d, 0x10
jb 0x180010171
mov rax, qword [rsi]
mov rcx, rsi
mov byte [rbp - 0x10], bl
mov rdx, qword [rax + 0x18]
call rdx
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x10]
mov rcx, rax
call rdx
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x180010202
xor eax, eax
mov dword [rbp + 0x28], 0xbebda2af
mov byte [rbp + 0x2c], al
mov edx, ebx
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0x28]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 4
jb 0x1800101d0
lea rdx, [rbp + 0x28]
mov byte [rbp + 0x2c], bl
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x180010202
mov al, 1
jmp 0x1800102a1
mov dword [rbp - 0x20], 0xbdbcbaac
mov edx, ebx
mov dword [rbp - 0x1c], 0xa68ba7b7
mov dword [rbp - 0x18], 0xb2bbbea2
mov word [rbp - 0x14], 0xa3
nop
movsxd rax, edx
lea rcx, [rbp - 0x20]
add rcx, rax
lea eax, [rdx - 0x32]
inc edx
xor byte [rcx], al
cmp edx, 0xd
jb 0x180010220
mov rax, qword [rsi]
mov rcx, rsi
mov byte [rbp - 0x13], bl
mov rdx, qword [rax + 0x18]
call rdx
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x10]
mov rcx, rax
call rdx
lea rdx, [rbp - 0x20]
mov rcx, rax
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x18001029f
xor eax, eax
mov dword [rbp + 0x28], 0xbebda2af
mov byte [rbp + 0x2c], al
nop
movsxd rax, ebx
lea rcx, [rbp + 0x28]
add rcx, rax
lea eax, [rbx - 0x32]
inc ebx
xor byte [rcx], al
cmp ebx, 4
jb 0x180010270
lea rdx, [rbp + 0x28]
mov byte [rbp + 0x2c], 0
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
setne al
jmp 0x1800102a1
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rbp
ret
Function at 0x180019350
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x24
jb 0x180019360
mov byte [rcx + 0x24], 0
mov rax, rcx
ret

Function at 0x180019380
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x39
jb 0x180019390
mov byte [rcx + 0x39], 0
mov rax, rcx
ret

Function at 0x1800193b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x31
jb 0x1800193c0
mov byte [rcx + 0x31], 0
mov rax, rcx
ret

Function at 0x1800193e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x28
jb 0x1800193f0
mov byte [rcx + 0x28], 0
mov rax, rcx
ret

Function at 0x180019410
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x2f
jb 0x180019420
mov byte [rcx + 0x2f], 0
mov rax, rcx
ret

Function at 0x180019440
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x26
jb 0x180019450
mov byte [rcx + 0x26], 0
mov rax, rcx
ret

Function at 0x180019470
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x30
jb 0x180019480
mov byte [rcx + 0x30], 0
mov rax, rcx
ret

Function at 0x1800194a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x2c
jb 0x1800194b0
mov byte [rcx + 0x2c], 0
mov rax, rcx
ret

Function at 0x1800194d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x22
jb 0x1800194e0
mov byte [rcx + 0x22], 0
mov rax, rcx
ret

Function at 0x180019500
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x20
jb 0x180019510
mov byte [rcx + 0x20], 0
mov rax, rcx
ret

Function at 0x180019530
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x1c
jb 0x180019540
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x180019560
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax - 0x32]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x18
jb 0x180019570
mov byte [rcx + 0x18], 0
mov rax, rcx
ret