joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019da0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5f90], 0
lea rbx, [rcx + 0x5f98]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140019e47
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140019dfa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001c4d0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140003860
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5f90]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5fa0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140059a08]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140019e4f
mov rcx, rbx
call fcn.140003860
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001a170
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140059a10]
xor ebp, ebp
cmp byte [rbx + 0x5ee8], bpl
jne 0x14001a24f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001a248
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.140003210
mov rsi, rax
test rax, rax
je 0x14001a248
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14001a1d4
mov rcx, rax
call fcn.14001a3a0
mov r8, qword [0x140059a10]
test r8, r8
je 0x14001a23f
movsx rdx, word [r8 + 0x6048]
lea rcx, [r8 + 0x604c]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14001a234
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6048], cx
movsx rax, cx
lea rcx, [r8 + 0x604c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x6044]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5ee8], 1
movss xmm0, dword [rbx + 0x5eec]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001a2de
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5eec], xmm0
jb 0x14001a2de
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14001a2d1
mov rax, qword [0x140059a10]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5eec], ebp
call fcn.14001a600
lea rdx, [0x140049534]
mov rcx, rdi
mov rsi, rax
call fcn.140003120
mov rdi, rax
test rax, rax
je 0x14001a2d8
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001a2d8
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5eec], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a300
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140059a10]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001a363
mov qword [rsp], rbx
lea rbx, [0x140049a00]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001a343
cmp byte [r8], r9b
jne 0x14001a343
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001a330
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f00]
not eax
mov r8, qword [r10 + 0x5f08]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001a38f
cmp dword [r8 + 8], eax
je 0x14001a396
add r8, 0x48
cmp r8, rcx
jne 0x14001a380
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x14002ebd0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x140056010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x140059a10]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14002edee
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14002edee
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x140059a10]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x14002eca4
movsx rdx, word [r8 + 0x6048]
lea rax, [r8 + 0x604c]
mov r9d, dword [r8 + 0x3f60]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x14002ec99
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6048], cx
movsx rax, cx
lea rax, [rax*8 + 0x604c]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6040]
test rdi, rdi
je 0x14002ecc1
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x14002ecc4
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, str.imgui_impl_win32
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x14002ed07
mov rsi, qword [r8 + 0x90]
jmp 0x14002ed0a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14002ed35
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x140059a10]
mov rcx, qword [rax + 0x4ad0]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14002edae
inc rbx
cmp rbx, 5
jl 0x14002ed90
jmp 0x14002edda
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x14002edf0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400463c0
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x14003d600
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x14003d68c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x14003d660
lea r11, [0x140049a00]
nop
cmp r9b, 0x23
jne 0x14003d643
cmp byte [r8], r9b
jne 0x14003d643
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14003d630
mov rcx, qword [0x140059a10]
not eax
cmp dword [rcx + 0x406c], eax
jne 0x14003d677
mov dword [rcx + 0x4070], eax
cmp dword [rcx + 0x4098], eax
jne 0x14003d6e9
mov byte [rcx + 0x409c], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x140059a10]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4008]
movsxd rax, dword [rbx + 0x100]
mov r8, qword [rbx + 0x108]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.140003070
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x4054], eax
jne 0x14003d6e2
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.14001b430
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140040e80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140056010]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, dword [0x140059ba0]
movsxd rax, dword [0x140059a24]
xor r9d, r9d
cmp eax, 0x7b
ja 0x140040ec0
lea r9, str.Press_any_key..
mov r9, qword [r9 + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0xf
mov byte [rbp - 0x28], 0
test r9, r9
jne 0x140040f0f
mov qword [rbp - 0x18], 0xe
movsd xmm0, qword [str.Select_any_Key]
movsd qword [rbp - 0x28], xmm0
mov eax, dword [0x14004e660]
mov dword [rbp - 0x20], eax
movzx eax, word [0x14004e664]
mov word [rbp - 0x1c], ax
mov byte [rbp - 0x1a], r9b
jmp 0x140040f48
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140040f16
lea rcx, [rbp - 0x28]
cmp rbx, 0xf
ja 0x140040f40
mov qword [rbp - 0x18], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x28], 0
jmp 0x140040f48
mov rdx, rbx
call fcn.140045c30
cmp edi, 1
jne 0x140040f9a
mov rax, qword [rbp - 0x10]
cmp rax, 0xd
jb 0x140040f85
lea rbx, [rbp - 0x28]
cmp rax, 0x10
cmovae rbx, qword [rbp - 0x28]
mov qword [rbp - 0x18], 0xd
lea r8d, [rdi + 0xc]
lea rdx, str.Press_the_Key
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xd], 0
jmp 0x140040f9a
lea r9, str.Press_the_Key
mov edx, 0xd
lea rcx, [rbp - 0x28]
call fcn.140045c30
mov dword [rbp - 0x30], 0x42fa0000
mov dword [rbp - 0x2c], 0x41a00000
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae rcx, qword [rbp - 0x28]
lea rdx, [rbp - 0x30]
call fcn.140031c40
test al, al
je 0x140040fe9
test edi, edi
jne 0x140040fe9
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, [0x140040e30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140041027
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041022
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041022
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004655c
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400463c0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x140046dc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140046e0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140046e0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140046e0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140046e0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140046e0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140046e0c
xor al, al
add rsp, 0x28
ret
Function at 0x140017820
Capabilities:
Read file via mapping

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbx, r8
mov r15d, edx
mov rsi, rcx
mov rax, qword [0x140054018]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [rcx + 0x28]
mov rcx, rdi
call fcn.140017700
xor ebp, ebp
cmp rbx, 0x7fffffff
ja 0x140017868
test al, al
je 0x140017868
cmp qword [rsi + 0x58], 0
je 0x140017884
xor ebp, ebp
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140045f60
mov eax, ebp
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp byte [rsi], 0
je 0x14001790d
mov rcx, rdi
call fcn.140017710
mov r14, rax
mov rbp, qword [0x140054c18]
test rbp, rbp
jne 0x1400178cb
lea rcx, [0x14004c3fe]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.NtQuerySection
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
mov qword [0x140054c18], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x30]
mov rcx, r14
xor edx, edx
mov r9d, 0x18
call rbp
test eax, eax
jne 0x140017866
test dword [rsp + 0x38], 0x1000000
jne 0x140017866
mov r14d, r15d
sar r14d, 0x1f
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140017710
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x58], rax
test rax, rax
jne 0x140017984
xor eax, eax
cmp byte [rsi + 0x60], 0
sete al
lea ebp, [rax + rax]
add ebp, 4
mov rcx, rdi
call fcn.140017710
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov edx, ebp
mov r8d, r14d
mov r9d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 0x58], rax
test rax, rax
je 0x140017866
mov rbp, rax
lea rdx, [rsp + 0x30]
mov r8d, 0x30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400179a4
xor eax, eax
jmp 0x1400179b1
mov rax, qword [rsp + 0x48]
sub rax, rbp
add rax, qword [rsp + 0x38]
mov qword [rsi + 0x50], rax
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400176a0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x70], xmm0
call fcn.1400179e0
mov bpl, 1
jmp 0x140017868

Function at 0x140017a40
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [rcx], rdx
je 0x140017ab4
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rcx, rsi
call fcn.140017ad0
lea rax, [rdi + 1]
cmp rax, 2
jb case.default.0x140017aad
mov qword [rsi], rdi
call fcn.140017670
mov rbx, rax
mov r15, qword [rsp + 0x58]
call sym.firefox.exe_GetHandleVerifier
mov rbp, qword [rax]
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, r15
call qword [rbp + 8]
mov ecx, r14d
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
out 0xf2, eax
mov edx, 0x1cd57617
call rsp
scasb al, byte [rdi]
fabs
mov ch, byte [rax + rdx - 0x49]
cmovae ebx, dword [rax]
int3
Function at 0x180001238
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [0x1800990e0]
lea r9, [rbp - 8]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x18000127e
lea rcx, [rsi + 0x58]
lea rdx, [rbp - 8]
call fcn.1800013f4
mov rcx, qword [rbp - 8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
add rsi, 0x58
cmp byte [0x1800a8ef9], 0
jne 0x1800013bd
mov rax, qword [0x1800a4028]
movabs rcx, 0xa0599b32101c6863
mov cl, byte [rax + rcx]
movabs rdx, 0xa0599b32101c6877
xor cl, byte [rax + rdx]
mov byte [0x1800a8ef0], cl
movabs rcx, 0xa0599b32101c6864
mov cl, byte [rax + rcx]
movabs rdx, 0xa0599b32101c6878
xor cl, byte [rax + rdx]
mov byte [0x1800a8ef1], cl
movabs rcx, 0xa0599b32101c6865
mov cl, byte [rax + rcx]
movabs rdx, 0xa0599b32101c6879
xor cl, byte [rax + rdx]
mov byte [0x1800a8ef2], cl
movabs rcx, 0xa0599b32101c6866
mov cl, byte [rax + rcx]
movabs rdx, 0xa0599b32101c687a
xor cl, byte [rax + rdx]
mov byte [0x1800a8ef3], cl
movabs rcx, 0xa0599b32101c6867
mov cl, byte [rax + rcx]
movabs rdx, 0xa0599b32101c687b
xor cl, byte [rax + rdx]
mov byte [0x1800a8ef4], cl
movabs rcx, 0xa0599b32101c6868
mov cl, byte [rax + rcx]
movabs rdx, 0xa0599b32101c687c
xor cl, byte [rax + rdx]
mov byte [0x1800a8ef5], cl
movabs rcx, 0xa0599b32101c6869
mov cl, byte [rax + rcx]
movabs rdx, 0xa0599b32101c687d
xor cl, byte [rax + rdx]
mov byte [0x1800a8ef6], cl
movabs rcx, 0xa0599b32101c686a
mov cl, byte [rax + rcx]
movabs rdx, 0xa0599b32101c687e
xor cl, byte [rax + rdx]
mov byte [0x1800a8ef7], cl
movabs rcx, 0xa0599b32101c686b
mov cl, byte [rax + rcx]
movabs rdx, 0xa0599b32101c687f
xor cl, byte [rax + rdx]
mov byte [0x1800a8ef8], cl
mov byte [0x1800a8ef9], 1
movabs rdx, 0xa0599b32101c6849
add rdx, qword [0x1800a4030]
mov rcx, rsi
call fcn.18000146e
nop
add rsp, 0x38
pop rsi
pop rbp
ret
Function at 0x18000224e
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov al, byte [rcx]
test al, al
jne 0x180002282
mov byte [rdi], 1
call fcn.180008cf2
mov qword [rdi + 8], rax
mov al, byte [rdi]
cmp al, 1
jne 0x1800022ab
mov rcx, qword [rdi + 8]
lea rdi, [rbp - 8]
mov rdx, rdi
mov r8, rsi
call fcn.180009878
mov rax, qword [rdi]
add rax, 0x40
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.180009128
lea rcx, [rbp - 0x28]
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800a9194], 0
jne 0x18000232d
mov rax, qword [0x1800a40c0]
movabs rcx, 0x2fbc859f8f9fb2ad
add rcx, rax
movabs r8, 0x2fbc859f8f9fb291
add r8, rax
xor r9d, r9d
movabs r10, 0x4924924924924925
lea r11, [0x1800a9161]
mov rax, r9
shr rax, 2
mul r10
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
add rax, r8
mov al, byte [r9 + rax]
xor al, byte [rcx + r9]
mov byte [r9 + r11], al
inc r9
cmp r9, 0x33
jne 0x1800022fd
mov byte [0x1800a9194], 1
movabs rsi, 0x2fbc859f8f9fab28
mov rdx, qword [0x1800a40c8]
add rdx, rsi
lea rcx, [rbp - 8]
lea r8, [rbp - 0x28]
call fcn.1800090d4
lea rcx, [rbp - 0x60]
lea r8, [rbp - 8]
mov edx, 0x131
call fcn.180008d68
add rsi, qword [0x1800a40d0]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1800024aa
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov al, byte [rcx]
test al, al
jne 0x1800024df
mov byte [rdi], 1
call fcn.180008cf2
mov qword [rdi + 8], rax
mov al, byte [rdi]
cmp al, 1
jne 0x180002546
mov rdi, qword [rdi + 8]
xorps xmm0, xmm0
mov rbx, rbp
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rbx
mov rdx, rsi
mov r8, rax
call fcn.180005588
lea rdx, [rbp - 0x20]
mov rcx, rdi
mov r8, rbx
call fcn.18000aae6
mov rsi, qword [rbp - 0x20]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x180002533
mov rcx, qword [rbp]
inc rdx
call fcn.180004dc2
add rsi, 0x40
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.180009128
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800a9194], 0
jne 0x1800025c8
mov rax, qword [0x1800a40e0]
movabs rcx, 0xc9575cd48a06e4bd
add rcx, rax
movabs r8, 0xc9575cd48a06e4a1
add r8, rax
xor r9d, r9d
movabs r10, 0x4924924924924925
lea r11, [0x1800a9161]
mov rax, r9
shr rax, 2
mul r10
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
add rax, r8
mov al, byte [r9 + rax]
xor al, byte [rcx + r9]
mov byte [r9 + r11], al
inc r9
cmp r9, 0x33
jne 0x180002598
mov byte [0x1800a9194], 1
movabs rsi, 0xc9575cd48a06dd38
mov rdx, qword [0x1800a40e8]
add rdx, rsi
mov rcx, rbp
lea r8, [rbp - 0x20]
call fcn.1800090d4
lea rcx, [rbp - 0x58]
mov r8, rbp
mov edx, 0x131
call fcn.180008d68
add rsi, qword [0x1800a40f0]
lea rcx, [rbp - 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x180004416
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rdi, rcx
cmp byte [rcx], 1
jne 0x1800044cd
mov rsi, r8
mov r8, rdx
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.18001dabc
mov qword [rbp - 8], rdi
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movabs rax, 0x8000000000000000
mov qword [rbp + 0x10], rax
movzx eax, byte [rdi]
cmp eax, 2
je 0x180004481
cmp eax, 1
jne 0x18000448f
mov rax, qword [rdi + 8]
mov rax, qword [rax]
mov qword [rbp], rax
jmp 0x180004497
mov rax, qword [rdi + 8]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
jmp 0x180004497
mov qword [rbp + 0x10], 1
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 8]
call fcn.18001dc5e
test al, al
jne 0x1800044c0
lea rcx, [rbp - 0x28]
call fcn.18001db28
lea rsi, [rbp - 8]
mov rcx, rax
mov rdx, rsi
call fcn.18001ed7c
mov eax, dword [rsi]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.180009128
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800aa1db], 0
jne 0x180004530
mov rdx, qword [0x1800a41a0]
movabs rax, 0x5e720e34e3dde8c3
add rax, rdx
movabs rcx, 0x5e720e34e3dde8dc
add rcx, rdx
xor edx, edx
lea r8, [0x1800aa1c2]
mov r9b, byte [rax + rdx]
xor r9b, byte [rcx + rdx]
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0x19
jne 0x180004514
mov byte [0x1800aa1db], 1
movabs rsi, 0x5e720e34e3ddba0d
mov rdx, qword [0x1800a41a8]
add rdx, rsi
lea rcx, [rbp - 0x28]
lea r8, [rbp - 8]
call fcn.1800090d4
lea rcx, [rbp - 0x60]
lea r8, [rbp - 0x28]
mov edx, 0x132
call fcn.180008d68
add rsi, qword [0x1800a41b0]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1800046ac
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rdi, rcx
cmp byte [rcx], 1
jne 0x180004763
mov rsi, r8
mov r8, rdx
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.18001dabc
mov qword [rbp - 8], rdi
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movabs rax, 0x8000000000000000
mov qword [rbp + 0x10], rax
movzx eax, byte [rdi]
cmp eax, 2
je 0x180004717
cmp eax, 1
jne 0x180004725
mov rax, qword [rdi + 8]
mov rax, qword [rax]
mov qword [rbp], rax
jmp 0x18000472d
mov rax, qword [rdi + 8]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
jmp 0x18000472d
mov qword [rbp + 0x10], 1
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 8]
call fcn.18001dc5e
test al, al
jne 0x180004756
lea rcx, [rbp - 0x28]
call fcn.18001db28
lea rsi, [rbp - 8]
mov rcx, rax
mov rdx, rsi
call fcn.18001e27f
mov al, byte [rsi]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.180009128
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800aa1db], 0
jne 0x1800047c6
mov rdx, qword [0x1800a41c0]
movabs rax, 0x6a2a9d0ecf2a55a5
add rax, rdx
movabs rcx, 0x6a2a9d0ecf2a55be
add rcx, rdx
xor edx, edx
lea r8, [0x1800aa1c2]
mov r9b, byte [rax + rdx]
xor r9b, byte [rcx + rdx]
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0x19
jne 0x1800047aa
mov byte [0x1800aa1db], 1
movabs rsi, 0x6a2a9d0ecf2a26ef
mov rdx, qword [0x1800a41c8]
add rdx, rsi
lea rcx, [rbp - 0x28]
lea r8, [rbp - 8]
call fcn.1800090d4
lea rcx, [rbp - 0x60]
lea r8, [rbp - 0x28]
mov edx, 0x132
call fcn.180008d68
add rsi, qword [0x1800a41d0]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x180004886
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rdi, rcx
cmp byte [rcx], 1
jne 0x18000493f
mov rsi, r8
mov r8, rdx
lea rdx, [rbp - 0x28]
mov rcx, rdi
call fcn.18001dabc
mov qword [rbp - 8], rdi
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movabs rax, 0x8000000000000000
mov qword [rbp + 0x10], rax
movzx eax, byte [rdi]
cmp eax, 2
je 0x1800048f1
cmp eax, 1
jne 0x1800048ff
mov rax, qword [rdi + 8]
mov rax, qword [rax]
mov qword [rbp], rax
jmp 0x180004907
mov rax, qword [rdi + 8]
mov rax, qword [rax + 8]
mov qword [rbp + 8], rax
jmp 0x180004907
mov qword [rbp + 0x10], 1
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 8]
call fcn.18001dc5e
test al, al
jne 0x180004930
lea rcx, [rbp - 0x28]
call fcn.18001db28
lea rsi, [rbp - 8]
mov rcx, rax
mov rdx, rsi
call fcn.18001e3ea
movss xmm0, dword [rsi]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
mov rcx, rdi
call fcn.180009128
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800aa1db], 0
jne 0x1800049a2
mov rdx, qword [0x1800a41e0]
movabs rax, 0x2bbb533276aafe81
add rax, rdx
movabs rcx, 0x2bbb533276aafe9a
add rcx, rdx
xor edx, edx
lea r8, [0x1800aa1c2]
mov r9b, byte [rax + rdx]
xor r9b, byte [rcx + rdx]
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0x19
jne 0x180004986
mov byte [0x1800aa1db], 1
movabs rsi, 0x2bbb533276aacfcb
mov rdx, qword [0x1800a41e8]
add rdx, rsi
lea rcx, [rbp - 0x28]
lea r8, [rbp - 8]
call fcn.1800090d4
lea rcx, [rbp - 0x60]
lea r8, [rbp - 0x28]
mov edx, 0x132
call fcn.180008d68
add rsi, qword [0x1800a41f0]
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3