joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f1960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11, r8
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x1400f1979
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x140149870]
cmp r8, 8
jb 0x1400f1a7d
mov qword [rsp + 0x10], rbx
mov rbx, r8
shr rbx, 3
mov rax, rbx
imul rax, rax, 0xfffffffffffffff8
add r11, rax
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
dec rbx
jne 0x1400f19b0
mov rbx, qword [rsp + 0x10]
test r11, r11
je 0x1400f1aaf
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
dec r11
jne 0x1400f1a90
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret
Function at 0x1400f2120
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x41], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x1400f2224
mov rcx, qword [rcx + 0x50]
mov qword [rsp + 0x48], rbp
test rcx, rcx
je 0x1400f2162
cmp dword [rbx + 0x58], edi
jae 0x1400f2162
call fcn.140109878
mov qword [rbx + 0x50], 0
cmp qword [rbx + 0x50], 0
jne 0x1400f2178
lea ecx, [rdi + rdi]
call fcn.1401094b8
mov dword [rbx + 0x58], edi
mov qword [rbx + 0x50], rax
mov rcx, qword [rbx + 0x50]
mov r8, rdi
mov rdx, rsi
mov rbp, rdi
call fcn.140109100
test edi, edi
je 0x1400f221b
xor r11d, r11d
lea rsi, [0x140149870]
nop dword [rax]
mov rax, qword [rbx + 0x50]
mov edx, dword [rbx + 0x44]
mov r8d, dword [rbx + 0x4c]
movsx r10, byte [r11 + rax]
mov ecx, edx
shr edx, 8
xor rcx, r10
mov r9d, r8d
inc r11
movzx eax, cl
and r9d, 0xfffd
mov ecx, dword [rsi + rax*4]
or r9d, 2
xor ecx, edx
mov dword [rbx + 0x44], ecx
movzx eax, cl
movzx ecx, r8b
add eax, dword [rbx + 0x48]
shr r8d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x48], eax
movzx eax, byte [rbx + 0x4b]
xor rcx, rax
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
mov dword [rbx + 0x4c], eax
mov rax, qword [rbx + 0x50]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
dec rbp
mov byte [r11 + rax - 1], cl
jne 0x1400f21a0
mov rsi, qword [rbx + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x1400f2274
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x1400f2251
mov dword [rbx + 0x24], 0x30000
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
add rcx, rdx
mov r8, rdi
mov rdx, rsi
call fcn.140109100
add dword [rbx + 0x38], edi
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400f22ab
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x58]
mov dword [rbx + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400f2930
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0xb8]
mov rsi, rdx
test rcx, rcx
je 0x1400f29bc
mov eax, dword [rdi + 0xc4]
mov qword [rsp + 0x48], rbp
mov ebp, dword [rdi + 0xc0]
cmp eax, ebp
jb 0x1400f297d
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
sub ebp, eax
lea rdx, [rcx + rax]
mov rcx, rsi
cmp ebp, r8d
cmova ebp, r8d
mov r8d, ebp
call fcn.140109100
mov ecx, dword [rdi + 0xa0]
add dword [rdi + 0xc4], ebp
add dword [rdi + 0x9c], ebp
mov r8d, ebp
mov rdx, rsi
call fcn.1400f1960
mov dword [rdi + 0xa0], eax
mov eax, ebp
jmp 0x1400f2968
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x1400f2a13
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400f2a1a
mov ebx, dword [rsp + 0x40]
mov ecx, dword [rdi + 0xa0]
mov rdx, rsi
add dword [rdi + 0x9c], ebx
mov r8d, ebx
call fcn.1400f1960
mov dword [rdi + 0xa0], eax
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rdi + 0x24], 0x1000000
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1401088c4
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140108734

Function at 0x140112ff8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1401692b0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14010cb90
xor ebx, ebx
cmp qword [0x14016db58], rbx
mov rdi, rax
jne 0x14011310b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1401131e2
lea rdx, [0x140128b20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401131e2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14016db58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14016db60], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14016db68], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14016db78], rax
test rax, rax
je 0x140113102
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14016db70], rax
jmp 0x140113112
mov rax, qword [0x14016db70]
jmp 0x140113119
mov rax, qword [0x14016db70]
mov r11, qword [0x14016db78]
cmp rax, rdi
je 0x140113180
cmp r11, rdi
je 0x140113180
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14016db78]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140113180
test rax, rax
je 0x140113180
call rsi
test rax, rax
je 0x14011317a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14011317a
test byte [rsp + 0x40], 1
jne 0x140113180
bts ebp, 0x15
jmp 0x1401131c0
mov rcx, qword [0x14016db60]
cmp rcx, rdi
je 0x1401131c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1401131c0
call rax
mov rbx, rax
test rax, rax
je 0x1401131c0
mov rcx, qword [0x14016db68]
cmp rcx, rdi
je 0x1401131c0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1401131c0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14016db58]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1401131e2
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1401131e4
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140110310
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401150b3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1401692b0]
jne 0x14011032a
rol rcx, 0x10
test cx, 0xffff
jne 0x140110326
repz ret
ror rcx, 0x10
jmp 0x14011500c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14016dca0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14016dd98]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140115091
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14016dca0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1401150b3
mov rax, qword [rsp + 0x88]
mov qword [0x14016dd98], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14016dd38], rax
mov rax, qword [0x14016dd98]
mov qword [0x14016dc10], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14016dd20], rax
mov dword [0x14016dc00], 0xc0000409
mov dword [0x14016dc04], 1
mov rax, qword [0x1401692b0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1401692b8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14016dc98], eax
mov ecx, 1
call fcn.140112df4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1401294f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14016dc98], 0
jne 0x14011513a
mov ecx, 1
call fcn.140112df4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000d910
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140016c60], rbx
je 0x14000d977
cmp rax, rbx
jne 0x14000d96a
mov ebx, 1
mov esi, ebx
jmp 0x14000d97c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000d94f
mov ebx, 1
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000d994
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000da00
mov eax, dword [0x140016c68]
test eax, eax
jne 0x14000d9f5
mov dword [0x140016c68], ebx
lea r15, [0x140010bb8]
lea rdi, [0x140010ba0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000d9e7
test eax, eax
jne 0x14000d9eb
cmp qword [rdi], r14
je 0x14000d9dc
mov rax, qword [rdi]
mov rcx, qword [0x140010b58]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000d9be
test eax, eax
je 0x14000d9fb
mov eax, 0xff
jmp 0x14000db56
mov dword [0x1400163e4], ebx
mov edi, 0x1f
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000da27
lea rdx, [0x140010b98]
lea rcx, [0x140010b60]
call sub.msvcrt.dll__initterm
mov dword [0x140016c68], 2
test esi, esi
jne 0x14000da35
mov rax, r14
xchg qword [0x140016c60], rax
cmp qword [0x140016c80], r14
je 0x14000da68
lea rcx, [0x140016c80]
call fcn.14000dfd0
test eax, eax
je 0x14000da68
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140016c80]
mov r9, qword [0x140010b58]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000da81
mov eax, 0xff
jmp 0x14000db56
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000db07
test ax, ax
je 0x14000da9c
test edx, edx
jne 0x14000db07
sub ax, bx
cmp ax, di
ja 0x14000dab2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000da9c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400019fc
mov dword [0x1400163e0], eax
cmp dword [0x140016400], r14d
jne 0x14000daf0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400163e4], r14d
jne 0x14000db05
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400163e0]
jmp 0x14000db56
cmp ax, 0x22
jne 0x14000db1b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000da8a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call 0x140169000
add rsp, 0x28
jmp 0x14000d910
Function at 0x1400342c8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14004c350], eax
call fcn.140034d70
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x14004c350], 0
jne case.default.0x14003431e
mov ecx, 1
call fcn.140034d70
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]

Function at 0x140b929ca
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rax
push rsi
jmp 0x140b7e616
rol edx, 3
test bpl, 0x14
clc
not edx
cmc
cmp r10b, 0xca
push rdi
xor dword [rsp], edx
pop rdi
movsxd rdx, edx
stc
add r11, rdx
jmp 0x140b389f7
push r11
ret
push r15
jmp 0x140a5e55f
push rdx
movsx r8d, r10w
push r11
push r13
rdtsc
not rdx
push r12
cmovge bp, cx
bswap r11
pushfq
push r10
rdtsc
push rdi
add r10b, r15b
movabs rax, 0
rcl r10b, 0x41
rol r11b, 0xfa
push rax
and r11w, 0x7765
neg r10
mov rbp, qword [rsp + 0x90]
neg ebp
cwd
add ebp, 0x4c887cbf
bswap ebp
bts r8w, r8w
ror ebp, 2
xor dx, 0x738c
add rbp, rax
and r8d, 0x593c29f2
movabs rdx, 0x100000000
bt r11, r8
sal di, cl
add rbp, rdx
mov r8w, 0x167f
mov r8, rsp
sub rsp, 0x180
and rsp, 0xfffffffffffffff0
mov rdi, rbp
cmp r8b, r9b
movsxd r10, r8d
movabs r10, 0
sub rdi, r10
sar edx, 0x65
test ah, al
lea r11, [0x140b7e6c2]
shrd rdx, r14, 0xab
add dl, 0xfa
inc dx
sub rbp, 4
and dx, r13w
mov edx, dword [rbp + riz]
cmc
xor edx, edi
cmc
neg edx
test r13b, 0x1a
cmp r9w, 0x7f7d
add edx, 0x4b62075c
test rax, r11
not edx
clc
add edx, 0xa0b0bef
jmp 0x140b1feff
push rbx
jmp 0x140b9f51a
push rcx
push rbp
push r8
movsx ebp, sp
movzx r8d, bx
mov ebp, r9d
push r9
not bpl
jmp 0x140b426f2
push r14
jmp 0x140b9cdc0
Function at 0x18000124c
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x98]
lea esi, [rdx - 0x44c9]
mov ebp, dword [rsp + 0x90]
lea r13d, [rcx - 0x4323]
xor ebp, 0x3f5
lea ebx, [rcx - 0x905]
mov r12, r8
lea r15d, [r9 - 0x3e9f]
lea r14d, [rax - 0x47f]
lea edi, [rax + 0x21e]
lea eax, [rbp + 0x37b]
cmp esi, eax
je 0x1800013b8
lea eax, [r14 - 0x5a3]
mov dword [r11 - 0x40], r9d
mov r9, qword [section..data]
mov r8d, esi
mov edx, r13d
mov dword [rsp + 0x20], eax
xor r14d, 0x56d
xor r8d, 0x44c9
mov ecx, r14d
xor edx, 0x3a1e
call fcn.1800060cc
mov r8d, ebp
mov qword [rsp + 0x20], r12
mov ecx, edi
lea r9d, [rbx + 0x23]
xor r8d, 0x7d4d
xor ecx, 0x7810
mov edx, edi
mov r14d, eax
call fcn.180005fd8
mov ebx, eax
lea ecx, [r15 + 0x405a]
xor ebx, 0x7ea
cmp ebx, ecx
jle 0x180001490
mov rdx, qword [section..data]
xor edi, 0x650
mov ecx, dword [0x18017e02c]
cmp dword [rdx + 0x94], ecx
jb 0x180001357
mov eax, dword [rdx + 0x138]
xor eax, dword [rdx + 0x50]
xor eax, dword [0x18017e044]
or dword [rdx + 0x58], eax
jmp 0x180001365
lea rax, [0x18017e160]
mov qword [0x18017e0d8], rax
mov r9d, r14d
lea edx, [r13 + 0x3933]
mov dword [rsp + 0x30], edx
lea eax, [rdi - 0x283]
xor r9d, 0x7ec8
lea r8d, [rbp - 0x201]
mov dword [rsp + 0x28], r9d
xor r14d, 0x1a5
xor esi, 0x4573
lea r9, [0x18017e010]
xor eax, 0x7ae1
mov edx, r14d
mov ecx, esi
mov dword [rsp + 0x20], eax
call fcn.180006278
jmp 0x180001490
mov ecx, dword [0x18017e0f0]
mov eax, r15d
xor eax, ebx
xor eax, r13d
cmp ecx, eax
je 0x180001490
lea esi, [rbx + 0x3a8e]
xor esi, r15d
lea edx, [r14 - 0x4355]
sub eax, ecx
mov r13d, eax
mov rax, qword [section..data]
mov r8d, dword [0x18017e0ec]
xor r8d, ebp
mov ecx, dword [rax + 0xdc]
mov r9d, dword [rax + 0x14]
xor ecx, edx
mov edx, dword [r12 + 0xe0]
sub r9d, ebx
mov dword [rsp + 0x20], ecx
add edx, edi
lea rcx, [0x18017e010]
add r9d, ebp
call sym.rjtm209qe25.dll_DIg314
mov rax, qword [section..data]
mov edx, r14d
mov r9d, dword [0x18017e150]
xor r9d, 0x405a
mov ecx, dword [rax + 0x6c]
sub edx, dword [rax + 0x34]
xor ecx, edi
mov r8d, dword [rax + 0x14]
sub ecx, edi
imul r8d, dword [0x18017e060]
mov eax, r15d
sub eax, dword [0x18017e044]
add edx, 0x3bbb
xor eax, dword [0x18017e124]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], esi
or r8d, dword [r12 + 0xc0]
mov qword [rsp + 0x20], r12
call fcn.18000298c
lea edx, [r14 - 0x4355]
mov ebp, eax
sub r13, 1
jne 0x1800013e3
lea r11, [rsp + 0x40]
mov rbp, qword [r11 + 0x38]
lea eax, [rbx - 0x174]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800014b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov ebp, r8d
lea r15d, [r8 - 0x421e]
mov r13d, r8d
mov dword [rsp + 0x60], r15d
mov ebx, r8d
xor r13d, 0x7890
mov r8d, dword [rsp + 0x90]
xor ebx, 0x792b
add r8d, 0xfffffcc3
lea eax, [rbp + 0x2ab]
mov dword [rsp + 0x90], r8d
mov rdi, rdx
cmp ebx, eax
jge 0x180001611
lea eax, [rbx + 0x7ee]
xor ecx, 0x626
cmp ecx, eax
jl 0x18000156d
mov edx, dword [rdx + 0x114]
cmp edx, 0x337
ja 0x18000155e
mov rax, qword [section..data]
mov ecx, dword [rax + 0xe0]
add ecx, edx
xor ecx, dword [rdi + 0x94]
xor ecx, dword [0x18017e050]
mov dword [rdi + 0x94], ecx
jmp 0x180001611
mov dword [0x18017e08c], 0x73a01
jmp 0x180001611
mov rax, qword [section..data]
mov edx, dword [0x18017e060]
mov ecx, dword [rax + 0x40]
mov esi, dword [rax + 0x14]
and ecx, edx
cmp esi, ecx
ja 0x180001611
xor ebx, r15d
sub ebx, r15d
mov r14d, dword [0x18017e050]
cmp r14d, ebx
jne 0x1800015f9
lea r12d, [r13 - 0x3ded]
mov r15d, r8d
and r12d, r8d
xor r15d, 0x3a8e
mov r9d, dword [rdi + 0xc0]
mov ecx, r15d
mov r8d, dword [0x18017e088]
or r9d, r13d
mov edx, dword [0x18017e024]
xor r8d, ebp
imul ecx, dword [rdi + 0x58]
or edx, dword [rdi + 0x138]
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_LockFile]
add r14d, 3
cmp r14d, ebx
je 0x1800015b0
mov edx, dword [0x18017e060]
mov r8d, dword [rsp + 0x90]
mov rax, qword [section..data]
add esi, 2
mov ecx, dword [rax + 0x40]
and ecx, edx
cmp esi, ecx
jbe 0x180001590
mov r15d, dword [rsp + 0x60]
cmp dword [rdi + 0x1c], 0xb61c
jbe 0x18000162b
mov eax, dword [0x18017e0d0]
add eax, 0x140bef
xor dword [0x18017e02c], eax
mov rax, qword [section..data]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov ecx, dword [rax + 0xf0]
xor ecx, dword [rdi + 0x114]
mov eax, dword [0x18017e098]
xor ecx, 0x1fb90f
imul eax, ecx
mov dword [0x18017e098], eax
lea eax, [r15 + 0x3ded]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180001e38
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov r10d, dword [rsp + 0x58]
lea ebx, [rcx - 0x3d63]
mov r8d, dword [rsp + 0x60]
add r10d, 0xffffba8d
add r8d, 0xfffff83d
lea eax, [r10 + 0x4355]
cmp ebx, eax
jge 0x18000200a
mov ecx, ebx
lea eax, [r9 + 0x50e]
xor ecx, 0x405a
cmp eax, ecx
jle 0x180001fca
mov r9, qword [rsp + 0x50]
xor r10d, r10d
mov rdx, qword [section..data]
mov rax, qword [0x18017e0d8]
mov r8d, dword [r10 + rax]
add r10, 4
imul r8d, dword [r9 + 0x98]
mov eax, dword [0x18017e068]
add eax, 0xfff05353
add dword [rdx + 0x94], eax
mov ecx, dword [0x18017e064]
mov rax, qword [section..data]
mov edx, r8d
shr edx, 0x10
sub ecx, dword [rax + 0x88]
add ecx, 0x2881c04
add dword [r9 + 0x28], ecx
movsxd rcx, dword [0x18017e0ac]
mov rax, qword [0x18017e0e0]
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [0x18017e0ac]
movsxd rcx, dword [r9 + 0x9c]
mov rax, qword [0x18017e0e0]
shr edx, 8
mov byte [rcx + rax], dl
inc dword [r9 + 0x9c]
movsxd rcx, dword [r9 + 0x9c]
mov rax, qword [0x18017e0e0]
mov byte [rcx + rax], r8b
inc dword [r9 + 0x9c]
mov rax, qword [section..data]
mov ecx, dword [rax + 0x54]
mov eax, dword [r9 + 0x28]
inc ecx
imul eax, ecx
mov dword [r9 + 0x28], eax
mov eax, dword [r9 + 0x140]
sub eax, dword [0x18017e0a4]
mov rcx, qword [section..data]
sub eax, 0xec1e2
add dword [rcx + 0xac], eax
mov eax, dword [0x18017e0f0]
sub eax, dword [0x18017e02c]
mov rcx, qword [section..data]
add eax, 0x19d265
add dword [rcx + 0xe0], eax
mov ecx, dword [r9 + 0x88]
add ecx, dword [0x18017e08c]
mov eax, dword [0x18017e064]
mov rdx, qword [section..data]
add eax, 0xfd70a9fb
add ecx, eax
mov eax, dword [0x18017e044]
mov dword [0x18017e064], ecx
add eax, 0x18d330
mov ecx, dword [rdx + 0x14]
add ecx, eax
xor dword [0x18017e0a4], ecx
cmp r10, 0x7400
jl 0x180001e91
jmp 0x18000200a
lea eax, [rdx + 0x37ec]
add eax, r8d
cmp dword [0x18017e0b4], eax
jne 0x18000200a
mov rax, qword [section..data]
mov ecx, dword [rax + 0x40]
sub ecx, r8d
and ecx, r8d
cmp dword [0x18017e02c], ecx
ja 0x18000200a
mov ecx, dword [0x18017e11c]
mov eax, r10d
or rcx, rax
mov eax, ebx
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
lea eax, [rbx + 0x3933]
add rsp, 0x20
pop rbx
ret
Function at 0x180002854
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x90]
lea r13d, [rcx - 0x3a8e]
mov edi, eax
mov r14d, ecx
xor r14d, 0x7a2e
xor edi, 0x3a1e
mov r15, r9
lea ecx, [rax + 0x481]
lea ebx, [rax - 0xeb]
mov eax, r14d
xor eax, 0x3f5
cmp ecx, eax
jge 0x180002963
lea eax, [rbx + 0x9f0]
cmp edi, eax
jge 0x1800028dc
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x138]
sub eax, dword [0x18017e04c]
add eax, 0xbcce4
add dword [rcx + 0xf0], eax
jmp 0x180002963
mov eax, dword [r9 + 0x138]
mov ebp, edi
mov r12d, dword [r9 + 0x78]
xor ebp, 0x44c9
or eax, ebp
cmp r12d, eax
je 0x180002963
mov esi, r13d
or esi, r14d
xor esi, 0x3d63
mov rdx, qword [section..data]
mov r8d, r13d
mov eax, dword [0x18017e148]
or r8d, dword [r15 + 0x54]
xor eax, edi
and r8d, 0x43ad
mov ecx, dword [rdx]
mov r9d, dword [rdx + 0xc0]
add ecx, 0x362a
xor ecx, dword [0x18017e060]
xor r9d, r14d
mov dword [rsp + 0x30], ecx
lea ecx, [rdi - 0x8412]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov edx, esi
call fcn.180001e38
mov ecx, dword [r15 + 0x138]
add r12d, 2
or ecx, ebp
cmp r12d, ecx
jne 0x180002902
lea r11, [rsp + 0x40]
xor ebx, 0x7e5
mov rbp, qword [r11 + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret