joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14024a754
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x14024a731
call fcn.14022a39c
mov dword [rax], 0x16
call fcn.14022a230
or eax, 0xffffffff
jmp 0x14024a74e
sub dword [rcx + 0x10], 1
jns 0x14024a740
add rsp, 0x28
jmp fcn.14024b5b0
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14024a710

Function at 0x14024a9f4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x14032a640]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14024aa52
cmp word [rdx], r12w
jne 0x14024aa52
or byte [rax + r8*8 + 0x38], cl
jmp 0x14024aa58
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14024abb3
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x14024ab8e
lea r9, [rcx + 2]
cmp ax, r13w
je 0x14024aa91
mov rcx, r9
jmp 0x14024aab4
cmp r9, rdx
jae 0x14024aacb
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14024aa75
jmp 0x14024abb3
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14024ab88
cmp dword [rsp + 0x80], edi
je 0x14024ab88
mov rdx, r14
lea r11, [0x14032a640]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x14024ab61
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x14024ab34
mov word [rbx], r12w
jmp 0x14024abaf
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x14024ab3d
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x14024abaf
cmp word [rsp + 0x70], r12w
jne 0x14024ab6e
cmp rbx, rsi
je 0x14024ab2e
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.14024b99c
cmp word [rsp + 0x70], r12w
je 0x14024abb3
mov word [rbx], r13w
jmp 0x14024abaf
lea r11, [0x14032a640]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x14024abab
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14024abb3
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14024b5b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x14024b5e2
call fcn.14022a39c
mov dword [rax], 0x16
call fcn.14022a230
jmp 0x14024b701
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14024b701
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14024b701
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14024b611
lock or dword [rcx + 0x14], 0x10
jmp 0x14024b701
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14024b625
call fcn.1402524f4
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14023e93c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.14024aea0
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14024b6ef
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14024b6ba
mov rcx, rsi
call fcn.14023e93c
cmp eax, edi
je 0x14024b6a5
mov rcx, rsi
call fcn.14023e93c
cmp eax, 0xfffffffe
je 0x14024b6a5
mov rcx, rsi
call fcn.14023e93c
movsxd rbx, eax
lea r14, [0x14032a640]
mov rcx, rsi
sar rbx, 6
call fcn.14023e93c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x14024b6ac
lea rdx, [0x14031bd80]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14024b6ba
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14024b6de
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14024b6de
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14024b6de
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x14024b704
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x14024b71c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14024b43e
call fcn.14022a39c
mov dword [rax], 0x16
call fcn.14022a230
jmp 0x14024b58e
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x14024b58e
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x14024b58e
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x14024b46d
lock or dword [rcx + 0x14], 0x10
jmp 0x14024b58e
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14024b481
call fcn.1402524f4
mov ebp, dword [rbx + 0x10]
cmp ebp, 1
jne 0x14024b491
mov rax, qword [rbx]
mov r14b, byte [rax]
jmp 0x14024b494
xor r14b, r14b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.14023e93c
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14024aea0
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14024b57c
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14024b527
mov rcx, rbx
call fcn.14023e93c
cmp eax, 0xffffffff
je 0x14024b512
mov rcx, rbx
call fcn.14023e93c
cmp eax, 0xfffffffe
je 0x14024b512
mov rcx, rbx
call fcn.14023e93c
movsxd rdi, eax
lea rsi, [0x14032a640]
mov rcx, rbx
sar rdi, 6
call fcn.14023e93c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14024b519
lea rdx, [0x14031bd80]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14024b527
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14024b54b
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14024b54b
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14024b54b
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp ebp, 1
jne 0x14024b569
movzx ecx, byte [rdx]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, r14b
or cx, ax
inc rdx
jmp 0x14024b574
movzx ecx, word [rdx]
add dword [rbx + 0x10], 0xfffffffe
add rdx, 2
mov qword [rbx], rdx
movzx eax, cx
jmp 0x14024b593
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x14024b408
Function at 0x14024cb68
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14024cbef
mov rsi, rbx
cmp word [rax], bp
je 0x14024cbae
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14024cb98
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14024cb94
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14024489c
mov rdi, rax
test rax, rax
je 0x14024cbdc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1402540d0
mov rbp, rdi
xor ecx, ecx
call fcn.140244860
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140253e20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140253e48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140253e48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180005ac0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
cmp dword [0x18000e258], 0
jne 0x180005b5b
mov dword [rsp], 0
jmp 0x180005aeb
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jae 0x180005b51
mov eax, dword [rsp]
mov dword [rsp + 4], eax
mov dword [rsp + 0xc], 8
jmp 0x180005b0f
mov eax, dword [rsp + 0xc]
dec eax
mov dword [rsp + 0xc], eax
cmp dword [rsp + 0xc], 0
jbe 0x180005b3e
mov eax, dword [rsp + 4]
and eax, 1
test eax, eax
je 0x180005b32
mov eax, dword [rsp + 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [rsp + 4], eax
jmp 0x180005b3c
mov eax, dword [rsp + 4]
shr eax, 1
mov dword [rsp + 4], eax
jmp 0x180005b05
mov eax, dword [rsp]
lea rcx, [0x18000de58]
mov edx, dword [rsp + 4]
mov dword [rcx + rax*4], edx
jmp 0x180005ae3
mov dword [0x18000e258], 1
mov dword [rsp + 8], 0xffffffff
mov dword [rsp], 0
jmp 0x180005b74
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x180005bac
mov eax, dword [rsp + 8]
shr eax, 8
mov ecx, dword [rsp]
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
xor ecx, dword [rsp + 8]
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x18000de58]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 8], eax
jmp 0x180005b6c
mov eax, dword [rsp + 8]
not eax
add rsp, 0x18
ret
Function at 0x180006fb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
cmp qword [rsp + 0x70], 0
jne 0x180006fd1
xor eax, eax
jmp 0x18000712c
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0
jmp 0x180007030
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x18000712a
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x20]
lea rax, [rax + rcx*4]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x28]
call fcn.18000a1a0
mov edx, eax
mov rcx, qword [rsp + 0x28]
call fcn.180005ac0
mov dword [rsp + 0x24], eax
cmp qword [rsp + 0x38], 0
je 0x180007125
cmp qword [rsp + 0x28], 0
je 0x180007125
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x24], eax
jne 0x180007125
cmp dword [rsp + 0x80], 0
je 0x1800070cd
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
call qword [0x18000dbe8]
jmp 0x18000712c
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov ecx, dword [rsp + 0x20]
lea rax, [rax + rcx*2]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
movzx ecx, word [rcx]
lea rax, [rax + rcx*4]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x70]
add rcx, rax
mov rax, rcx
jmp 0x18000712c
jmp 0x180007026
xor eax, eax
add rsp, 0x68
ret
Function at 0x18000a634
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0x811c9dc5
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
jmp 0x18000a662
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 8], rax
jae 0x18000a697
mov rax, qword [rsp + 8]
movsx eax, byte [rax]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
imul eax, dword [rsp], 0x1000193
mov dword [rsp], eax
jmp 0x18000a655
mov eax, dword [rsp]
add rsp, 0x18
ret

Function at 0x18000a744
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov dword [rsp + 0x20], 0
jmp 0x18000a770
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x58]
cmp dword [rsp + 0x20], eax
jge 0x18000a872
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x104]
inc eax
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x104], eax
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x104]
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 0x108]
add ecx, eax
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 0x108], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov r8d, dword [rcx + 0x108]
mov rcx, qword [rsp + 0x40]
mov edx, dword [rcx + 0x104]
mov rcx, rax
call fcn.18000a900
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x104]
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x40]
movsxd rcx, dword [rcx + 0x108]
mov rdx, qword [rsp + 0x40]
movzx ecx, byte [rdx + rcx]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
cdqe
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
movzx ecx, byte [rdx + rcx]
xor eax, ecx
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov byte [rdx + rcx], al
jmp 0x18000a766
add rsp, 0x38
ret
Function at 0x180002590
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002637
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002637
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x133bba9c
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002632
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002610
cmp r8d, 0xe5ebc59a
je 0x18000263c
test r9d, r9d
jne 0x1800025f0
mov rax, qword [rax]
jmp 0x1800025c0
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r10
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.180012f70
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002705
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002705
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x1e40491b
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x180002700
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x1800026e0
cmp edx, 0xd93d19eb
je 0x18000270a
test r9d, r9d
jne 0x1800026c0
mov rcx, qword [rcx]
jmp 0x180002690
mov ecx, dword [r11 + 0x24]
mov r8, rsi
add rcx, r10
mov rdx, rbp
movzx r9d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002750
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800027f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800027f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x7d0664f6
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800027f2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1800027d0
cmp r8d, 0x1db55cea
je 0x1800027fc
test r9d, r9d
jne 0x1800027b0
mov rax, qword [rax]
jmp 0x180002780
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002c00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002cd7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002cd7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x9bb0ef64
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002cd2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002cb0
cmp r8d, 0x4f8eaa22
je 0x180002cdc
test r9d, r9d
jne 0x180002c90
mov rax, qword [rax]
jmp 0x180002c60
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180035170]
addsd xmm8, qword [0x180035170]
movups xmm9, xmmword [0x1800350a0]
movups xmm10, xmmword [0x18003e918]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.180002590
cmp word [rax], 0
je 0x180002d56
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002d40
xor edx, edx
add ecx, 1
je 0x180002d5a
mov rdx, rax
jmp 0x180002d5a
xor edx, edx
mov ecx, edx
mov rax, qword [0x18003add8]
movaps xmm0, xmmword [0x1800353c0]
mov rbx, qword [0x18003ae58]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18003edc8]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002dff
xor r9d, r9d
lea r8, str.Canvas.K2_DrawText
xor edx, edx
xor ecx, ecx
call qword [0x18003af88]
mov qword [0x18003edc8], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x180002e50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002f27
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002f27
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1ca4ee84
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002f22
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002f00
cmp r8d, 0x55ab0242
je 0x180002f2c
test r9d, r9d
jne 0x180002ee0
mov rax, qword [rax]
jmp 0x180002eb0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180035170]
addsd xmm8, qword [0x180035170]
movups xmm9, xmmword [0x1800350a0]
movups xmm10, xmmword [0x18003e918]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.180002590
cmp word [rax], 0
je 0x180002fa6
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002f90
xor edx, edx
add ecx, 1
je 0x180002faa
mov rdx, rax
jmp 0x180002faa
xor edx, edx
mov ecx, edx
mov rax, qword [0x18003add8]
movaps xmm0, xmmword [0x1800353c0]
mov rbx, qword [0x18003ae58]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18003edc8]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x18000304f
xor r9d, r9d
lea r8, str.Canvas.K2_DrawText
xor edx, edx
xor ecx, ecx
call qword [0x18003af88]
mov qword [0x18003edc8], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret