joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003ef40
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov rax, qword [0x180059640]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x74], 0
lea rcx, [rsp + 0x38]
call fcn.180002710
nop
mov qword [rsp + 0x68], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xc8]
xor r8d, r8d
mov rdx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
jne 0x18003f027
mov dword [rsp + 0x70], 0
movsxd rdx, dword [rsp + 0xc0]
lea rcx, [rsp + 0x38]
call fcn.1800011a0
lea rcx, [rsp + 0x38]
call fcn.180001180
mov r11, rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x38]
call fcn.180001180
mov rdx, rax
mov rcx, qword [rsp + 0xa0]
call fcn.1800032a0
mov eax, dword [rsp + 0x74]
or eax, 1
mov dword [rsp + 0x74], eax
lea rcx, [rsp + 0x38]
call fcn.1800027e0
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180026540
add rsp, 0x98
ret

Function at 0x18003f080
Capabilities:
Create process on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov rax, qword [0x180059640]
xor rax, rsp
mov qword [rsp + 0x110], rax
lea rcx, [rsp + 0x38]
call fcn.180002710
nop
cmp qword [rsp + 0x130], 0
je 0x18003f1a1
mov rdx, qword [rsp + 0x130]
lea rcx, [rsp + 0x60]
call fcn.1800032a0
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0xe8], rax
lea r8, [0x18004c538]
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x88]
call fcn.180002070
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf8], rax
mov r8, qword [rsp + 0x138]
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0xb0]
call fcn.180002070
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x108], rax
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0x38]
call fcn.180001000
nop
lea rcx, [rsp + 0xb0]
call fcn.1800027e0
nop
lea rcx, [rsp + 0x88]
call fcn.1800027e0
nop
lea rcx, [rsp + 0x60]
call fcn.1800027e0
jmp 0x18003f1b3
mov rdx, qword [rsp + 0x138]
lea rcx, [rsp + 0x38]
call fcn.1800026c0
lea rcx, [rsp + 0x38]
call fcn.1800026f0
mov r8, rax
mov eax, dword [rsp + 0x148]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x140]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rsp + 0x38]
call fcn.1800027e0
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.180026540
add rsp, 0x128
ret
Function at 0x180002240
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xor esi, esi
mov r8, rcx
test rcx, rcx
je 0x1800022ec
cmp qword [rcx], rsi
je 0x1800022d5
cmp word [rdx + 0x58], si
je 0x1800022ec
movzx r11d, word [rdx + 0x58]
lea r9d, [rsi + 1]
shr r11, 1
movabs r10, 0xcbf29ce484222325
mov rdi, qword [rdx + 0x60]
mov ebx, esi
je 0x1800022bf
movzx eax, word [rdi + rbx*2]
movzx ecx, word [rdi + rbx*2]
sub ax, 0x41
add cx, 0x20
cmp ax, 0x19
cmova cx, word [rdi + rbx*2]
add rbx, r9
movzx eax, cx
movabs rcx, 0x100000001b3
imul r10, rcx
xor r10, rax
cmp rbx, r11
jb 0x18000228a
cmp r10, qword [r8]
jne 0x1800022ec
mov rax, qword [rdx + 0x30]
mov qword [r8 + 8], rax
mov eax, dword [rdx + 0x40]
mov qword [r8 + 0x10], rax
jmp 0x1800022ef
mov rax, qword [rdx + 0x30]
mov r9d, 1
mov qword [rcx + 8], rax
mov eax, dword [rdx + 0x40]
mov qword [rcx + 0x10], rax
jmp 0x1800022ef
mov r9b, sil
mov rbx, qword [rsp + 8]
mov al, r9b
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180002304
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
movzx esi, r8w
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x180002394
xor r10d, r10d
lea r11d, [r10 + 1]
cmp byte [r9], r10b
je 0x18000233c
add r10, r11
cmp byte [r10 + r9], 0
jne 0x180002332
xor edi, edi
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x180002385
mov al, byte [rdi + r9]
mov dl, byte [rdi + r9]
add al, 0x20
movzx ecx, al
sub dl, 0x41
movzx eax, byte [rdi + r9]
cmp dl, 0x19
cmova ecx, eax
add rdi, r11
movsx rax, cl
movabs rcx, 0x100000001b3
imul r8, rcx
xor r8, rax
cmp rdi, r10
jb 0x18000234d
cmp r8, qword [rbx]
jne 0x180002394
mov qword [rbx + 0x10], rbp
mov word [rbx + 8], si
jmp 0x180002397
xor r11b, r11b
mov rbx, qword [rsp + 8]
mov al, r11b
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x180012cdc
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
jmp 0x180012f8c
test rcx, rcx
je 0x180013112
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [rcx - 0x10]
cmp dword [r11], 0x4d474943
je 0x180013056
int3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r10d, dword [rax + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1800130cc
xor ecx, ecx
cmp dword [r10 + 0x18], ecx
jbe 0x1800130cc
mov esi, dword [r10 + 0x20]
lea rax, [rsi + rcx*4]
mov edi, ecx
mov r9d, dword [rax + r8]
mov ebx, 0x811c9dc5
add r9, r8
mov al, byte [r9]
inc r9
test al, al
je 0x1800130c4
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r9]
inc r9
test al, al
jne 0x1800130a7
cmp ebx, 0x7c76ecf5
je 0x1800130d1
inc ecx
cmp ecx, dword [r10 + 0x18]
jb 0x18001308b
mov rdx, qword [rdx]
jmp 0x180013067
mov rax, qword gs:[0x30]
mov edx, dword [r10 + 0x24]
add rdx, r8
mov rcx, qword [rax + 0x60]
movzx r9d, word [rdx + rdi*2]
mov edx, dword [r10 + 0x1c]
mov rcx, qword [rcx + 0x30]
add rdx, r8
mov eax, dword [rdx + r9*4]
xor edx, edx
add rax, r8
mov r8, r11
call rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180012da8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x20
call fcn.180013114
mov r11, rax
test rax, rax
je 0x180012e7c
mov qword [rax + 0x10], rbx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180012e50
xor ecx, ecx
cmp dword [r9 + 0x18], ecx
jbe 0x180012e50
mov r14d, dword [r9 + 0x20]
lea rax, [r14 + rcx*4]
mov esi, ecx
mov r10d, dword [rax + r8]
mov edi, 0x811c9dc5
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x180012e48
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x180012e2b
cmp edi, 0xaa8c48ae
je 0x180012e55
inc ecx
cmp ecx, dword [r9 + 0x18]
jb 0x180012e0f
mov rdx, qword [rdx]
jmp 0x180012deb
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rsi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rdx, r11
add rax, r8
lea rcx, [0x1800156a0]
call rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180012e94
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call fcn.180012ce4
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180012f1d
xor ecx, ecx
cmp dword [r9 + 0x18], ecx
jbe 0x180012f1d
mov ebx, dword [r9 + 0x20]
lea rax, [rbx + rcx*4]
mov edi, ecx
mov r10d, dword [rax + r8]
mov r11d, 0x811c9dc5
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x180012f15
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x180012ef5
cmp r11d, 0x38ef582a
je 0x180012f22
inc ecx
cmp ecx, dword [r9 + 0x18]
jb 0x180012ed8
mov rdx, qword [rdx]
jmp 0x180012eb4
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rcx, [0x1800156a0]
add rax, r8
call rax
lea rbx, [section..rdata]
lea rdi, [0x180014018]
jmp 0x180012f61
mov rax, qword [rbx]
test rax, rax
je 0x180012f5d
call rax
add rbx, 8
cmp rbx, rdi
jb 0x180012f53
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x180012f8c
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
jmp 0x180012f8c
test rcx, rcx
je 0x180013112
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [rcx - 0x10]
cmp dword [r11], 0x4d474943
je 0x180013056
int3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r10d, dword [rax + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1800130cc
xor ecx, ecx
cmp dword [r10 + 0x18], ecx
jbe 0x1800130cc
mov esi, dword [r10 + 0x20]
lea rax, [rsi + rcx*4]
mov edi, ecx
mov r9d, dword [rax + r8]
mov ebx, 0x811c9dc5
add r9, r8
mov al, byte [r9]
inc r9
test al, al
je 0x1800130c4
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r9]
inc r9
test al, al
jne 0x1800130a7
cmp ebx, 0x7c76ecf5
je 0x1800130d1
inc ecx
cmp ecx, dword [r10 + 0x18]
jb 0x18001308b
mov rdx, qword [rdx]
jmp 0x180013067
mov rax, qword gs:[0x30]
mov edx, dword [r10 + 0x24]
add rdx, r8
mov rcx, qword [rax + 0x60]
movzx r9d, word [rdx + rdi*2]
mov edx, dword [r10 + 0x1c]
mov rcx, qword [rcx + 0x30]
add rdx, r8
mov eax, dword [rdx + r9*4]
xor edx, edx
add rax, r8
mov r8, r11
call rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180013114
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbx, rcx
mov rdx, qword [rax + 0x18]
mov r9, qword [rdx + 0x10]
mov r8, qword [r9 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r10d, dword [rax + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1800131a1
xor edx, edx
cmp dword [r10 + 0x18], edx
jbe 0x1800131a1
mov edi, dword [r10 + 0x20]
lea rax, [rdi + rdx*4]
mov r11d, 0x811c9dc5
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180013199
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x18001317a
cmp r11d, 0xb3f819f8
je 0x1800131a6
inc edx
cmp edx, dword [r10 + 0x18]
jb 0x180013160
mov r9, qword [r9]
jmp 0x18001313c
mov rax, qword gs:[0x30]
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov r9d, dword [rcx + rdx*4]
mov edx, 8
mov rcx, qword [rax + 0x60]
add r9, r8
lea r8, [rbx + 0x10]
mov rcx, qword [rcx + 0x30]
call r9
test rax, rax
je 0x1800131ef
mov dword [rax], 0x4d474943
mov qword [rax + 8], rbx
add rax, 0x10
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000942c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
sub rsp, 0x30
lea rax, [r11 + 0x10]
mov qword [r11 - 0x18], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx + 0x10]
mov r8, qword [r9 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r10d, dword [rax + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1800094c1
xor r11d, r11d
cmp dword [r10 + 0x18], r11d
jbe 0x1800094c1
mov ecx, dword [r10 + 0x20]
add rcx, r8
mov edx, dword [rcx]
mov ebx, 0x811c9dc5
add rdx, r8
mov al, byte [rdx]
inc rdx
test al, al
je 0x1800094b4
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [rdx]
inc rdx
test al, al
jne 0x180009498
cmp ebx, 0xaf07e45d
je 0x1800094c6
inc r11d
add rcx, 4
cmp r11d, dword [r10 + 0x18]
jb 0x180009485
mov r9, qword [r9]
jmp 0x18000945d
mov eax, dword [r10 + 0x24]
mov ecx, dword [r10 + 0x1c]
add rax, r8
mov r9, qword [rsp + 0x20]
add rcx, r8
movzx edx, word [rax + r11*2]
mov r10d, dword [rcx + rdx*4]
mov edx, 0x200
add r10, r8
lea rcx, [0x1802a0210]
mov r8, qword [rsp + 0x40]
call r10
lea rax, [0x1802a0210]
add rsp, 0x30
pop rbx
ret

Function at 0x180009f44
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x180009f51
xor eax, eax
jmp 0x180009fb9
mov rax, qword [rcx]
test rax, rax
je 0x180009fb9
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x180009f66
xor eax, eax
jmp 0x180009fb9
mov r10, r9
mov qword [rsp + 8], r9
or edx, 0xffffffff
xor r8d, r8d
mov dword [rsp], r8d
mov ecx, edx
or rax, 0xffffffffffffffff
inc rax
cmp byte [r9 + rax], 0
jne 0x180009f7e
cmp r8d, eax
jae 0x180009fb1
movsx eax, byte [r10]
xor rax, rcx
movzx ecx, al
lea rax, [0x180219380]
shr edx, 8
xor edx, dword [rax + rcx*4]
inc r10
mov qword [rsp + 8], r10
inc r8d
jmp 0x180009f74
not edx
mov eax, edx
jmp 0x180009fb9
add rsp, 0x18
ret
Function at 0x1800177bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180017833
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x180017833
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x180017820
cmp rbx, rcx
jae 0x180017833
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x18001780b
cmp rbx, rcx
jae 0x180017833
movzx eax, word [rbx]
neg ax
sbb rax, rax
and rax, rbx
jmp 0x180017835
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180017d24
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x70
movaps xmmword [rax - 0x18], xmm6
lea rcx, [rax + 8]
movaps xmmword [rax - 0x28], xmm7
movss xmm7, dword [0x18029c1b4]
addss xmm7, dword [0x180280398]
movaps xmmword [rax - 0x38], xmm8
movss xmm8, dword [0x18029c1c4]
addss xmm8, dword [0x180280398]
call qword [sym.imp.USER32.dll_GetCursorPos]
xor ebx, ebx
test eax, eax
je 0x180017e13
movd xmm1, dword [rsp + 0x80]
movaps xmm0, xmm7
movss xmm6, dword [0x1802803ec]
cvtdq2ps xmm1, xmm1
subss xmm0, xmm6
comiss xmm1, xmm0
jb 0x180017e1b
movaps xmm0, xmm7
addss xmm0, xmm6
comiss xmm1, xmm0
ja 0x180017e1b
movd xmm1, dword [rsp + 0x84]
movaps xmm0, xmm8
cvtdq2ps xmm1, xmm1
subss xmm0, xmm6
comiss xmm1, xmm0
jb 0x180017e1b
movaps xmm0, xmm8
addss xmm0, xmm6
comiss xmm1, xmm0
ja 0x180017e1b
lea ecx, [rbx + 1]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180017e13
cmp byte [0x18029f866], bl
je 0x180017e13
movd xmm0, dword [rsp + 0x80]
movd xmm1, dword [rsp + 0x84]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
subss xmm0, dword [0x180280398]
subss xmm1, dword [0x180280398]
movss dword [0x18029c1b4], xmm0
movss dword [0x18029c1c4], xmm1
movss xmm6, dword [0x1802803ec]
movaps xmm0, xmmword [0x180280af0]
lea rcx, [rsp + 0x30]
movq qword [rsp + 0x30], xmm0
psrldq xmm0, 8
movq qword [rsp + 0x38], xmm0
movss dword [rsp + 0x88], xmm7
movss dword [rsp + 0x8c], xmm8
call fcn.180042804
mov rcx, qword [0x1802a07a8]
lea rdx, [rsp + 0x88]
mov r9d, eax
mov dword [rsp + 0x20], ebx
movaps xmm2, xmm6
call fcn.180059a5c
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x70
pop rbx
ret
Function at 0x180036d60
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180036e26
and dword [rsp + 0x48], 0
lea r9d, [rdx + 3]
lea r8d, [rdx + 0x3f]
mov rdx, rcx
lea rax, [rsp + 0x48]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180036dac
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
test rbx, rbx
je 0x180036de8
lea rax, [rsp + 0x48]
mov r9d, 4
mov r8d, 0x108
mov qword [rsp + 0x20], rax
mov rdx, rbx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x180036de8
xor edx, edx
mov r8d, 0x108
mov rcx, rbx
call fcn.1800e2cc0
and qword [rsp + 0x28], 0
lea r8, [0x180036704]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
and qword [rsp + 0x28], 0
lea r8, [0x180026bf8]
and dword [rsp + 0x20], 0
mov r9, rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
add rsp, 0x30
pop rbx
ret

Function at 0x1800371ac
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1800371da
xor eax, eax
jmp 0x1800372c0
cmp qword [rcx + 0x68], 0
je 0x1800371eb
call fcn.1800382e0
jmp 0x1800372c0
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180037202
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180037204
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180037236
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1800e2610
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x1800372ba
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x18003726d
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x180037296
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1800efe1c
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x1800372ba
cmp rsi, rbx
ja 0x180037274
test rsi, rsi
je 0x1800372ba
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1800efe1c
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18003cc58
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
xor edx, edx
mov rcx, rsi
lea r8d, [rdx + 2]
call fcn.1800e9994
test eax, eax
jne 0x18003ccf9
mov rcx, rsi
call fcn.1800e8474
movsxd rbx, eax
test eax, eax
js 0x18003ccf9
jne 0x18003cc91
xor eax, eax
jmp 0x18003ccfe
lea eax, [rbx + 1]
movsxd rcx, eax
lea rdx, [0x180133ba0]
call fcn.1800df7e0
mov rdi, rax
test rax, rax
jne 0x18003ccb0
lea eax, [rdi - 2]
jmp 0x18003ccfe
xor r8d, r8d
mov byte [rbx + rax], 0
xor edx, edx
mov rcx, rsi
call fcn.1800e9994
mov r9, rsi
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.1800efe1c
cmp rax, rbx
je 0x18003cce0
mov ebx, 0xfffffffd
jmp 0x18003cced
mov r8, rax
mov rdx, rdi
call fcn.18003eadc
mov ebx, eax
mov rcx, rdi
call fcn.1800df7a4
mov eax, ebx
jmp 0x18003ccfe
mov eax, 0xfffffffd
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180042018
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180042072
mov r11b, 0x23
lea rdi, [0x180276420]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x18004205c
cmp rdx, 2
jb 0x18004205c
cmp byte [r10], r11b
jne 0x18004205c
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x18004203a
jmp 0x1800420b3
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x1800420b3
mov r11b, 0x23
lea rdi, [0x180276420]
cmp dl, r11b
jne 0x180042097
cmp byte [r10], r11b
jne 0x180042097
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x180042085
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x1800421e4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x180042204
and qword [r8], 0
lea rdx, [0x18027e010]
call fcn.1800420c4
mov rbx, rax
test rax, rax
je 0x1800422eb
mov rcx, rax
call fcn.1800e8474
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800422e3
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1800e9994
test eax, eax
jne 0x1800422e3
mov rcx, rbx
call fcn.1800e8474
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800422e3
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.1800e9994
test eax, eax
jne 0x1800422e3
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x1800422e3
mov rax, qword [0x18029faf0]
test rax, rax
je 0x180042285
inc dword [rax + 0xf4]
mov rcx, rbp
call fcn.1800f00dc
mov rdi, rax
test rax, rax
je 0x1800422e3
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.1800efe1c
mov rcx, rbx
cmp rax, rbp
je 0x1800422d1
call fcn.1800e9394
mov rax, qword [0x18029faf0]
test rax, rax
je 0x1800422c7
dec dword [rax + 0xf4]
mov rcx, rdi
call fcn.1800ef914
jmp 0x1800422eb
call fcn.1800e9394
test rsi, rsi
je 0x1800422de
mov qword [rsi], rbp
mov rax, rdi
jmp 0x1800422ed
mov rcx, rbx
call fcn.1800e9394
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180043ff8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov r9d, 8
mov rax, qword [rcx + 0xd8]
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x38]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x180276420]
xor ebx, dword [rax + rcx*4]
sub r9, 1
jne 0x180044022
mov rcx, qword [0x18029faf0]
not ebx
cmp dword [rcx + 0x3ed4], ebx
jne 0x180044061
mov r8, rdx
mov ecx, ebx
lea edx, [r9 + 0xc]
call fcn.180054984
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18004406c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov r10d, 4
mov rax, qword [rcx + 0xd8]
mov r9d, r10d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x38]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x180276420]
xor ebx, dword [rax + rcx*4]
sub r9, 1
jne 0x180044098
mov rcx, qword [0x18029faf0]
not ebx
cmp dword [rcx + 0x3ed4], ebx
jne 0x1800440d6
movsxd r8, edx
mov ecx, ebx
mov edx, r10d
call fcn.180054984
mov eax, ebx
add rsp, 0x20
pop rbx
ret