joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012ce0
Capabilities:
Print debug messages
Read file via mapping

Disassembly:
jmp 0x140012ce0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0xb70]
sub rsp, 0xc70
mov rax, qword [0x14001f088]
xor rax, rsp
mov qword [rbp + 0xb60], rax
mov rbx, qword [rbp + 0xb80]
lea rax, [0x14001cba8]
mov edi, dword [rbp + 0xb88]
xor edx, edx
mov r8d, 0x11a10
mov qword [rsp + 0x30], rbx
lea rcx, [rbx + 0x30]
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0xffffffffffffffff
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0xffffffffffffffff
mov qword [rbx + 0x28], 0xffffffffffffffff
mov qword [rbx], rax
call sub.VCRUNTIME140.dll_memset
mov r8d, edi
lea rdx, str.DumpToolException__d.bin
lea rcx, [rbp + 0x150]
call fcn.140012af0
xor edx, edx
lea r8, [rbp + 0x150]
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov rcx, rax
mov qword [rbx + 0x10], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140012dc8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rbp + 0x150]
lea rdx, str.Failed_Failed_to_create_file_mapping_of__s__d_n
lea rcx, [rbp + 0x360]
call fcn.140012b80
jmp 0x140012e04
xor r9d, r9d
mov qword [rsp + 0x20], 0x20000
xor r8d, r8d
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140012e0c
lea r8, [rbp + 0x150]
lea rdx, str.Failed_Failed_to_map_view_of_file__s_n
lea rcx, [rbp + 0x360]
call fcn.140012b80
mov rcx, rbx
call fcn.14000e2d5
cmp qword [rbx + 0x18], 0
jne 0x140012e2c
lea rcx, [rbp + 0x360]
call fcn.14000e023
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r9d, edi
lea r8, str.TakeDump
lea rdx, str.GlobalDumpToolException__s__d_event
lea rcx, [rsp + 0x40]
call fcn.140012af0
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x100000
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x20], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140012ea2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x40]
lea rdx, str.Failed_to_open_event:__s_0x_x_n
lea rcx, [rbp + 0x360]
call fcn.140012b80
lea rcx, [rbp + 0x360]
call fcn.14000e023
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov r9d, edi
lea r8, str.DumpTaken
lea rdx, str.GlobalDumpToolException__s__d_event
lea rcx, [rsp + 0x40]
call fcn.140012af0
lea r8, [rsp + 0x40]
xor edx, edx
mov ecx, 0x100002
call qword [sym.imp.KERNEL32.dll_OpenEventW]
mov qword [rbx + 0x28], rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x140012f1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, [rsp + 0x40]
lea rdx, str.Failed_to_open_event:__s_0x_x_n
lea rcx, [rbp + 0x360]
call fcn.140012b80
lea rcx, [rbp + 0x360]
call fcn.14000e023
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rax, rbx
mov rcx, qword [rbp + 0xb60]
xor rcx, rsp
call fcn.14000e1b3
lea r11, [rsp + 0xc70]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400139a0
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400139a0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x2088
call fcn.14000e0a0
sub rsp, rax
mov rax, qword [0x14001f088]
xor rax, rsp
mov qword [rsp + 0x2070], rax
mov rbp, qword [rsp + 0x20c0]
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x2000
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xorps xmm0, xmm0
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
xor ecx, ecx
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movzx ebx, word [rsp + 0x50]
mov eax, 0x51eb851f
movzx ecx, word [rsp + 0x5e]
mov esi, 0x1000
movzx r8d, word [rsp + 0x5c]
movzx r10d, word [rsp + 0x5a]
movzx r11d, word [rsp + 0x58]
movzx r9d, word [rsp + 0x52]
mov dword [rsp + 0x48], ecx
lea rcx, [rsp + 0x70]
mul ebx
mov dword [rsp + 0x40], r8d
lea r8, str._02d._02d._02d__02d:_02d:_02d._03d_:_DumpTool_:
mov dword [rsp + 0x38], r10d
shr edx, 5
imul eax, edx, 0x64
mov edx, esi
mov dword [rsp + 0x30], r11d
sub ebx, eax
movzx eax, word [rsp + 0x56]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call fcn.140013780
lea rdi, [rsp + 0x70]
mov r14, rax
lea r15, [rsp + 0x20d0]
sub rsi, rax
lea rdi, [rdi + rax*2]
call fcn.14000e019
mov rcx, qword [rsp + 0x20c8]
lea r9, [rsi - 1]
mov qword [rsp + 0x30], r15
mov r8, rsi
xor r15d, r15d
mov rdx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsnwprintf_s]
mov rdx, qword [rbp + 0x10200]
mov ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
movsxd rbx, eax
lea rcx, [rdx*2 + 0x208]
add rbx, r14
mov eax, 0x7ffb
sub rax, rdx
lea rdx, [rsp + 0x70]
cmp rax, rbx
cmovb rbx, rax
add rcx, rbp
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
add qword [rbp + 0x10200], rbx
mov rax, qword [rbp + 0x10200]
mov word [rbp + rax*2 + 0x208], r15w
cmp word [rbp], r15w
je 0x140013b5f
lea rdx, [0x14001cd18]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov rbx, rax
test rax, rax
je 0x140013b5f
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14000e2c6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x2070]
xor rcx, rsp
call fcn.14000e1b3
add rsp, 0x2088
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180001000
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
lea r8d, [rdx + 0x809]
mov r9d, ecx
mov edx, ecx
lea eax, [rcx + 0x718]
xor edx, 0x238c
lea ebx, [rcx + 0x4da]
add edx, 0x269c
cmp eax, edx
jle 0x180001196
mov r10, qword [rsp + 0x50]
xor r11d, r11d
mov rax, qword [0x1802690b8]
mov r8d, dword [r11 + rax]
add r11, 4
mov rax, qword [section..data]
imul r8d, dword [0x180269064]
movsxd rcx, dword [rax + 0x74]
mov rax, qword [0x1802690c0]
mov edx, r8d
shr edx, 8
mov byte [rcx + rax], dl
mov rax, qword [section..data]
inc dword [rax + 0x74]
mov eax, dword [0x18026905c]
mov rcx, qword [section..data]
add eax, 0xd2a0b035
xor dword [rcx + 0x94], eax
mov eax, dword [r10 + 0xd0]
mov rcx, qword [section..data]
add eax, 0x43ba1
or dword [0x180269034], eax
mov eax, 0xe91d5
sub eax, dword [r10 + 0xb8]
add dword [rcx + 0x38], eax
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x74]
mov rax, qword [0x1802690c0]
mov byte [rcx + rax], r8b
mov rax, qword [section..data]
inc dword [rax + 0x74]
mov rcx, qword [section..data]
mov eax, dword [r10 + 0x6c]
sub eax, 0xa1c7e
xor dword [rcx + 8], eax
mov ecx, dword [0x1802690e0]
mov eax, dword [0x1802690c8]
add eax, 0xfff16e2c
imul ecx, eax
mov eax, dword [0x1802690a8]
add eax, 0xffe8bc8d
mov dword [0x1802690e0], ecx
mov rcx, qword [section..data]
or dword [rcx + 0x6c], eax
mov rdx, qword [section..data]
mov ecx, dword [r10 + 0xd8]
add ecx, dword [r10 + 0xec]
xor ecx, 0x1c7b14
mov eax, dword [rdx + 0x4c]
imul eax, ecx
mov dword [rdx + 0x4c], eax
mov eax, dword [r10 + 0x9c]
sub eax, dword [0x180269074]
mov rcx, qword [section..data]
sub eax, 0x1fefa1
xor dword [rcx + 0x6c], eax
mov ecx, dword [r10 + 0x9c]
mov eax, dword [r10 + 0xd8]
sub eax, 0x3b2b7
imul ecx, eax
mov dword [r10 + 0x9c], ecx
cmp r11, 0x8d6a8
jl 0x18000103a
mov eax, dword [r10 + 0x4c]
mov ebx, r9d
add eax, 0x992201be
add ecx, eax
mov dword [r10 + 0x54], ecx
jmp 0x1800011cb
mov rax, qword [rsp + 0x50]
mov ecx, dword [rax + 0xa0]
add ecx, dword [0x1802690fc]
cmp r8d, ecx
jne 0x1800011cb
mov rcx, qword [section..data]
mov edx, r8d
mov ecx, dword [rcx + 0x10c]
add ecx, 0x2967
and rcx, rdx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ebx, 0x1308
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1800012a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov ebx, dword [rsp + 0x70]
lea r13d, [rdx - 0x3084]
mov edi, r8d
lea eax, [r13 + 0x2866]
add ebx, 0xffffd09a
xor edi, 0x1bd0
mov r15, rcx
mov esi, r9d
lea ecx, [rdx - 0xcf8]
cmp ebx, eax
jge 0x180001387
mov edx, r9d
lea eax, [r9 + 0x9aa]
xor edx, 0x238c
cmp edx, eax
jg 0x18000132b
add ebx, 0x2245
cmp dword [0x18026902c], 0x17b7a
jb 0x180001387
mov eax, dword [0x180269018]
add eax, 0xccc1ad89
xor dword [0x180269064], eax
jmp 0x180001387
mov eax, dword [0x1802690e4]
mov ebp, dword [r15 + 0xc]
add eax, 0x269c
and eax, ebx
cmp ebp, eax
jae 0x180001387
mov r14d, edi
xor r14d, ecx
or edi, ecx
mov edx, dword [r15 + 0x24]
mov r9d, r14d
mov rax, qword [section..data]
mov r8d, edi
mov ecx, dword [r15 + 0xc]
imul edx, esi
xor ecx, r13d
sub r9d, dword [rax + 0x6c]
mov dword [rsp + 0x20], edx
mov rdx, r15
call fcn.18000a280
mov ecx, dword [0x1802690e4]
inc ebp
add ecx, 0x269c
and ecx, ebx
cmp ebp, ecx
jb 0x180001348
mov rbp, qword [rsp + 0x58]
xor ebx, 0x8e1
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x1800020fc
Capabilities:
Connect pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov ebx, dword [rsp + 0x70]
lea r14d, [rcx + 0x9e0]
mov edi, r8d
lea r15d, [rdx + 0x3ef]
xor edi, 0x5b8
mov r10d, r8d
mov eax, edi
mov esi, r8d
lea ebp, [rbx - 0x238c]
xor eax, 0x952
xor ebx, 0xcea
xor esi, 0x2f66
xor r10d, 0x541
mov r13, r9
cmp r14d, eax
jl 0x1800021e8
lea eax, [rbx - 0x7e8]
cmp r10d, eax
jl 0x18000217f
mov eax, dword [0x180269028]
add dword [0x1802690d8], eax
jmp 0x1800021e8
mov rdx, qword [section..data]
mov r8d, esi
mov r9d, edi
and r8d, edi
or r10d, r15d
or r9d, 0x277e
xor r8d, 0x3084
mov dword [rsp + 0x20], r10d
mov ecx, dword [rdx + 0x10c]
sub ecx, 0x2866
call fcn.180008d34
mov rcx, qword [section..data]
mov r15d, eax
mov r8d, dword [0x180269080]
mov edx, dword [rcx + 0xd0]
mov ecx, dword [r13 + 0x3c]
or rdx, rcx
mov ecx, dword [r13 + 0x24]
imul ecx, dword [0x18026911c]
and rcx, r8
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov r8d, edi
lea edx, [rbp + 0x2ade]
xor r8d, 0x3b9
lea eax, [r15 - 0x9e0]
mov dword [rsp + 0x28], r8d
lea r9d, [r14 + 0x26e]
xor ebp, 0x238c
mov dword [rsp + 0x20], eax
lea r8, [0x180269010]
mov ecx, ebp
call fcn.1800029a8
mov rdx, qword [section..data]
lea eax, [rbx - 0xc1]
mov r9d, edi
mov dword [rsp + 0x20], eax
mov r8d, esi
lea ecx, [rbx - 0xd21]
xor r9d, 0x1b29
xor r8d, 0x31f7
call fcn.180003918
lea eax, [rdi + 0x719]
mov dword [rsp + 0x28], eax
lea r9d, [rsi + 0x2ade]
lea r8d, [rsi + 0x2c59]
mov qword [rsp + 0x20], r13
lea edx, [r14 - 0x4af]
lea ecx, [rsi + 0x277e]
call fcn.1800011dc
mov rbx, qword [rsp + 0x50]
lea eax, [r15 - 0x1bd]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x18000326c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rsp + 0x78]
mov esi, ecx
mov ebx, dword [rsp + 0x70]
mov ecx, 0xbaa
mov r11d, r8d
xor eax, ecx
xor r11d, ecx
mov rdi, rdx
cmp r11d, eax
jle 0x18000342f
mov r8d, r9d
lea eax, [r9 - 0x3c7]
xor r8d, 0x2ea5
cmp r8d, eax
jge 0x180003429
mov rax, qword [section..data]
lea rcx, [0x1802fabc0]
xor r10d, r10d
mov qword [rax + 0xa8], rcx
mov eax, dword [0x18026902c]
add eax, 0xfffa7f14
or dword [rdi + 0xb8], eax
mov eax, dword [rdi + 0x9c]
xor eax, dword [0x1802690c8]
mov rcx, qword [section..data]
xor eax, 0x1feff8
mov dword [0x1802690c8], eax
mov eax, dword [rdi + 0x14]
sub eax, 0x17151c
add dword [rcx + 0xd8], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0xd0]
mov eax, 0xffff39e5
sub ecx, dword [rdi + 0xd8]
sub eax, dword [0x1802690a4]
xor ecx, 0xfff811a7
add dword [0x1802690c8], ecx
add dword [rdi + 0x10c], eax
movsxd rdx, dword [rdi + 0x74]
mov rax, qword [0x1802690b8]
mov r9d, dword [r10 + rax]
add r10, 4
imul r9d, dword [rdi + 0x54]
mov rax, qword [section..data]
mov rcx, qword [rax + 0xb0]
mov r8d, r9d
shr r8d, 0x10
mov byte [rdx + rcx], r8b
inc dword [rdi + 0x74]
mov ecx, dword [rdi + 0xb8]
mov rdx, qword [section..data]
xor ecx, 0xe91d4
mov eax, dword [rdx + 0x24]
imul eax, ecx
mov dword [rdx + 0x24], eax
mov edx, r9d
movsxd rcx, dword [0x180269084]
mov rax, qword [0x1802690c0]
shr edx, 8
mov byte [rcx + rax], dl
mov eax, dword [0x180269084]
inc eax
mov dword [0x180269084], eax
movsxd rcx, eax
mov rax, qword [0x1802690c0]
mov byte [rcx + rax], r9b
inc dword [0x180269084]
mov eax, dword [0x180269048]
dec eax
xor dword [0x1802690e0], eax
cmp r10, 0x113940
jl 0x1800032d0
lea r10d, [rbx + 0x4c1]
xor r10d, 0x1890
lea eax, [rbx - 0x4d0]
mov dword [rsp + 0x30], r10d
lea r8d, [rsi - 0x488]
mov dword [rsp + 0x28], eax
lea r9d, [rbx + 0x16f]
mov dword [rsp + 0x20], r8d
lea edx, [r11 - 0x5b8]
mov r8, rdi
lea ecx, [r11 - 0x4d0]
call fcn.18000ac08
jmp 0x18000342f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rsi, qword [rsp + 0x58]
lea eax, [rbx - 0x258]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180003918
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov r11d, dword [rsp + 0x60]
lea r10d, [r8 - 0x3e1]
mov eax, r10d
lea ecx, [r9 - 0x31f7]
mov ebx, r8d
xor eax, 0x4c8
xor ebx, 0x1bd0
xor r11d, 0x401
cmp ecx, eax
jge 0x1800039ca
mov eax, dword [rdx + 0x94]
sub eax, dword [0x1802690a8]
add eax, 0x43028a
xor dword [rdx + 0x40], eax
mov eax, dword [0x18026905c]
cmp dword [0x180269034], eax
jae 0x180003986
mov eax, dword [rdx + 0x14]
mov rcx, qword [section..data]
add eax, 0x1e368
xor dword [rcx + 0x6c], eax
jmp 0x180003a2f
mov rax, qword [section..data]
xor ecx, ecx
mov r8d, dword [0x180269100]
xor r8d, dword [0x1802690e0]
mov edx, dword [0x180269050]
add r8d, 0x46ba1
mov r9d, dword [rax + 0xf0]
add r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x4800
mov qword [0x1802690d0], rax
jmp 0x180003a2f
mov r8, qword [section..data]
mov eax, dword [r8 + 0xf0]
and eax, ecx
or eax, dword [rdx + 4]
cmp dword [r8 + 0xa0], eax
ja 0x180003a2f
imul eax, ecx, 0x31f7
and eax, dword [r8 + 0x1c]
cmp r10d, eax
ja 0x180003a2f
mov r9d, dword [r8 + 0x14]
lea rdx, [0x180269010]
or r9d, dword [0x180269010]
mov eax, ebx
mov r8d, dword [0x180269024]
sub eax, r10d
or eax, dword [0x18026906c]
or r9d, r10d
xor r8d, 0x2ea5
mov dword [rsp + 0x20], eax
and ecx, r11d
call fcn.18000a038
lea eax, [rbx + 0x7d]
add rsp, 0x30
pop rbx
ret
Function at 0x180008d34
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, r8d
lea ecx, [r8 - 0x2d36]
xor ebx, 0x2d36
lea eax, [r9 + 0xbd1]
cmp ecx, eax
jge 0x180008d80
mov rcx, qword [section..data]
xor ebx, 0x269c
mov eax, dword [rcx + 0xf8]
xor eax, 0x3b2b9
mov dword [0x1802690e8], eax
mov eax, dword [rcx + 0x6c]
add eax, 0x116e63
add dword [rdx + 0x4c], eax
jmp 0x180008db9
mov edx, dword [rdx + 0xd8]
mov eax, dword [0x18026905c]
xor rdx, rax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x94]
mov eax, dword [rsp + 0x50]
or rdx, rcx
xor eax, 0x250
lea ecx, [r9 + 0x539]
sub eax, ebx
add ecx, eax
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [rbx + 0x69a]
add rsp, 0x20
pop rbx
ret
Function at 0x180009578
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov edi, dword [rsp + 0x90]
lea esi, [rcx + 0x621]
lea r12d, [rcx - 0x2245]
mov dword [rsp + 0x70], esi
mov ecx, dword [rsp + 0x98]
lea ebp, [r9 - 0x2ea5]
xor edi, 0x818
lea eax, [rsi + 0x278]
mov rbx, rdx
lea edx, [rcx - 0x5f1]
cmp ebp, eax
je 0x180009767
lea eax, [rcx - 0x2a27]
xor eax, 0x2ade
cmp edx, eax
jg 0x1800096a8
mov rax, qword [section..data]
mov ecx, dword [rax + 0x10]
add ecx, dword [rbx + 0xcc]
add ecx, dword [0x180269028]
xor ecx, 0x928f82df
mov dword [rbx + 0x118], ecx
xor r8d, r8d
mov edx, dword [0x180269088]
mov rax, qword [rbx + 0xc0]
mov ecx, dword [rax + r8]
mov rax, qword [0x1802690d0]
xor ecx, edx
mov dword [r8 + rax], ecx
add r8, 4
mov ecx, dword [0x180269024]
add ecx, 0xffe01008
add ecx, dword [0x1802690ac]
mov dword [0x180269024], ecx
mov eax, dword [rbx + 0x98]
xor eax, dword [0x1802690a4]
xor eax, dword [0x1802690ac]
mov rcx, qword [section..data]
xor eax, 0xffe87a96
mov dword [0x1802690ac], eax
mov eax, 0x1bb457
sub eax, dword [rcx + 0xd0]
sub eax, dword [rcx + 0x9c]
add dword [rcx + 0xb8], eax
mov edx, dword [0x180269088]
add edx, dword [0x1802690d8]
mov dword [0x180269088], edx
cmp r8, 0x21fb94
jl 0x180009615
jmp 0x180009767
mov eax, dword [rbx + 0x88]
mov r13d, edi
xor eax, dword [rbx + 0x5c]
cmp edi, eax
jne 0x180009767
mov eax, esi
mov r14d, edx
mov r15d, ebp
and r14d, 0x2967
xor r15d, edi
xor eax, r12d
imul eax, eax, 0x238c
mov esi, eax
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0x38]
mov eax, dword [rdx + 0x1c]
sub ecx, ebp
or rcx, rax
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov rcx, qword [section..data]
mov edx, r12d
sub edx, dword [0x18026904c]
imul edx, dword [rbx + 0x10c]
mov qword [rsp + 0x30], r14
mov r8d, dword [rcx + 4]
mov r9d, dword [rcx + 0x8c]
sub r8d, dword [rbx + 0xb8]
and r9d, edi
mov ecx, dword [rcx + 0xb8]
and r8d, 0x3084
mov dword [rsp + 0x28], r8d
mov r8d, r15d
mov eax, r12d
mov dword [rsp + 0x20], edx
or rcx, rax
imul r9d, r12d
mov edx, esi
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov eax, dword [rbx + 0x88]
add r13d, 4
xor eax, dword [rbx + 0x5c]
cmp r13d, eax
je 0x1800096d9
mov esi, dword [rsp + 0x70]
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
lea eax, [rsi + 0x700]
mov rbp, qword [r11 + 0x40]
xor eax, 0x541
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000a280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r11d, dword [rsp + 0x90]
lea r15d, [r8 - 0x3084]
add r11d, 0xcf8
mov ebx, r8d
xor ebx, 0x3084
mov dword [rsp + 0x90], r11d
mov eax, ebx
mov edi, r8d
xor eax, 0x2436
xor edi, 0x1e92
mov rsi, rdx
mov ebp, ecx
mov r13d, ebx
cmp ecx, eax
jl 0x18000a378
mov eax, dword [0x1802690c8]
lea r9d, [rbx + 0x269c]
sub eax, dword [0x180269024]
lea r8d, [rdi - 0x338]
add eax, 0x1e9050
lea edx, [rbp + 0x5b8]
or dword [0x18026905c], eax
mov r10d, ebx
lea eax, [rcx + 0x4db]
xor r10d, 0x2866
mov dword [rsp + 0x30], eax
lea ecx, [rbx + 0x2967]
mov dword [rsp + 0x28], ecx
mov rcx, qword [section..data]
mov dword [rsp + 0x20], r10d
call fcn.180003448
mov eax, dword [rsi + 0x4c]
cmp dword [rsi + 0x9c], eax
je 0x18000a35b
mov eax, dword [rsi + 0xb8]
add eax, 0x4018af63
xor dword [0x180269060], eax
jmp 0x18000a365
add dword [0x180269108], 0x230b
mov rax, qword [section..data]
and dword [rax + 0xcc], 0
jmp 0x18000a45e
mov eax, r15d
mov r12d, edi
sub eax, edi
imul r14d, eax, 0x2866
cmp edi, r14d
jne 0x18000a45e
mov r9, qword [section..data]
mov ecx, r15d
mov eax, dword [0x1802690a8]
mov edx, dword [0x180269104]
and eax, r13d
mov r10d, dword [0x1802690ec]
xor eax, 0x2ea5
sub edx, dword [r9 + 0x48]
sub r10d, r11d
mov r8d, dword [r9 + 0x98]
add edx, 0x238c
sub ecx, dword [0x180269034]
add r8d, dword [rsi + 0x48]
xor ecx, ebp
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r10d
call fcn.180004478
mov rcx, qword [section..data]
mov edx, ebx
sub edx, dword [0x180269078]
mov r13d, eax
xor edx, dword [0x18026902c]
mov r10d, dword [rsi + 0x4c]
mov r8d, dword [rcx + 0xec]
mov ecx, dword [0x180269108]
sub r10d, dword [rsi + 0x10c]
mov r9d, dword [rsi + 0xb8]
or r8d, dword [rsp + 0x90]
or r9d, edi
sub r9d, dword [rsi + 0xa0]
add r8d, ebx
imul ecx, eax
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], edx
lea rdx, [0x180269010]
imul ecx, ebp
call fcn.180009de0
mov r11d, dword [rsp + 0x90]
inc r12d
cmp r12d, r14d
je 0x18000a390
lea r11, [rsp + 0x40]
mov rbp, qword [r11 + 0x38]
lea eax, [rbx + 0x2aa4]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000a484
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0xa0]
lea r13d, [rcx - 0x2866]
mov esi, r8d
lea r11, [0x180269010]
xor esi, 0x2aa4
mov r14d, r9d
xor r14d, 0x2aa4
mov dword [rsp + 0x98], esi
lea r15d, [rax - 0x59e]
mov rbp, rdx
lea r12d, [rax - 0x753]
mov dword [rsp + 0x90], r15d
lea edi, [rax - 0x31f7]
mov dword [rsp + 0xa0], r12d
lea eax, [rsi + 0x269c]
cmp r15d, eax
je 0x18000a67d
mov eax, esi
xor eax, 0x2a27
cmp esi, eax
jg 0x18000a59e
mov r10d, r14d
lea eax, [r15 + 0x42b]
mov edx, r15d
xor r10d, 0x2c59
xor edx, 0x16f
mov dword [rsp + 0x30], r10d
mov dword [rsp + 0x28], edx
mov r9d, esi
mov r8d, r15d
mov dword [rsp + 0x20], eax
mov ecx, r15d
mov rdx, r11
xor r9d, 0x2e16
xor r8d, 0x6fd
xor ecx, 0x86f
call fcn.1800047d8
add eax, 0x698
lea r9d, [r13 + 0x238c]
mov dword [rsp + 0x28], eax
lea edx, [rdi + 0x2f66]
mov r8d, esi
lea rax, [0x180269010]
xor r8d, 0x269c
mov qword [rsp + 0x20], rax
lea ecx, [rdi + 0x2ea5]
call fcn.1800027b4
mov r12d, eax
lea r11, [0x180269010]
jmp 0x18000a67d
mov eax, dword [rdx + 0x60]
mov r12d, edi
and eax, dword [rdx + 0xd4]
and eax, r13d
cmp edi, eax
jbe 0x18000a675
mov ebx, dword [rsp + 0xa0]
mov rcx, qword [section..data]
imul ebx, edi
cmp edi, ebx
jle 0x18000a64e
mov eax, dword [rcx + 0x90]
mov esi, dword [rbp + 0xb8]
xor eax, 0xd23
cmp esi, eax
jb 0x18000a64e
lea eax, [r15 + 0x269c]
mov r15d, eax
imul r14d, dword [rbp + 0xf0]
mov rdx, rcx
imul r9d, dword [0x1802690c8], 0x238c
mov ecx, r15d
mov eax, dword [rbp + 0x10c]
xor eax, r13d
xor eax, 0x2245
or r14d, dword [rbp + 0xc]
or r9d, dword [0x1802690c8]
mov r8d, r14d
mov dword [rsp + 0x20], eax
call fcn.180002c3c
mov rcx, qword [section..data]
mov r14d, eax
inc esi
mov eax, dword [rcx + 0x90]
xor eax, 0xd23
cmp esi, eax
jae 0x18000a5ed
mov r15d, dword [rsp + 0x90]
mov eax, dword [rbp + 0x60]
add r12d, 3
and eax, dword [rbp + 0xd4]
and eax, r13d
cmp r12d, eax
ja 0x18000a5c6
mov esi, dword [rsp + 0x98]
lea r11, [0x180269010]
mov r12d, dword [rsp + 0xa0]
mov eax, esi
xor eax, 0x269c
cmp r14d, eax
je 0x18000a733
mov eax, esi
lea r8d, [r13 + 0x2e16]
mov ecx, r12d
xor eax, 0x2aa4
mov ebx, esi
mov dword [rsp + 0x20], eax
xor ebx, 0x238c
xor ecx, 0x1c9
mov edx, ebx
mov r9, r11
call fcn.180002d54
mov r8d, eax
mov dword [rsp + 0x20], ebx
xor r12d, 0x8e1
lea ecx, [r15 - 0x4db]
xor r8d, 0x1db2
mov r9d, r12d
mov rdx, rbp
mov edi, eax
call fcn.18000a280
mov r8, qword [section..data]
lea r9d, [rdi - 0xdd]
mov edx, edi
mov qword [rsp + 0x20], r8
xor r14d, 0x2ade
lea ecx, [rsi + 0x31f7]
mov r8d, r14d
xor edx, 0x1cc1
call fcn.180002ed0
lea r9d, [r13 + 0x2d36]
mov qword [rsp + 0x20], rbp
lea r8d, [rdi - 0x292]
mov ecx, eax
lea edx, [rsi + 0x2ea5]
call fcn.180004918
lea eax, [rdi - 0x292]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret