joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180066920
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180066951
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18019e8a8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18019e8b8]
lea rdx, [rdi + rdi]
call fcn.180065430
mov rax, qword [0x18019e8a8]
lea r9, [rdi - 1]
mov qword [0x18019e8d0], r9
mov qword [0x18019e8d8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180066ac4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18019e8b8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180066a10
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180066a85
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180066a4d
mov r10, qword [rdx]
cmp r10, rax
je 0x180066a47
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180066a85
cmp r9, rdx
je 0x180066a61
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180066a99
cmp r9, rdx
jne 0x180066a52
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180066abf
mov r9, qword [0x18019e8d0]
jmp 0x1800669c1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180066a85
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180066ad0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180066b01
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18019e938]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18019e948]
lea rdx, [rdi + rdi]
call fcn.180065430
mov rax, qword [0x18019e938]
lea r9, [rdi - 1]
mov qword [0x18019e960], r9
mov qword [0x18019e968], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180066c74
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18019e948]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180066bc0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180066c35
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180066bfd
mov r10, qword [rdx]
cmp r10, rax
je 0x180066bf7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180066c35
cmp r9, rdx
je 0x180066c11
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180066c49
cmp r9, rdx
jne 0x180066c02
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180066c6f
mov r9, qword [0x18019e960]
jmp 0x180066b71
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180066c35
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180066c80
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180066cb1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18019e9c8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18019e9d8]
lea rdx, [rdi + rdi]
call fcn.180065430
mov rax, qword [0x18019e9c8]
lea r9, [rdi - 1]
mov qword [0x18019e9f0], r9
mov qword [0x18019e9f8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180066e24
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18019e9d8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180066d70
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180066de5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180066dad
mov r10, qword [rdx]
cmp r10, rax
je 0x180066da7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180066de5
cmp r9, rdx
je 0x180066dc1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180066df9
cmp r9, rdx
jne 0x180066db2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180066e1f
mov r9, qword [0x18019e9f0]
jmp 0x180066d21
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180066de5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180066e30
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180066e61
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18019e8f8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18019e908]
lea rdx, [rdi + rdi]
call fcn.180065430
mov rax, qword [0x18019e8f8]
lea r9, [rdi - 1]
mov qword [0x18019e920], r9
mov qword [0x18019e928], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180066fd4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18019e908]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180066f20
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180066f95
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180066f5d
mov r10, qword [rdx]
cmp r10, rax
je 0x180066f57
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180066f95
cmp r9, rdx
je 0x180066f71
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180066fa9
cmp r9, rdx
jne 0x180066f62
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180066fcf
mov r9, qword [0x18019e920]
jmp 0x180066ed1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180066f95
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180066fe0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180067011
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18019ea08]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18019ea18]
lea rdx, [rdi + rdi]
call fcn.180065430
mov rax, qword [0x18019ea08]
lea r9, [rdi - 1]
mov qword [0x18019ea30], r9
mov qword [0x18019ea38], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180067184
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18019ea18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800670d0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180067145
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18006710d
mov r10, qword [rdx]
cmp r10, rax
je 0x180067107
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180067145
cmp r9, rdx
je 0x180067121
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180067159
cmp r9, rdx
jne 0x180067112
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18006717f
mov r9, qword [0x18019ea30]
jmp 0x180067081
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180067145
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180067190
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800671c1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18019e988]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18019e998]
lea rdx, [rdi + rdi]
call fcn.180065430
mov rax, qword [0x18019e988]
lea r9, [rdi - 1]
mov qword [0x18019e9b0], r9
mov qword [0x18019e9b8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180067334
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18019e998]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180067280
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800672f5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800672bd
mov r10, qword [rdx]
cmp r10, rax
je 0x1800672b7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800672f5
cmp r9, rdx
je 0x1800672d1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180067309
cmp r9, rdx
jne 0x1800672c2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18006732f
mov r9, qword [0x18019e9b0]
jmp 0x180067231
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800672f5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180067d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18014b040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rcx]
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x180067da3
movdqa xmm0, xmmword [0x180130280]
lea rdx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x1a], 0x353020
movdqa xmm0, xmmword [0x1801308a0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x20], 0x20383420
mov word [rbp - 0x1c], 0x4238
mov byte [rbp - 0x16], al
mov word [rbp - 0x35], 0x6c
mov dword [rbp - 0x40], 0x2d73656d
mov dword [rbp - 0x3c], 0x65766966
mov word [rbp - 0x38], 0x642e
mov byte [rbp - 0x36], 0x6c
mov byte [rbp - 0x33], al
call fcn.1800676e0
mov qword [rbx], rax
mov qword [rbp - 0x28], rax
lea rcx, section..text
xor eax, eax
mov qword [rbp - 0x30], rcx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rbp - 0x20], rax
xor r8d, r8d
lea rax, [rbp - 0x30]
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.18009c2a0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18009cbe0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x1800698c0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
call fcn.180067350
mov r11, rax
test rax, rax
je 0x180069963
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x180069963
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x180069963
mov eax, dword [rcx + r11 + 0x88]
test eax, eax
je 0x180069963
mov ebx, dword [rax + r11 + 0x1c]
xor r9d, r9d
mov r10d, dword [rax + r11 + 0x20]
mov ebp, dword [rax + r11 + 0x24]
add r10, r11
add rbp, r11
lea rsi, [r11 + rbx]
test ebx, ebx
je 0x180069963
nop dword [rax]
mov r8d, dword [r10]
mov rax, rdi
add r8, r11
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180069953
inc rax
test ecx, ecx
jne 0x180069940
test edx, edx
je 0x18006997a
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x180069930
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x180069965
Function at 0x18006ba60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
mov r9, rcx
je 0x18006baa9
mov r8, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r8, rcx
nop word [rax + rax]
lea edx, [rax + r8]
lea ecx, [rdx - 0xb]
xor byte [rax - 2], cl
lea rax, [rax + 3]
lea ecx, [rdx - 0xa]
sub dl, 9
xor byte [rax - 4], cl
lea rcx, [r8 + rax]
xor byte [rax - 3], dl
cmp rcx, 0x57
jb 0x18006ba80
mov byte [r9 + 0x58], 0
ret

Function at 0x18006bab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xaa], 0
je 0x18006bad8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xb]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0xa9
jb 0x18006bac0
mov byte [rcx + 0xaa], 0
ret

Function at 0x18006bae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1eb], 0
je 0x18006bb08
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xb]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x1ea
jb 0x18006baf0
mov byte [rcx + 0x1eb], 0
ret
Function at 0x18006dca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x18014b040]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword [0x18019e740]
mov rcx, qword [rax]
test rcx, rcx
je 0x18006de37
mov rdx, qword [rcx + 8]
test rdx, rdx
je 0x18006de37
mov rax, qword [0x18019e7b0]
cmp qword [rdx + rax], 0
je 0x18006de37
cmp byte [0x18019e7c0], 0
je 0x18006de37
lea rax, section..text
mov qword [rbp + 0x27], rax
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov qword [rbp + 0x2f], rax
xor eax, eax
mov qword [rbp + 0x37], rax
xor ebx, ebx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x45
call fcn.18009c2a0
test ax, ax
jns 0x18006de37
movdqa xmm0, xmmword [0x180130aa0]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x180130170]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x180130b60]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x180130870]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x180130040]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1801301a0]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x180130610]
movdqa xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x1004359
nop dword [rax + rax]
lea eax, [rbx - 7]
xor byte [rbp + rbx - 0x59], al
lea eax, [rbx - 6]
xor byte [rbp + rbx - 0x58], al
lea eax, [rbx - 5]
xor byte [rbp + rbx - 0x57], al
lea eax, [rbx - 4]
xor byte [rbp + rbx - 0x56], al
lea eax, [rbx - 3]
xor byte [rbp + rbx - 0x55], al
lea eax, [rbx - 2]
xor byte [rbp + rbx - 0x54], al
add rbx, 6
cmp rbx, 0x72
jb 0x18006ddb0
mov byte [rbp + 0x1a], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x59]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18006de02
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 0x27]
call fcn.18001ac10
nop
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova rcx, qword [rbp + 0x27]
call fcn.18006a320
nop
lea rcx, [rbp + 0x27]
call fcn.180017e00
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18009cbe0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret
Function at 0x18006dff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x18014b040]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
mov rax, qword [0x18019e658]
mov rsi, qword [rax + rcx*8]
mov dword [rbp - 0x17], 0x203d20
mov dword [rbp - 0x21], 0x61636f6c
mov dword [rbp - 0x1d], 0x766e206c
mov word [rbp - 0x19], 0x6865
mov byte [rbp - 0x13], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
lea rax, [rbp - 0x21]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x18006e062
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0xf]
call fcn.18001ac10
nop
test rsi, rsi
je 0x18006e0ba
lea rax, section..text
mov qword [rbp - 0x21], rax
mov rax, qword [0x18019e7a0]
mov qword [rbp - 0x19], rax
xor eax, eax
mov qword [rbp - 0x11], rax
mov qword [rsp + 0x28], rbx
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.18009c2a0
mov ebx, eax
lea r9, [rbp + 0x44]
test ebx, ebx
jns 0x18006e100
neg ebx
nop dword [rax]
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x18006e0d0
dec r9
mov byte [r9], 0x2d
jmp 0x18006e126
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x18006e100
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
lea rax, [rbp + 0x44]
cmp r9, rax
jne 0x18006e151
movdqa xmm0, xmmword [0x18012fe20]
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x21], 0
jmp 0x18006e165
lea r8, [rbp + 0x44]
sub r8, r9
mov rdx, r9
lea rcx, [rbp - 0x21]
call fcn.18001ac10
nop
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 0xf
cmova rdx, qword [rbp - 0x21]
mov r8, qword [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.1800181f0
mov word [rbp - 0x29], 0xa
mov byte [rbp - 0x27], 0
lea rcx, [rbp - 0x29]
mov r8, rdi
inc r8
cmp byte [rcx + r8], 0
jne 0x18006e191
lea rdx, [rbp - 0x29]
mov rcx, rax
call fcn.1800181f0
nop
lea rcx, [rbp - 0x21]
call fcn.180017e00
movdqa xmm0, xmmword [0x180130a00]
movdqu xmmword [rbp - 0x21], xmm0
movdqa xmm1, xmmword [0x180130190]
movdqu xmmword [rbp - 0x11], xmm1
mov dword [rbp - 1], 0x74353126
mov dword [rbp + 3], 0x3275796d
mov dword [rbp + 7], 0x81132
mov byte [rbp + 0xb], 1
lea rcx, [rbp - 0x21]
call fcn.18006d530
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18006e1f0
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.1800181f0
lea rcx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0xf
cmova rcx, qword [rbp + 0xf]
call fcn.18006a320
nop
lea rcx, [rbp + 0xf]
call fcn.180017e00
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18009cbe0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret