joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019c060
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
lea rax, [0x1401c37d0]
mov qword [rcx], rax
mov byte [rcx + 8], 0
lea rcx, str.qwave.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14019c10e
mov rdi, rax
lea rdx, str.QOSCreateHandle
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rbx
mov qword [rsi + 0x10], rax
lea rdx, str.QOSCloseHandle
mov rcx, rdi
call rbx
mov qword [rsi + 0x18], rax
lea rdx, str.QOSAddSocketToFlow
mov rcx, rdi
call rbx
mov qword [rsi + 0x20], rax
lea rdx, str.QOSRemoveSocketFromFlow
mov rcx, rdi
call rbx
mov qword [rsi + 0x28], rax
lea rdx, str.QOSSetFlow
mov rcx, rdi
call rbx
mov qword [rsi + 0x30], rax
cmp qword [rsi + 0x10], 0
je 0x14019c10e
cmp qword [rsi + 0x18], 0
je 0x14019c10e
cmp qword [rsi + 0x20], 0
je 0x14019c10e
cmp qword [rsi + 0x28], 0
je 0x14019c10e
test rax, rax
je 0x14019c10e
mov al, 1
xchg byte [rsi + 8], al
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14019c280
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov r14, r9
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401f0038]
xor rax, rsp
mov qword [rsp + 0xe0], rax
lea rbx, [rsp + 0x50]
mov r8d, SysAllocStringByteLen
mov rcx, rbx
mov dl, 0xaa
call fcn.14012ffe0
mov rcx, rbx
call fcn.1400c7b90
mov dword [rbx + 0x80], 0x80
mov rcx, qword [rsi + 8]
cmp rcx, 0xffffffffffffffff
je 0x14019c430
lea rax, [rsp + 0xd0]
mov r8, qword [rax + 8]
mov rdx, qword [rdi + 0x10]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r8d, ebp
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
je 0x14019c3b0
mov ebx, eax
movaps xmm0, xmmword [0x1401c1a20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
mov dword [rcx + 0x10], 0xaaaaaaaa
call fcn.1400f7530
test ebx, ebx
js 0x14019c370
mov r8d, dword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
lea r15, [rsp + 0x30]
mov rcx, r15
call fcn.1400a07c0
test al, al
je 0x14019c36b
test r14, r14
je 0x14019c373
mov eax, dword [rsp + 0x40]
mov dword [r14 + 0x10], eax
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [r14], xmm0
jmp 0x14019c373
mov ebx, 0xffffff94
xor r15d, r15d
mov r8, qword [rdi + 0x10]
mov rcx, rsi
mov edx, ebx
mov r9, r15
call fcn.14019c5c0
lea rcx, [rsp + 0x30]
call fcn.1400f7520
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14012d050
mov eax, ebx
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14019c3d8
mov ecx, eax
call fcn.1400c7c50
mov ebx, eax
mov rcx, rsi
mov edx, eax
xor r8d, r8d
xor r9d, r9d
call fcn.14019c5c0
jmp 0x14019c38e
test rdi, rdi
je 0x14019c3ee
mov eax, 1
lock xadd dword [rdi + 8], eax
cmp eax, 0x7fffffff
je 0x14019c433
mov rcx, qword [rsi + 0xa8]
mov qword [rsi + 0xa8], rdi
test rcx, rcx
je 0x14019c418
lock dec dword [rcx + 8]
jne 0x14019c418
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x140224008]
mov dword [rsi + 0xb8], ebp
mov rcx, rsi
call fcn.14019cb30
mov ebx, 0xffffffff
jmp 0x14019c38e
int3
int3
Function at 0x14019c440
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov r14, r9
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x1401f0038]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea r15, [rsp + 0x30]
mov r8d, SysAllocStringByteLen
mov rcx, r15
mov dl, 0xaa
call fcn.14012ffe0
mov rcx, r15
call fcn.1400c7b90
test r14, r14
je 0x14019c4d4
lea r8, [rsp + 0xb0]
mov r15, qword [r8 + 8]
mov rcx, r14
mov rdx, r15
call fcn.1400a0750
test al, al
jne 0x14019c4cb
add rsi, 0xe0
mov ebp, 0xffffff94
mov rcx, rsi
mov edx, 0x59
mov r8d, 0xffffff94
call fcn.1400a05a0
jmp 0x14019c519
mov eax, dword [rsp + 0xb0]
jmp 0x14019c4e4
mov dword [rsp + 0xb0], 0
xor eax, eax
xor r15d, r15d
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rsi + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x14019c53b
mov ebp, eax
mov r8, qword [rbx + 0x10]
mov rcx, rsi
mov edx, eax
mov r9, r14
call fcn.14019c620
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14012d050
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14019c55e
mov ecx, eax
call fcn.1400c7c50
mov ebp, eax
mov rcx, rsi
mov edx, eax
xor r8d, r8d
xor r9d, r9d
jmp 0x14019c514
test rbx, rbx
je 0x14019c574
mov eax, 1
lock xadd dword [rbx + 8], eax
cmp eax, 0x7fffffff
je 0x14019c5b6
mov rcx, qword [rsi + 0xb0]
mov qword [rsi + 0xb0], rbx
test rcx, rcx
je 0x14019c59e
lock dec dword [rcx + 8]
jne 0x14019c59e
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x140224008]
mov dword [rsi + 0xbc], edi
mov rcx, rsi
call fcn.14019cb30
mov ebp, 0xffffffff
jmp 0x14019c519
int3

Function at 0x1401af260
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
je 0x1401af273
cmp dword [0x1402137d0], ecx
jle 0x1401af27a
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd rdi, eax
mov rcx, rsi
mov rdx, rdi
call fcn.1401af2c0
test edi, edi
je 0x1401af273
cmp byte [rsi + rdi - 1], 0xa
je 0x1401af273
lea rcx, reloc.WS2_32.dll_ioctlsocket
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1401af2c0
Function at 0x1401af2c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401f0038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1401af30e
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x1401af34c
cmp rdi, rsi
jae 0x1401af34c
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x1401af307
jmp 0x1401af304
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14012d050
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x180343058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1803431df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180343089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x18034306f
add dl, dl
jne 0x180343096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1803430f6
xor eax, eax
add dl, dl
jne 0x1803430a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1803431ad
add dl, dl
jne 0x1803430b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1803430c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1803430d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1803430dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1803430ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x18034307e
mov eax, 1
add dl, dl
jne 0x180343106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180343113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1803430fb
sub eax, ebx
mov ebx, 1
jne 0x18034314c
mov ecx, 1
add dl, dl
jne 0x18034312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x18034313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180343123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18034307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180343168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180343175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x18034315d
cmp eax, 0x7d00
jae 0x18034319b
cmp eax, 0x500
jb 0x180343196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18034307e
cmp eax, 0x7f
ja 0x18034319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x18034307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1803431d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x18034307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180008500
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180253040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor ecx, ecx
call fcn.1800375c0
mov r9, rax
lea r8, [0x18023a3e0]
lea rdx, str.CONIN_
lea rcx, [rsp + 0x20]
call fcn.180037788
mov ecx, 1
call fcn.1800375c0
mov r9, rax
lea r8, [0x18023a3ec]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x20]
call fcn.180037788
mov ecx, 2
call fcn.1800375c0
mov r9, rax
lea r8, [0x18023a3ec]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x20]
call fcn.180037788
lea rcx, str.Logger
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [0x180237fd0]
mov rdx, rbx
call fcn.180008260
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180030780
add rsp, 0x30
pop rbx
ret
Function at 0x18001ba90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180253040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov edx, dword [0x180259410]
mov rax, qword gs:[0x58]
mov ecx, 8
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x1802647e4], edx
jle 0x18001bb29
lea rcx, [0x1802647e4]
call fcn.180030848
cmp dword [0x1802647e4], 0xffffffff
jne 0x18001bb29
mov word [0x180264813], 0x1c5
mov dword [0x180264808], 0xa4f17882
mov dword [0x18026480c], 0xf5dd26e4
mov word [0x180264810], 0x75ab
mov byte [0x180264812], 0xf3
lea rcx, [0x18015d920]
call fcn.180030c18
lea rcx, [0x1802647e4]
call fcn.1800307dc
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r11d, dword [rcx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x18001bbb6
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x18001bbb6
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
mov r8d, 0x2275701
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18001bbb1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x18001bb90
cmp r8d, 0xd6bdf1b0
je 0x18001bbbb
test r9d, r9d
jne 0x18001bb70
mov rax, qword [rax]
jmp 0x18001bb40
mov edx, dword [r11 + 0x1c]
add rdx, r10
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
add rax, r10
cmp byte [0x180264814], 0
je 0x18001bc38
xor byte [0x180264808], 0xcf
xor byte [0x180264809], 0x19
xor byte [0x18026480a], 0x9f
xor byte [0x18026480b], 0xc5
xor byte [0x18026480c], 0x83
xor byte [0x18026480d], 0x43
xor byte [0x18026480e], 0xaf
xor byte [0x18026480f], 0xdb
xor byte [0x180264810], 0xcf
xor byte [0x180264811], 0x19
xor byte [0x180264812], 0x9f
xor byte [0x180264813], 0xc5
mov byte [0x180264814], 0
lea rcx, [0x180264808]
call rax
mov rdx, rax
lea rcx, [0x1802647e8]
call fcn.18000e0a0
mov ecx, reloc.WS2_32.dll_recv
call fcn.180030f8c
mov qword [rax], rdi
lea rcx, [0x18001b8c0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18000e070]
xor edx, edx
xor ecx, ecx
call fcn.1800378d8
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18001bce2
cmp dword [rsp + 0x38], 0
je 0x18001bcd7
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18002ef1c
test eax, eax
jne 0x18001bcd7
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180030780
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
mov ecx, 1
call fcn.18002eba4
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.18002eba4
int3
Function at 0x18001e1d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x18001e267
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x18001e267
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc2f532ca
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18001e262
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18001e240
cmp r8d, 0xf8b69f20
je 0x18001e26c
test r9d, r9d
jne 0x18001e220
mov rax, qword [rax]
jmp 0x18001e1f0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
movabs r9, 0xe9881fdf4b67ad8e
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov ebx, dword [rcx + rdx*4]
lea rcx, [0x18001e1c0]
lea eax, [rcx - 0x1e]
add rbx, r10
xor al, 0x8e
mov byte [rsp + 0x20], al
mov rax, rcx
shr rax, 8
sub al, 0x1e
xor al, 0x8f
mov byte [rsp + 0x21], al
mov rax, rcx
shr rax, 0x10
sub al, 0x1e
xor al, 0x90
mov byte [rsp + 0x22], al
mov rax, rcx
shr rax, 0x18
sub al, 0x1e
xor al, 0x91
mov byte [rsp + 0x23], al
mov rax, rcx
shr rax, 0x20
sub al, 0x1e
xor al, 0x92
mov byte [rsp + 0x24], al
mov rax, rcx
shr rax, 0x28
sub al, 0x1e
xor al, 0x93
mov byte [rsp + 0x25], al
mov rax, rcx
shr rax, 0x30
shr rcx, 0x38
sub al, 0x1e
xor al, 0x94
sub cl, 0x1e
mov byte [rsp + 0x26], al
xor cl, 0x95
xor eax, eax
mov byte [rsp + 0x27], cl
mov qword [rsp + 0x28], rax
mov word [rsp + 0x30], ax
mov byte [rsp + 0x32], al
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
nop
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
add rcx, r9
movzx edx, byte [rsp + rax + 0x20]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rsp + 0x50]
add r8, rcx
add r8, rdx
add r8b, 0x1e
mov byte [rsp + rax + 0x20], r8b
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x13
jb 0x18001e320
mov rdx, qword [rsp + 0x20]
lea r8, [0x180263c48]
mov rcx, rbx
call fcn.1800bb760
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x1800bb9f0
Function at 0x18001fc40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x18001fcd7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x18001fcd7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x95ccb627
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18001fcd2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18001fcb0
cmp r8d, 0xdaeaf937
je 0x18001fcdc
test r9d, r9d
jne 0x18001fc90
mov rax, qword [rax]
jmp 0x18001fc60
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
movabs r9, 0xe3d56e3c4983ef66
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov ebx, dword [rcx + rdx*4]
lea rcx, [0x18001f830]
lea eax, [rcx - 0x36]
add rbx, r10
xor al, 0x66
mov byte [rsp + 0x20], al
mov rax, rcx
shr rax, 8
sub al, 0x36
xor al, 0x67
mov byte [rsp + 0x21], al
mov rax, rcx
shr rax, 0x10
sub al, 0x36
xor al, 0x68
mov byte [rsp + 0x22], al
mov rax, rcx
shr rax, 0x18
sub al, 0x36
xor al, 0x69
mov byte [rsp + 0x23], al
mov rax, rcx
shr rax, 0x20
sub al, 0x36
xor al, 0x6a
mov byte [rsp + 0x24], al
mov rax, rcx
shr rax, 0x28
sub al, 0x36
xor al, 0x6b
mov byte [rsp + 0x25], al
mov rax, rcx
shr rax, 0x30
shr rcx, 0x38
sub al, 0x36
xor al, 0x6c
sub cl, 0x36
mov byte [rsp + 0x26], al
xor cl, 0x6d
xor eax, eax
mov byte [rsp + 0x27], cl
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
nop word [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
add rcx, r9
movzx edx, byte [rsp + rax + 0x20]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rsp + 0x50]
add r8, rcx
add r8, rdx
add r8b, 0x36
mov byte [rsp + rax + 0x20], r8b
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x14
jb 0x18001fd90
mov rdx, qword [rsp + 0x20]
lea r8, [0x180263c78]
mov rcx, rbx
call fcn.1800bb760
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp 0x1800bb9f0
Function at 0x1800240a0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rax, qword gs:[0x60]
xor r13d, r13d
mov qword [rsp + 0x48], rdx
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov qword [rsp + 0x38], rcx
mov r15, qword [rcx]
cmp r15, rcx
je 0x18002427c
mov edx, 0x20b
mov r8d, 0x5a4d
nop
cmp qword [r15 + 0x60], 0
je 0x180024270
mov rdi, qword [r15 + 0x30]
test rdi, rdi
je 0x180024270
movsxd rax, dword [rdi + 0x3c]
mov ebp, dword [rax + rdi + 0x88]
add rbp, rdi
cmp word [rdi], r8w
jne 0x180024270
cmp word [rax + rdi + 0x18], dx
jne 0x180024135
cmp dword [rax + rdi + 0x8c], 0
jbe 0x180024270
mov r14d, dword [rbp + 0x18]
xor ebx, ebx
test r14d, r14d
je 0x18002426b
mov r12d, dword [rbp + 0x20]
nop dword [rax + rax]
lea rax, [r12 + rbx*4]
xor r10d, r10d
mov r11d, dword [rax + rdi]
mov eax, 0xb1ae19c0
add r11, rdi
movzx r9d, byte [r11]
test r9b, r9b
je 0x18002422e
mov r14d, 0xb1ae19c0
nop word [rax + rax]
movzx r8d, r9b
sub r9b, 0x41
cmp r9b, 0x19
lea ecx, [r8 + 0x20]
movzx edx, cl
cmova edx, r8d
movsx r8d, dl
cmp eax, r8d
jne 0x1800241a4
xor ecx, ecx
jmp 0x1800241c5
movd xmm0, r8d
movd xmm2, eax
movdqa xmm1, xmm0
andnps xmm1, xmmword [0x18023be00]
andps xmm1, xmm2
andnps xmm2, xmm0
orps xmm1, xmm2
movd ecx, xmm1
lea eax, [r10 - 0x4e51e640]
imul eax, r8d
add eax, ecx
mov ecx, r10d
test r10d, r10d
cmove ecx, r14d
movd xmm0, eax
pshufd xmm0, xmm0, 0
movd eax, xmm0
cmp ecx, r14d
jne 0x1800241f2
xor ecx, ecx
jmp 0x180024213
movd xmm1, ecx
movd xmm2, r14d
movdqa xmm0, xmm1
andnps xmm0, xmmword [0x18023be00]
andps xmm0, xmm2
andnps xmm2, xmm1
orps xmm0, xmm2
movd ecx, xmm0
imul eax, ecx
inc r10d
movzx r9d, byte [r10 + r11]
add eax, r8d
test r9b, r9b
jne 0x180024180
mov r14d, dword [rbp + 0x18]
mov ecx, eax
cmp qword [rsp + 0x48], rcx
je 0x180024244
inc ebx
cmp ebx, r14d
jb 0x180024150
jmp 0x18002425b
mov ecx, dword [rbp + 0x24]
add rcx, rdi
movzx edx, word [rcx + rbx*2]
mov ecx, dword [rbp + 0x1c]
add rcx, rdi
mov r13d, dword [rcx + rdx*4]
add r13, rdi
mov rcx, qword [rsp + 0x38]
mov r8d, 0x5a4d
mov edx, 0x20b
test r13, r13
jne 0x180024293
mov r15, qword [r15]
cmp r15, rcx
jne 0x1800240f0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rax, r13
jmp 0x18002427e
Function at 0x180025910
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x180253040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rax, qword gs:[0x58]
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor r14d, r14d
mov ecx, dword [0x180259410]
mov r15d, 8
mov rbp, qword [rax + rcx*8]
mov eax, dword [r15 + rbp]
cmp dword [0x1802654c8], eax
jle 0x180025a67
lea rcx, [0x1802654c8]
call fcn.180030848
cmp dword [0x1802654c8], 0xffffffff
jne 0x180025a67
mov rax, qword gs:[0x60]
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], rsi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180025a27
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180025a27
mov esi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xf8b629ef
lea rcx, [rsi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180025a22
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180025a00
cmp r8d, 0x5380ea2f
je 0x180025a2c
test r9d, r9d
jne 0x1800259e0
mov rax, qword [rax]
jmp 0x1800259b0
mov edx, dword [rbx + 0x24]
lea rcx, [0x1802654c8]
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rdx + r8*4]
add rax, r10
mov qword [0x1802654c0], rax
call fcn.1800307dc
mov rsi, qword [rsp + 0x1a0]
mov rbx, qword [rsp + 0x198]
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [0x1802654c0]
test eax, eax
jne 0x180025b0a
mov eax, dword [r15 + rbp]
cmp dword [0x1802654b8], eax
jle 0x180025ac4
lea rcx, [0x1802654b8]
call fcn.180030848
cmp dword [0x1802654b8], 0xffffffff
jne 0x180025ac4
lea rcx, [0x18015e400]
mov word [0x1802654b0], 0x11d
call fcn.180030c18
lea rcx, [0x1802654b8]
call fcn.1800307dc
cmp byte [0x1802654b1], r14b
je 0x180025adb
xor byte [0x1802654b0], 0x1d
mov byte [0x1802654b1], r14b
xorps xmm0, xmm0
lea rdx, [0x1802654b0]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
inc r8
cmp byte [rdx + r8], r14b
jne 0x180025af7
mov rcx, rdi
call fcn.18000d8e0
jmp 0x180025b50
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
xorps xmm1, xmm1
mov r8, 0xffffffffffffffff
movups xmmword [rsp + 0x30], xmm0
movdqu xmmword [rsp + 0x40], xmm1
inc r8
cmp byte [rax + r8], r14b
jne 0x180025b27
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18000d8e0
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180030780
mov rbp, qword [rsp + 0x1a8]
add rsp, 0x170
pop r15
pop r14
pop rdi
ret