joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002c520
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [0x180285ba8], 0
mov rbx, rcx
jne 0x18002c68a
xor eax, eax
mov dword [rsp + 0x30], 0x1b91a998
mov byte [rsp + 0x36], al
movabs r9, 0xaaaaaaaaaaaaaaab
mov word [rsp + 0x34], 0x6f5a
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
nop word [rax + rax]
mov rcx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x38]
movzx r8d, byte [rsp + rax + 0x31]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x38]
shl dl, 3
sub cl, dl
mov edx, 0x732d11fa
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x31], dl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp rax, 5
jb 0x18002c570
mov byte [rsp + 0x36], 0
call fcn.1800015c0
mov rcx, qword gs:[0x58]
mov rsi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rdi, qword [rcx + rdx*8]
add rdi, rax
mov ecx, dword [rdi]
cmp dword [0x180286968], ecx
jle 0x18002c622
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x18002c622
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rdi]
cmp dword [0x18028a99c], eax
mov rdi, qword [rsp + 0x48]
jle 0x18002c660
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18002c660
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rsi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x31]
mov rcx, rax
call r8
mov rsi, qword [rsp + 0x40]
mov qword [0x180285ba8], rax
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18002c6bc
mov eax, 1
xchg dword [rcx + 4], eax
cmp eax, 1
je 0x18002c6bc
mov ecx, 0xa
call qword [0x180285ba8]
mov rcx, qword [rbx + 8]
mov eax, 1
xchg dword [rcx + 4], eax
cmp eax, 1
jne 0x18002c6a0
add rsp, 0x20
pop rbx
ret
Function at 0x1800305f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r15
mov rbp, rsp
sub rsp, 0x78
xor esi, esi
lea rdx, [rbp - 0x48]
mov dword [rbp + 0x30], esi
mov r15, rcx
call fcn.18002fb30
mov rdi, qword [rbp - 0x48]
cmp rdi, qword [rbp - 0x40]
je 0x180030842
mov edx, dword [0x1802848b4]
mov rax, qword gs:[0x58]
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], r13
movabs r13, 0xaaaaaaaaaaaaaaab
lea r12, [rax + rdx*8]
mov qword [rsp + 0x70], r14
mov r10d, 4
nop dword [rax]
mov rax, qword [r15 + 0x10]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1800306e5
nop dword [rax]
cmp byte [rbx + 0x68], 0
je 0x1800306b8
lea rcx, [rbx + 0x10]
or esi, 1
lea rdx, [rbp - 0x30]
call fcn.18002f660
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x180030693
mov rdx, qword [rdi]
cmp qword [rax + 0x18], 0x10
mov r8, qword [rax + 0x10]
jb 0x1800306a1
mov rax, qword [rax]
cmp r8, qword [rdi + 0x10]
jne 0x1800306b8
mov rcx, rax
call fcn.18024c4b0
test eax, eax
jne 0x1800306b8
mov r14b, 1
jmp 0x1800306bb
xor r14b, r14b
test sil, 1
je 0x1800306cd
and esi, 0xfffffffe
lea rcx, [rbp - 0x30]
call fcn.18023c0a0
test r14b, r14b
jne 0x180030811
mov rbx, qword [rbx]
cmp rbx, qword [r15 + 0x10]
jne 0x180030670
mov r10d, 4
xor eax, eax
mov dword [rbp - 0x58], 0x5219bc31
mov byte [rbp - 0x4c], al
mov dword [rbp - 0x54], 0x55423bfa
mov dword [rbp - 0x50], 0x40676860
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
nop word [rax + rax]
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0x30]
movzx r8d, byte [rbp + rax - 0x57]
mov rax, r13
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rbp + 0x30]
shl dl, 3
sub cl, dl
mov edx, 0x5bd404f8
sar edx, cl
xor dl, r8b
mov byte [rbp + rax - 0x57], dl
mov rax, qword [rbp + 0x30]
inc rax
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
cmp rax, 0xb
jb 0x180030710
mov byte [rbp - 0x4c], 0
call fcn.1800015c0
mov ebx, r10d
mov r14, rax
add rbx, qword [r12]
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x1800307a7
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x1800307a7
mov rcx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18028a9f8], rcx
lea rcx, [0x180286968]
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x1800307e0
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x1800307e0
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, r14
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rbp - 0x57]
mov rcx, rax
call r8
test rax, rax
je 0x180030811
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x18003080f
mov rcx, qword [rdi]
call rax
add rdi, 0x20
mov r10d, 4
cmp rdi, qword [rbp - 0x40]
jne 0x180030660
mov r14, qword [rsp + 0x70]
mov r13, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xa0]
lea rcx, [rbp - 0x48]
call fcn.18023bf70
add rsp, 0x78
pop r15
pop rdi
pop rsi
pop rbp
ret
Function at 0x180034150
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov byte [rsp + 0x20], r9b
push rdi
sub rsp, 0x30
mov byte [rcx + 0x10], 1
lea rax, [0x18027a908]
xor ebp, ebp
mov rbx, rcx
mov qword [rcx + 8], rbp
mov r8, 0xffffffffffffffff
mov qword [rcx + 0x18], rbp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx], rax
add rcx, 0x38
mov qword [rbx + 0x68], rbp
mov qword [rbx + 0x70], 0xf
mov byte [rbx + 0x58], bpl
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bpl
mov qword [rbx + 0x88], rbp
mov qword [rbx + 0x90], 0xf
mov byte [rbx + 0x78], bpl
nop dword [rax]
inc r8
cmp byte [rdx + r8], bpl
jne 0x1800341d0
call fcn.18023c100
xor r8d, r8d
lea rdx, [0x18027a397]
lea rcx, [rbx + 0x58]
call fcn.18023c100
xor r8d, r8d
lea rdx, [0x18027a397]
lea rcx, [rbx + 0x78]
call fcn.18023c100
lea rax, [rsp + 0x58]
mov byte [rbx + 0x30], 1
mov qword [rsp + 0x28], rax
lea r8, [0x180001e10]
mov r9, rbx
mov dword [rsp + 0x20], ebp
xor edx, edx
xor ecx, ecx
call fcn.180251cdc
mov qword [rbx + 8], rax
test rax, rax
jne 0x18003424e
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
cmp byte [rbx + 0x10], bpl
je 0x18003424e
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180036520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov dword [rsp + 0x38], 0xf1
mov dword [rsp + 0x30], 0xf
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [rsp + 0x30], ecx
mov rcx, rbx
mov edx, dword [rsp + 0x30]
call fcn.18023a8f0
mov dword [rsp + 0x38], 0x14
mov dword [rsp + 0x30], 0x6c
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
mov rax, qword [rbx + 8]
cmp rax, qword [rbx]
je 0x1800365d3
nop
mov rax, qword [rbx]
add cl, dil
mov byte [rdi + rax], cl
mov rdx, qword [rbx]
mov dword [rsp + 0x38], 0x9d
mov dword [rsp + 0x30], 0xd
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
add ecx, eax
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x30]
movzx eax, byte [rdx + rdi]
inc rdi
xor ecx, eax
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
cmp rdi, rax
jb 0x180036590
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180036780
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
lea rdx, [rsp + 0xa8]
mov rdi, rcx
call fcn.18003bb30
mov rbx, qword [rsp + 0xa8]
xor esi, esi
cmp ebx, 1
jne 0x1800367fc
mov eax, dword [rsp + 0xac]
dec eax
cmp eax, 5
ja case.default.0x1800367c8
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x369ec]
add rcx, rdx
jmp rcx
lea rbx, [rdi + 0x20]
jmp 0x1800367f1
lea rbx, [rdi + 0x28]
jmp 0x1800367f1
lea rbx, [rdi + 0x30]
jmp 0x1800367f1
lea rbx, [rdi + 0x38]
jmp 0x1800367f1
lea rbx, [rdi + 0x40]
jmp 0x1800367f1
lea rbx, [rdi + 0x48]
jmp 0x1800367f1
mov rbx, rsi
mov rbx, qword [rbx]
mov qword [rsp + 0xa8], rbx
cmp ebx, 4
jne 0x1800369db
mov rax, qword [rdi + 8]
sub rax, qword [rdi]
shr rbx, 0x20
movsxd rcx, ebx
cmp rcx, rax
ja 0x1800369db
mov rdx, qword [rdi + 0x60]
lea rcx, [rdi + 0x58]
mov eax, dword [rdi + 0x18]
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x20], 4
mov dword [rsp + 0x24], eax
cmp rdx, qword [rdi + 0x68]
je 0x180036852
mov rax, qword [rsp + 0x20]
mov qword [rdx], rax
add qword [rcx + 8], 8
jmp 0x18003685c
lea r8, [rsp + 0x20]
call fcn.18023ec50
lea rcx, [rsp + 0x40]
mov dword [rdi + 0x18], ebx
lea r14, [rdi + 0x88]
call fcn.180036520
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
mov ebp, dword [rax + 8]
sub ebp, dword [rax]
mov dword [rsp + 0xa0], 0xf1
mov dword [rsp + 0x98], 0xf
mov ecx, dword [rsp + 0x98]
mov eax, dword [rsp + 0xa0]
add ecx, eax
mov dword [rsp + 0x98], ecx
lea rcx, [rsp + 0x28]
mov edx, dword [rsp + 0x98]
call fcn.18023a8f0
mov dword [rsp + 0xa0], 0x14
mov dword [rsp + 0x98], 0x6c
mov ecx, dword [rsp + 0x98]
mov eax, dword [rsp + 0xa0]
add ecx, eax
mov dword [rsp + 0x98], ecx
mov ecx, dword [rsp + 0x98]
mov rdx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
sub rdx, rdi
je 0x180036952
add cl, sil
mov byte [rsi + rdi], cl
mov dword [rsp + 0xa0], 0x9d
mov dword [rsp + 0x98], 0xd
mov ecx, dword [rsp + 0x98]
mov eax, dword [rsp + 0xa0]
add ecx, eax
movzx eax, byte [rsi + rdi]
inc rsi
mov dword [rsp + 0x98], ecx
mov ecx, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x28]
xor ecx, eax
cmp rsi, rdx
jb 0x180036905
mov r9d, ebx
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call fcn.180002bf0
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
test rdi, rdi
je 0x1800369a3
mov rdx, qword [rsp + 0x38]
mov rax, rdi
sub rdx, rdi
cmp rdx, 0x1000
jb 0x18003699b
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800369e3
mov rcx, rdi
call fcn.180249cb8
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1800369db
mov rdx, qword [rsp + 0x50]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800369d6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800369e3
call fcn.180249cb8
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
call fcn.1802514a4
int3
Function at 0x18003c7e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r14
mov rbp, rsp
sub rsp, 0x68
mov r8, qword [rcx + 8]
sub r8, qword [rcx]
mov r14d, edx
cmp r14, r8
ja 0x18003c9e7
mov dword [rcx + 0x18], r14d
mov qword [rax + 0x18], rbx
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
xor edi, edi
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rdi
mov dword [rbp + 0x18], 0xf1
mov dword [rbp + 0x20], 0xf
mov qword [rax - 0x28], r15
lea r15, [rcx + 0x88]
mov ecx, dword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
add ecx, eax
mov dword [rbp + 0x20], ecx
lea rcx, [rbp - 0x48]
mov edx, dword [rbp + 0x20]
call fcn.18023a8f0
mov dword [rbp + 0x18], 0x14
mov edx, edi
mov dword [rbp + 0x20], 0x6c
mov ecx, dword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
add ecx, eax
mov dword [rbp + 0x20], ecx
mov ecx, dword [rbp + 0x20]
mov rsi, qword [rbp - 0x40]
mov r8, qword [rbp - 0x48]
mov r9, rsi
sub r9, r8
je 0x18003c8b9
nop dword [rax]
add cl, dl
mov byte [r8 + rdx], cl
mov dword [rbp + 0x18], 0x9d
mov dword [rbp + 0x20], 0xd
mov ecx, dword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
add ecx, eax
movzx eax, byte [r8 + rdx]
inc rdx
mov dword [rbp + 0x20], ecx
mov ecx, dword [rbp + 0x20]
mov r8, qword [rbp - 0x48]
xor ecx, eax
cmp rdx, r9
jb 0x18003c880
mov rsi, qword [rbp - 0x40]
mov qword [rbp - 0x30], rdi
sub esi, r8d
mov qword [rbp - 0x28], rdi
mov qword [rbp - 0x20], rdi
mov dword [rbp + 0x18], 0xf1
mov dword [rbp + 0x20], 0xf
mov ecx, dword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
add ecx, eax
mov dword [rbp + 0x20], ecx
lea rcx, [rbp - 0x30]
mov edx, dword [rbp + 0x20]
call fcn.18023a8f0
mov dword [rbp + 0x18], 0x14
mov dword [rbp + 0x20], 0x6c
mov ecx, dword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
add ecx, eax
mov dword [rbp + 0x20], ecx
mov ecx, dword [rbp + 0x20]
mov rdx, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x30]
sub rdx, rbx
je 0x18003c954
nop word [rax + rax]
add cl, dil
mov byte [rdi + rbx], cl
mov dword [rbp + 0x18], 0x9d
mov dword [rbp + 0x20], 0xd
mov ecx, dword [rbp + 0x20]
mov eax, dword [rbp + 0x18]
add ecx, eax
movzx eax, byte [rdi + rbx]
inc rdi
mov dword [rbp + 0x20], ecx
mov ecx, dword [rbp + 0x20]
mov rbx, qword [rbp - 0x30]
xor ecx, eax
cmp rdi, rdx
jb 0x18003c920
mov r9d, r14d
mov r8d, esi
mov rdx, rbx
mov rcx, r15
call fcn.180002bf0
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
test rbx, rbx
je 0x18003c9a9
mov rdx, qword [rbp - 0x20]
mov rax, rbx
sub rdx, rbx
cmp rdx, 0x1000
jb 0x18003c9a1
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003c9ef
mov rcx, rbx
call fcn.180249cb8
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x18003c9df
mov rdx, qword [rbp - 0x38]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18003c9da
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003c9ef
call fcn.180249cb8
mov rbx, qword [rsp + 0x90]
add rsp, 0x68
pop r14
pop rbp
ret
call fcn.1802514a4
int3
Function at 0x18003cab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor ebx, ebx
lea rax, [0x18027a848]
xorps xmm0, xmm0
mov qword [0x18028aa20], rbx
mov byte [0x18028aa28], bl
mov qword [0x18028aa18], rax
lea ecx, [rbx + 0x20]
movdqu xmmword [0x18028aa30], xmm0
call fcn.180249f28
mov dword [rsp + 0x20], 0xf6540ee6
movabs r9, 0xaaaaaaaaaaaaaaab
mov dword [rsp + 0x24], 0x14d710a8
mov dword [rsp + 0x28], 0xfd6e6259
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18028aa30], rax
mov word [rsp + 0x2c], 0x83
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx r8d, byte [rsp + rax + 0x21]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x40]
shl dl, 3
sub cl, dl
mov edx, 0x736e164d
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x21], dl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xc
jb 0x18003cb30
mov byte [rsp + 0x2d], bl
call fcn.1800015c0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x18003cbe1
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x18003cbe1
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x18003cc1a
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18003cc1a
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x21]
mov rcx, rax
call r8
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x48]
mov qword [0x18028aa40], rax
lea rax, [0x18028aa18]
mov byte [0x18028aa48], 0
add rsp, 0x30
pop rdi
ret
Function at 0x180055ec0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rcx
call fcn.18000ab80
mov r9d, eax
lea rcx, [rsi + 0x88]
mov eax, 0xaaaaaaab
mul r9d
mov eax, 0x5397829d
shr edx, 5
lea r8d, [rdx + rdx*2]
shl r8d, 4
sub r9d, r8d
mul r9d
shr edx, 4
imul eax, edx, 0x31
sub r9d, eax
lea eax, [r9 + 1]
movzx edx, al
add edx, 0x20
shl edx, 4
call fcn.18000d5c0
cmp byte [rsi + 0x3b50], 0
jne 0x180055f42
mov ecx, 0x148
call fcn.180249f28
mov rdx, rsi
mov rcx, rax
call fcn.180052a20
mov qword [rsi + 0x3b38], rax
mov edi, 2
mov r8d, edi
lea edx, [rdi - 1]
lea ecx, [rdi + 3]
call fcn.180007760
test al, al
jne 0x180055f99
lea edx, [rdi - 1]
lea ecx, [rdi + 3]
lea r8d, [rdi + 1]
call fcn.180007760
test al, al
jne 0x180055f99
xor r8d, r8d
lea ecx, [rdi + 4]
xor edx, edx
call fcn.180007760
test al, al
jne 0x180055f99
xor edx, edx
lea ecx, [rdi + 4]
lea r8d, [rdi - 1]
call fcn.180007760
test al, al
jne 0x180055f99
cmp byte [rsi + 0x3fb0], al
je 0x180055fa5
jmp 0x180055fa0
mov byte [rsi + 0x3fb0], 1
mov edi, 5
xor ebp, ebp
lea r14, [0x18027a9b8]
nop
mov ecx, 0x28
call fcn.180249f28
mov rbx, rax
lea r8, [0x180001e10]
mov r9, rbx
xor edx, edx
xor ecx, ecx
mov qword [rax + 8], rbp
mov byte [rax + 0x10], 1
mov qword [rax], r14
mov qword [rax + 0x20], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
call fcn.180251cdc
mov qword [rbx + 8], rax
test rax, rax
jne 0x180056012
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
cmp byte [rbx + 0x10], bpl
je 0x180056012
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov qword [rsi + 0x3b40], rbx
sub rdi, 1
jne 0x180055fb0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180058f30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
movzx edi, r8w
mov ecx, 0x4f8
mov rbx, rdx
call fcn.180249f28
mov rdx, rbx
mov rcx, rax
call fcn.18003d300
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rcx, [rsi + 0x70]
mov qword [rax + 0x38], rsi
mov byte [rax + 0x90], 1
mov word [rax + 0x4c8], di
mov rdx, qword [rsi + 0x78]
cmp rdx, qword [rsi + 0x80]
je 0x180058f93
mov qword [rdx], rax
add qword [rcx + 8], 8
jmp 0x180058fa2
lea r8, [rsp + 0x40]
call fcn.18023ee70
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x180001e10]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call fcn.180251cdc
mov qword [rbx + 8], rax
test rax, rax
jne 0x180058fec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
cmp byte [rbx + 0x10], 0
je 0x180058fec
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18005b5a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx ebx, dl
mov rdi, rcx
call fcn.18005ffa0
cmp bl, 0x5a
jne 0x18005b5cc
mov dword [rdi + 0x78], 8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180009b60
Function at 0x1800629f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
je 0x180062a10
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180062a23
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 8], rdi
movdqa xmm0, xmmword [0x18027ac20]
movabs r9, 0xaaaaaaaaaaaaaaab
movdqu xmmword [rsp + 0x2b], xmm0
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x50]
nop word [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx r8d, byte [rsp + rax + 0x2c]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x50]
shl dl, 3
sub cl, dl
mov edx, 0x4913a28a
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x2c], dl
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0xe
jb 0x180062a50
xor eax, eax
mov byte [rsp + 0x3a], dil
mov byte [rsp + 0x2a], al
mov dword [rsp + 0x20], 0xcc3eeacb
mov dword [rsp + 0x24], 0x6e3b1867
mov word [rsp + 0x28], 0xaee9
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x50]
nop dword [rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
movzx r8d, byte [rsp + rax + 0x21]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x50]
shl dl, 3
sub cl, dl
mov edx, 0x45bc2a5
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x21], dl
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 9
jb 0x180062ad0
mov rax, qword gs:[0x58]
mov ecx, dword [0x1802848b4]
mov edx, 4
mov byte [rsp + 0x2a], dil
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x180286968], eax
jle 0x180062b7a
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x180062b7a
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x180062bb3
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x180062bb3
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
lea rcx, [rsp + 0x21]
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x2c]
mov rcx, rax
call r8
test rax, rax
je 0x180062bda
call rax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180064320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor eax, eax
mov dword [rsp + 0x20], 0xc939ea2e
mov byte [rsp + 0x2c], al
movabs r9, 0xaaaaaaaaaaaaaaab
mov dword [rsp + 0x24], 0x593ac714
mov dword [rsp + 0x28], 0xb8081f0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
movzx r8d, byte [rsp + rax + 0x21]
mov rax, r9
mul rcx
shr rdx, 4
movzx eax, dl
add al, al
add dl, al
mov rax, qword [rsp + 0x40]
shl dl, 3
sub cl, dl
mov edx, 0x5609cab8
sar edx, cl
xor dl, r8b
mov byte [rsp + rax + 0x21], dl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xb
jb 0x180064370
mov byte [rsp + 0x2c], 0
call fcn.1800016b0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x1802848b4]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x180286968], ecx
jle 0x180064422
lea rcx, [0x180286968]
call fcn.180249e18
cmp dword [0x180286968], 0xffffffff
jne 0x180064422
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x180286968]
mov qword [0x18028a9f8], rax
call fcn.180249db8
mov eax, dword [rbx]
cmp dword [0x18028a99c], eax
jle 0x18006445b
lea rcx, [0x18028a99c]
call fcn.180249e18
cmp dword [0x18028a99c], 0xffffffff
jne 0x18006445b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x18028a99c]
mov qword [0x18028a9a0], rax
call fcn.180249db8
mov rax, qword [0x18028a9f8]
mov rcx, rdi
call rax
mov r8, qword [0x18028a9a0]
lea rdx, [rsp + 0x21]
mov rcx, rax
call r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret