joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180040000
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov r8, qword [rcx + 8]
mov rbx, rcx
sub r8, qword [rcx]
mov eax, edx
cmp rax, r8
ja 0x180040199
mov dword [rcx + 0x18], edx
mov qword [rsp + 0x70], rsi
xor esi, esi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x60], 0xc8
mov dword [rsp + 0x68], 0x38
mov ecx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
add ecx, eax
mov dword [rsp + 0x68], ecx
lea rcx, [rsp + 0x20]
mov edx, dword [rsp + 0x68]
mov qword [rsp + 0x78], rdi
call fcn.180356080
mov dword [rsp + 0x60], 8
mov r8d, esi
mov dword [rsp + 0x68], 0x78
mov ecx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
add ecx, eax
mov dword [rsp + 0x68], ecx
mov ecx, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x20]
cmp qword [rsp + 0x28], rdx
je 0x1800400ea
nop word [rax + rax]
add cl, r8b
mov byte [rdx + r8], cl
mov rdx, qword [rsp + 0x20]
mov dword [rsp + 0x60], 0x75
mov dword [rsp + 0x68], 0x35
mov ecx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x60]
add ecx, eax
movzx eax, byte [rdx + r8]
inc r8
mov dword [rsp + 0x68], ecx
mov ecx, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x20]
xor ecx, eax
mov rax, qword [rsp + 0x28]
sub rax, rdx
cmp r8, rax
jb 0x1800400a0
lea rcx, [rsp + 0x38]
call fcn.18003aa00
mov r8d, dword [rsp + 0x28]
lea rcx, [rbx + 0x88]
sub r8d, dword [rsp + 0x20]
mov r9d, dword [rbx + 0x18]
mov rdx, qword [rax]
call fcn.180002d50
mov rcx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x78]
test rcx, rcx
je 0x18004015c
mov rdx, qword [rsp + 0x48]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180040149
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004019f
call fcn.180360d9c
xorps xmm0, xmm0
mov qword [rsp + 0x48], rsi
movdqu xmmword [rsp + 0x38], xmm0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x180040194
mov rdx, qword [rsp + 0x30]
mov rax, rcx
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18004018f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004019f
call fcn.180360d9c
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rbx
ret
call fcn.1803687c0
int3
Function at 0x180049a10
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rcx + 8], 0
lea rax, [0x18038ecd8]
mov qword [rcx], rax
mov rbx, rcx
mov byte [rcx + 0x10], 1
mov rbp, r9
mov qword [rcx + 0x40], 0
mov esi, r8d
mov qword [rcx + 0x48], 0xf
mov rdi, rdx
mov byte [rcx + 0x30], 0
add rcx, 0x58
call fcn.18000a190
mov rdx, qword [rsp + 0x70]
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
mov dword [rbx + 0x20], esi
mov qword [rbx + 0x28], rbp
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x180049a80
lea rcx, [rbx + 0x30]
call fcn.180353890
movzx eax, word [rsp + 0x78]
lea rcx, [rbx + 0x58]
mov dl, 1
mov word [rbx + 0x50], ax
mov byte [rbx + 0x178], 1
call fcn.18000b640
mov rcx, qword [rbp + 0x20]
mov dl, 1
call fcn.18000b640
lea rax, [rsp + 0x78]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea r8, [0x180001e10]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call fcn.1803666c0
mov qword [rbx + 8], rax
test rax, rax
jne 0x180049b03
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
cmp byte [rbx + 0x10], 0
je 0x180049b03
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18004dc90
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
movzx r14d, r8w
mov ecx, 0x4f8
mov rbx, rdx
call fcn.1803610bc
mov r15, rax
xor r12d, r12d
mov qword [rax + 8], r12
mov byte [rax + 0x10], 1
mov qword [rax + 0x20], rbx
mov word [rax + 0x18], 1
lea rax, [0x18038eba8]
mov qword [r15], rax
mov dword [rsp + 0x80], 0x38f
mov dword [rsp + 0x90], 0x71
mov ecx, dword [rsp + 0x90]
mov eax, dword [rsp + 0x80]
add ecx, eax
mov dword [rsp + 0x90], ecx
lea rcx, [r15 + 0x40]
mov edi, dword [rsp + 0x90]
mov qword [r15 + 0x40], r12
mov edx, edi
mov qword [r15 + 0x48], r12
mov qword [r15 + 0x50], r12
mov qword [r15 + 0x58], r12
mov qword [r15 + 0x60], r12
mov qword [r15 + 0x68], r12
call fcn.1803566a0
lea edx, [rdi + 1]
lea rcx, [r15 + 0x58]
call fcn.1803566a0
mov dword [r15 + 0x70], r12d
lea rcx, [rbp + 0x70]
mov byte [r15 + 0x74], r12b
mov byte [r15 + 0x88], r12b
mov qword [r15 + 0x4b0], r12
mov qword [r15 + 0x4b8], r12
mov qword [r15 + 0x4c0], r12
mov byte [r15 + 0xa4], r12b
mov dword [r15 + 0x9c], r12d
mov byte [r15 + 0x4e0], r12b
mov qword [r15 + 0x4e8], r12
mov word [r15 + 0x28], 1
mov word [r15 + 0x4f0], r12w
mov qword [r15 + 0x38], rbp
mov byte [r15 + 0x90], 1
mov word [r15 + 0x4c8], r14w
mov rdx, qword [rcx + 8]
mov qword [rsp + 0x30], r15
cmp qword [rcx + 0x10], rdx
je 0x18004ddb8
mov qword [rdx], r15
add qword [rcx + 8], 8
jmp 0x18004ddc2
lea r8, [rsp + 0x30]
call fcn.180355af0
lea rax, [rsp + 0x98]
mov r9, r15
mov qword [rsp + 0x28], rax
lea r8, [0x180001e10]
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call fcn.1803666c0
mov qword [r15 + 8], rax
test rax, rax
jne 0x18004de0c
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
cmp byte [r15 + 0x10], r12b
je 0x18004de0c
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18004de20
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x18039c6c8]
mov rdi, rcx
test rax, rax
jne 0x18004df64
movdqa xmm0, xmmword [0x18038fab0]
mov byte [rsp + 0x34], al
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xb9afaea0
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
nop word [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
sub cl, 0x45
xor cl, byte [rsp + rax + 0x21]
mov rax, qword [rsp + 0x50]
mov byte [rsp + rax + 0x21], cl
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0x13
jb 0x18004de70
mov byte [rsp + 0x34], 0
call fcn.1800015d0
mov ecx, dword [0x18039b468]
mov rsi, rax
mov rax, qword gs:[0x58]
mov edx, 4
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x18039d510], eax
jle 0x18004df03
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x18004df03
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
mov rbx, qword [rsp + 0x58]
jle 0x18004df41
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x18004df41
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rsi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x21]
call qword [0x1803a1560]
mov rsi, qword [rsp + 0x60]
mov qword [0x18039c6c8], rax
mov rcx, qword [rdi + 0x3b48]
mov edx, 0xffffffff
call rax
add rsp, 0x40
pop rdi
ret
Function at 0x18004f480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx ebx, dl
mov rdi, rcx
call fcn.180052330
cmp bl, 0x5a
jne 0x18004f4ac
mov dword [rdi + 0x78], 8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18000b220
Function at 0x1800537f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [0x18038ed18]
mov qword [rcx + 8], 0
mov qword [rcx], rax
mov rdi, rcx
mov byte [rcx + 0x10], 1
mov rsi, r8
add rcx, 0x18
movzx ebx, dx
call fcn.18000a190
lea rax, [rsp + 0x48]
mov word [rdi + 0x138], bx
mov qword [rsp + 0x28], rax
lea r8, [0x180001e10]
mov r9, rdi
mov dword [rsp + 0x20], 0
xor edx, edx
mov byte [rdi + 0x13a], 0
xor ecx, ecx
call fcn.1803666c0
mov qword [rdi + 8], rax
test rax, rax
jne 0x18005387f
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
cmp byte [rdi + 0x10], 0
je 0x18005387f
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rbx, qword [rsp + 0x40]
lea rax, [0x18038ed78]
mov qword [rdi], rax
mov rax, rdi
mov qword [rdi + 0x140], rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180053c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
xor edi, edi
mov rcx, qword [rcx]
test rcx, rcx
je 0x180053c70
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180053c83
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rbx + 8], rdi
movdqa xmm0, xmmword [0x18038f500]
xor eax, eax
mov byte [rsp + 0x2a], al
movdqu xmmword [rsp + 0x2b], xmm0
mov dword [rsp + 0x20], 0x4e466622
mov dword [rsp + 0x24], 0x4b001f1f
mov word [rsp + 0x28], 0x5d5c
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x50]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
sub cl, 0x76
xor cl, byte [rsp + rax + 0x2c]
mov rax, qword [rsp + 0x50]
mov byte [rsp + rax + 0x2c], cl
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 0xe
jb 0x180053cc0
mov byte [rsp + 0x3a], dil
mov qword [rsp + 0x50], rdi
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x50]
add cl, 0x29
xor cl, byte [rsp + rax + 0x21]
mov rax, qword [rsp + 0x50]
mov byte [rsp + rax + 0x21], cl
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
cmp rax, 9
jb 0x180053d01
mov rax, qword gs:[0x58]
mov ecx, dword [0x18039b468]
mov edx, 4
mov byte [rsp + 0x2a], dil
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x18039d510], eax
jle 0x180053d8c
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180053d8c
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180053dc5
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180053dc5
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
lea rcx, [rsp + 0x21]
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x2c]
call qword [0x1803a1560]
test rax, rax
je 0x180053de5
call rax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180055410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
xor eax, eax
mov dword [rsp + 0x20], 0xc0f3b29
mov byte [rsp + 0x2c], al
mov dword [rsp + 0x24], 0x1c01012f
mov dword [rsp + 0x28], 0xa173a15
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
add cl, 0x69
xor cl, byte [rsp + rax + 0x21]
mov rax, qword [rsp + 0x40]
mov byte [rsp + rax + 0x21], cl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xb
jb 0x180055450
mov byte [rsp + 0x2c], 0
call fcn.180001690
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x18039d510], ecx
jle 0x1800554e3
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x1800554e3
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x18005551c
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x18005551c
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x21]
call qword [0x1803a1560]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180055540
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
movdqa xmm0, xmmword [0x18038f480]
mov rsi, rdx
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x80], 0
mov rax, qword [rsp + 0x80]
nop dword [rax]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x80]
add cl, 0x5b
xor cl, byte [rsp + rax + 0x31]
mov rax, qword [rsp + 0x80]
mov byte [rsp + rax + 0x31], cl
mov rax, qword [rsp + 0x80]
inc rax
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
cmp rax, 0xe
jb 0x180055580
mov byte [rsp + 0x3f], 0
call fcn.180001690
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x18039d510], ecx
jle 0x180055625
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180055625
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x18005565e
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x18005565e
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x31]
call qword [0x1803a1560]
mov r10, rax
test rax, rax
jne 0x180055690
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
movdqa xmm0, xmmword [0x18038fc30]
mov ebx, 1
mov dword [rsp + 0x70], ebx
xor dil, dil
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0xe0f6e2
mov qword [rsp + 0x80], 0
mov rax, qword [rsp + 0x80]
nop word [rax + rax]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x80]
add cl, 0x74
xor cl, byte [rsp + rax + 0x41]
mov rax, qword [rsp + 0x80]
mov byte [rsp + rax + 0x41], cl
mov rax, qword [rsp + 0x80]
inc rax
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
cmp rax, 0x12
jb 0x1800556d0
lea rax, [rsp + 0x70]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov byte [rsp + 0x53], 0
lea rdx, [rsp + 0x41]
mov rcx, rsi
call r10
mov rsi, qword [rsp + 0x88]
test eax, eax
movzx ecx, dil
cmove ecx, ebx
mov rbx, qword [rsp + 0x78]
movzx eax, cl
add rsp, 0x60
pop rdi
ret
Function at 0x180055760
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
movdqa xmm0, xmmword [0x18038f640]
xor eax, eax
mov byte [rbp + 0x17], al
xor r14d, r14d
movdqu xmmword [rbp + 7], xmm0
mov qword [rbp + 0x67], r14
mov rsi, rdx
mov rax, qword [rbp + 0x67]
nop
mov rcx, qword [rbp + 0x67]
mov rax, qword [rbp + 0x67]
add cl, 0x66
xor cl, byte [rbp + rax + 8]
mov rax, qword [rbp + 0x67]
mov byte [rbp + rax + 8], cl
mov rax, qword [rbp + 0x67]
inc rax
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
cmp rax, 0xf
jb 0x1800557a0
mov byte [rbp + 0x17], r14b
call fcn.180001690
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x18039d510], ecx
jle 0x18005582c
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x18005582c
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180055865
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180055865
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp + 8]
call qword [0x1803a1560]
mov rbx, rax
test rax, rax
je 0x18005595a
call fcn.180055410
mov rdi, rax
test rax, rax
je 0x18005595a
movdqa xmm0, xmmword [0x18038fa00]
movdqa xmm1, xmmword [0x18038f7a0]
movdqu xmmword [rbp + 0x18], xmm0
mov dword [rbp + 0x38], 0x6267606a
movdqu xmmword [rbp + 0x28], xmm1
mov dword [rbp + 0x3c], 0x73715732
mov dword [rbp + 0x40], 0x7c7c7973
mov word [rbp + 0x44], 0x68
mov qword [rbp + 0x67], r14
mov rax, qword [rbp + 0x67]
nop word [rax + rax]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rbp + 0x67]
sub cl, 0x11
xor cl, byte [rbp + rax + 0x19]
mov rax, qword [rbp + 0x67]
mov byte [rbp + rax + 0x19], cl
mov rax, qword [rbp + 0x67]
inc rax
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
cmp rax, 0x2c
jb 0x1800558e0
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x77]
mov qword [rsp + 0x38], rax
lea rdx, [rbp + 0x19]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x20], r14d
mov byte [rbp + 0x45], r14b
call rbx
test eax, eax
jne 0x18005595a
mov rdx, qword [rbp + 0x77]
call fcn.180055540
mov rcx, qword [rbp + 0x77]
movzx ebx, al
call rdi
movzx eax, bl
jmp 0x18005595c
xor al, al
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180055980
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [0x18038fbb0]
xor ecx, ecx
mov qword [rbp + 0x28], rcx
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0xe0
mov qword [rbp + 0x20], rcx
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x20]
add cl, 0x76
xor cl, byte [rbp + rax - 0x1f]
mov rax, qword [rbp + 0x20]
mov byte [rbp + rax - 0x1f], cl
mov rax, qword [rbp + 0x20]
inc rax
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
cmp rax, 0x10
jb 0x1800559b0
mov byte [rbp - 0xf], 0
call fcn.1800018d0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x18039d510], ecx
jle 0x180055a3c
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x180055a3c
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x180055a75
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x180055a75
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rbp - 0x1f]
call qword [0x1803a1560]
mov rdi, rax
test rax, rax
je 0x180055b75
call fcn.180055410
mov rbx, rax
test rax, rax
je 0x180055b75
xor edx, edx
lea rax, [rbp + 0x28]
lea r9, [0x18038e848]
mov qword [rsp + 0x20], rax
lea rcx, [0x18038e838]
lea r8d, [rdx + 1]
call rdi
test eax, eax
js 0x180055b69
mov rcx, qword [rbp + 0x28]
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x28]
test eax, eax
js 0x180055b5f
mov rcx, qword [rbp + 0x28]
lea r8, [rbp + 0x30]
mov edx, 2
mov rax, qword [rcx]
call qword [rax + 0x78]
test eax, eax
js 0x180055b5f
mov rdx, qword [rbp + 0x30]
call fcn.180055760
mov rcx, qword [rbp + 0x28]
lea r8, [rbp - 0x40]
mov edx, 1
mov qword [rsp + 0x20], r8
lea r9, [rbp - 0x30]
mov dword [rbp - 0x30], 0x35378eac
mov r8d, edx
mov dword [rbp - 0x2c], 0x11d2683f
mov rax, qword [rcx]
mov dword [rbp - 0x28], 0xc0009aa8
mov dword [rbp - 0x24], 0xa2cfbb4f
mov dword [rbp - 0x40], 0xf6b957e
mov dword [rbp - 0x3c], 0x11d1509e
mov dword [rbp - 0x38], 0xcca7
mov dword [rbp - 0x34], 0xe37175f8
call qword [rax + 0x38]
mov rcx, qword [rbp + 0x30]
call rbx
mov rcx, qword [rbp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rdx, 0xffffffff80000002
call fcn.180055760
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
Function at 0x18034c140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
movdqa xmm0, xmmword [0x18038f4b0]
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x40], 0
mov rax, qword [rsp + 0x40]
nop word [rax + rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
add cl, 0x72
xor cl, byte [rsp + rax + 0x21]
mov rax, qword [rsp + 0x40]
mov byte [rsp + rax + 0x21], cl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xe
jb 0x18034c170
mov byte [rsp + 0x2f], 0
call fcn.1800015d0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x18039d510], ecx
jle 0x18034c203
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x18034c203
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x18034c23c
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x18034c23c
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x21]
call qword [0x1803a1560]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18034c260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor eax, eax
mov dword [rsp + 0x20], 0xd0b278b
mov byte [rsp + 0x2e], al
mov dword [rsp + 0x24], 0x1f032b00
mov dword [rsp + 0x28], 0x7032f1c
mov word [rsp + 0x2c], 0x2c09
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
nop dword [rax]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
add cl, 0x61
xor cl, byte [rsp + rax + 0x21]
mov rax, qword [rsp + 0x40]
mov byte [rsp + rax + 0x21], cl
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp rax, 0xd
jb 0x18034c2a0
mov byte [rsp + 0x2e], 0
call fcn.1800015d0
mov rcx, qword gs:[0x58]
mov rdi, rax
mov edx, dword [0x18039b468]
mov eax, 4
mov rbx, qword [rcx + rdx*8]
add rbx, rax
mov ecx, dword [rbx]
cmp dword [0x18039d510], ecx
jle 0x18034c333
lea rcx, [0x18039d510]
call fcn.180360f8c
cmp dword [0x18039d510], 0xffffffff
jne 0x18034c333
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, [0x18039d510]
mov qword [0x1803a15b8], rax
call fcn.180360f2c
mov eax, dword [rbx]
cmp dword [0x1803a1558], eax
jle 0x18034c36c
lea rcx, [0x1803a1558]
call fcn.180360f8c
cmp dword [0x1803a1558], 0xffffffff
jne 0x18034c36c
mov rax, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [0x1803a1558]
mov qword [0x1803a1560], rax
call fcn.180360f2c
mov rcx, rdi
call qword [0x1803a15b8]
mov rcx, rax
lea rdx, [rsp + 0x21]
call qword [0x1803a1560]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret