joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ec70
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.14000d8c0
mov ecx, dword [0x140013478]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14000ec28
test byte [rbx + 0x40], 0xc
jne 0x14000ebdf
mov eax, dword [0x14001bd68]
test eax, eax
jne 0x14000ebf0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.14000cb20
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x14000ec13
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x14000ec13
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14000ec3c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14000ce10
call fcn.14000d970
mov rbx, rax
test rax, rax
jne 0x14000ebcf
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14000ec5a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.14000ce10
call fcn.14000ead0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x14000ece0
call fcn.14000fd90
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x14000ed18
call fcn.14000d8c0
mov ecx, dword [0x140013478]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14000ed70
test esi, esi
je 0x14000ecf6
call fcn.14000ebb0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000ed50
mov edx, edi
call fcn.14000fe40
call fcn.14000ebb0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14000d8c0
mov ecx, dword [0x140013478]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14000ed60
call fcn.14000ebb0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000ebb0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.14000d8c0
mov ecx, dword [0x140013478]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x14000ecb5
call fcn.14000d970
mov rbx, rax
jmp 0x14000ecb5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000ecce
call fcn.14000d970
jmp 0x14000ecf6
call fcn.14000d970
mov rbx, rax
jmp 0x14000ecb1

Function at 0x14000ed80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.14000d8c0
mov ecx, dword [0x140013478]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14000edf0
test esi, esi
je 0x14000edd0
call fcn.14000ebb0
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14000ee00
mov edx, esi
call fcn.14000fe40
call fcn.14000ebb0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14000ebb0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000ebb0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.14000d970
mov rbx, rax
jmp 0x14000eda1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000edba
Function at 0x18000dc50
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x18029d790]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
mov qword [rbp + 0x17], rcx
xor esi, esi
mov dword [rbp - 0x11], esi
mov qword [rcx], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
mov dword [rbp - 0x11], 1
mov qword [rbp + 0x3f], rsi
lea r9, [rbp + 0x3f]
xor r8d, r8d
mov edx, 0x8000
lea rcx, [0x18022a360]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x18000dd99
mov rdx, qword [rbp + 0x3f]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rdx + r8*2], 0
jne 0x18000dcd2
mov qword [rbp - 9], rsi
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], 7
mov word [rbp - 9], si
lea rcx, [rbp - 9]
call fcn.180011bd0
mov dword [rbp - 0x11], 7
lea rdx, [rbp - 9]
mov rcx, rdi
call fcn.180006940
nop
lea rcx, [rbp - 9]
call fcn.180011b60
mov byte [rbp - 0x19], 0x49
mov al, 0x27
mov cl, 0x2c
mov dl, 0x31
mov r8b, 0x3c
mov r9b, 0x3a
xor r10d, r10d
xor al, 0x49
mov byte [rbp - 0x18], al
xor cl, 0x49
mov byte [rbp - 0x17], cl
xor dl, 0x49
mov byte [rbp - 0x16], dl
xor r8b, 0x49
mov byte [rbp - 0x15], r8b
xor r9b, 0x49
mov byte [rbp - 0x14], r9b
mov byte [rbp - 0x13], r10b
lea rax, [rbp - 0x18]
inc rbx
cmp byte [rax + rbx], r10b
jne 0x18000dd53
call fcn.1801a75b8
lea rcx, [rbp - 0x18]
mov qword [rbp - 9], rcx
mov qword [rbp - 1], rbx
lea r8, [rbp - 9]
mov edx, eax
lea rcx, [rbp + 0x1f]
call fcn.1800066c0
mov dword [rbp - 0x11], 0x1f
lea rdx, [rbp + 0x1f]
mov rcx, rdi
call fcn.180006940
nop
lea rcx, [rbp + 0x1f]
call fcn.180011b60
mov rax, rdi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1801a9b50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18000e320
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18000e342
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18000e3bc
mov rdi, r14
mov rcx, rbx
call fcn.180011b20
test rax, rax
jle 0x18000e394
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1801ac2d0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18000e3ac
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x18000e3b4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18000e356
sub r14, rdi
jmp 0x18000e4a9
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18000e3d3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000e3d5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000e40a
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1801ac2d0
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18000e4a6
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x18000e445
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x18000e481
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1801c0a14
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x18000e4bf
cmp rbp, rax
ja 0x18000e451
mov r8, rdi
test rdi, rdi
je 0x18000e4a6
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1801c0a14
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x18000e4a9
Function at 0x18000e8c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18029d790]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000e8ed
xor eax, eax
jmp 0x18000ea33
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000e927
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18000e927
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18000ea33
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18000ea26
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000e96a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18000e979
movsx ecx, dil
jmp 0x18000e9cd
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + gethostname]
test eax, eax
je 0x18000e9e7
sub eax, 1
je 0x18000e9e7
cmp eax, 2
jne 0x18000ea26
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1801b8bc0
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000ea2b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18000ea14
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1801bdc3c
cmp rsi, rax
jne 0x18000ea26
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x18000ea2b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1801a9b50
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x180026680
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
cmp edx, 1
jne 0x180026858
mov rax, qword [0x1803368e0]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [0x1803368f0], rcx
test rax, rax
jne 0x18002676a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180026747
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180026747
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x45d9a764
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180026742
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180026720
cmp r8d, 0xc4d3cf58
je 0x18002674c
test r9d, r9d
jne 0x180026700
mov rax, qword [rax]
jmp 0x1800266d0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x1803368e0], rax
mov rcx, rsi
call rax
mov rax, qword [0x1803368c8]
test rax, rax
jne 0x18002682a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180026807
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180026807
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x554084fe
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180026802
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800267e0
cmp r8d, 0x43b892de
je 0x18002680c
test r9d, r9d
jne 0x1800267c0
mov rax, qword [rax]
jmp 0x180026790
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x1803368c8], rax
xor ecx, ecx
lea r8, [0x180026400]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], ecx
call rax
mov rdi, qword [rsp + 0x48]
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret
xor eax, eax
add rsp, 0x30
pop rsi
ret
Function at 0x180026a80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov ebx, edx
mov rdi, rcx
mov r8d, dword [0x180335888]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180336d54], r8d
jle 0x180026b68
lea rcx, [0x180336d54]
call fcn.1801a9d00
cmp dword [0x180336d54], 0xffffffff
jne 0x180026b68
movdqa xmm0, xmmword [0x180271920]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271a90]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x6166506
mov dword [rsp + 0x54], 0x11061211
mov word [rsp + 0x58], reloc.WS2_32.dll_recv
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x31], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x32], al
add rdx, 2
cmp rdx, 0x28
jb 0x180026b10
mov byte [rsp + 0x59], 0
mov dword [rsp + 0x20], 0
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rsp + 0x31]
call fcn.180068750
add rax, 3
mov qword [0x180336cd0], rax
lea rcx, [0x180336d54]
call fcn.1801a9ca0
mov rcx, qword [0x180336cd0]
movsxd rax, dword [rcx]
lea r8, [rcx + 4]
add r8, rax
je 0x180026b8d
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
jmp r8
xor eax, eax
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x180026ba0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rdi, rcx
mov r8d, dword [0x180335888]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180336d40], r8d
jle 0x180026c75
lea rcx, [0x180336d40]
call fcn.1801a9d00
cmp dword [0x180336d40], 0xffffffff
jne 0x180026c75
movdqa xmm0, xmmword [0x180271b80]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180272a50]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0xb0e1a0b
mov dword [rsp + 0x54], 0x78021a
xor edx, edx
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x31], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x32], al
add rdx, 2
cmp rdx, 0x26
jb 0x180026c21
mov byte [rsp + 0x57], 0
mov dword [rsp + 0x20], 0
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rsp + 0x31]
call fcn.180068750
mov qword [0x180336ca0], rax
lea rcx, [0x180336d40]
call fcn.1801a9ca0
mov rax, qword [0x180336ca0]
xor edx, edx
mov rcx, rdi
call rax
movsd xmm0, qword [rax]
movsd qword [rbx], xmm0
mov eax, dword [rax + 8]
mov dword [rbx + 8], eax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x180026ca0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov r8d, dword [0x180335888]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180336d44], r8d
jle 0x180026d7a
lea rcx, [0x180336d44]
call fcn.1801a9d00
cmp dword [0x180336d44], 0xffffffff
jne 0x180026d7a
movdqa xmm0, xmmword [0x1802723f0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x52442750
mov dword [rsp + 0x44], 0x25274457
mov dword [rsp + 0x48], 0x44265044
mov word [rsp + 0x4c], 0x205c
xor eax, eax
mov byte [rsp + 0x4e], al
xor edx, edx
nop dword [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x31], al
inc rdx
cmp rdx, 0x1d
jb 0x180026d30
mov byte [rsp + 0x4e], 0
mov dword [rsp + 0x20], 0
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rsp + 0x31]
call fcn.180068750
mov qword [0x180336d08], rax
lea rcx, [0x180336d44]
call fcn.1801a9ca0
mov rax, qword [0x180336d08]
mov r8, rbx
xor edx, edx
mov rcx, rdi
call rax
test rax, rax
setne al
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180029f30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov ecx, dword [0x180335888]
mov rax, qword gs:[0x58]
mov edx, 4
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x180341850], eax
jle 0x180029fcd
lea rcx, [0x180341850]
call fcn.1801a9d00
cmp dword [0x180341850], 0xffffffff
jne 0x180029fcd
mov dword [rsp + 0x20], 0
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, str.E8_____________8B_03_48_8B_BC_24_B0_01_00_00
call fcn.180068750
movsxd rdx, dword [rax + 1]
add rax, 5
add rax, rdx
mov qword [0x180341878], rax
lea rcx, [0x180341850]
call fcn.1801a9ca0
mov rdi, qword [0x180341878]
mov eax, dword [rbx]
cmp dword [0x180341860], eax
jle 0x18002a095
lea rcx, [0x180341860]
call fcn.1801a9d00
cmp dword [0x180341860], 0xffffffff
jne 0x18002a095
movdqa xmm0, xmmword [0x1802726f0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180272500]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180272560]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x4d385a4f
xor eax, eax
mov byte [rsp + 0x64], al
xor edx, edx
nop word [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x31], al
inc rdx
cmp rdx, 0x33
jb 0x18002a040
mov byte [rsp + 0x64], 0
mov dword [rsp + 0x20], 0
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rsp + 0x31]
call fcn.180068750
movsxd rdx, dword [rax + 3]
add rax, 7
add rax, rdx
mov qword [0x1803418a8], rax
lea rcx, [0x180341860]
call fcn.1801a9ca0
mov rax, qword [0x1803418a8]
mov rcx, qword [rax]
mov r9, rsi
mov r8, rbp
mov rdx, r14
mov rax, rdi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
jmp rax
Function at 0x18002a0d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x110
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov ecx, dword [0x180335888]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180341854], ecx
jle 0x18002a221
lea rcx, [0x180341854]
call fcn.1801a9d00
cmp dword [0x180341854], 0xffffffff
jne 0x18002a221
movdqa xmm0, xmmword [0x180271be0]
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmm1, xmmword [0x1802718e0]
movdqa xmmword [rsp + 0xa0], xmm1
movdqa xmm0, xmmword [0x180271bd0]
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmm1, xmmword [0x180271ba0]
movdqa xmmword [rsp + 0xc0], xmm1
movdqa xmm0, xmmword [0x1802727c0]
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmm1, xmmword [0x180271b90]
movdqa xmmword [rsp + 0xe0], xmm1
movdqa xmm0, xmmword [0x180272890]
movdqa xmmword [rsp + 0xf0], xmm0
mov dword [rsp + 0x100], 0x131303
xor edx, edx
nop
movzx eax, byte [rsp + 0x90]
xor byte [rsp + rdx + 0x91], al
movzx eax, byte [rsp + 0x90]
xor byte [rsp + rdx + 0x92], al
add rdx, 2
cmp rdx, 0x72
jb 0x18002a1b0
mov byte [rsp + 0x103], 0
mov dword [rsp + 0x20], 0
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rsp + 0x91]
call fcn.180068750
movsxd rdx, dword [rax + 1]
add rax, 5
add rax, rdx
mov qword [0x180341858], rax
lea rcx, [0x180341854]
call fcn.1801a9ca0
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x80], rax
mov eax, dword [rsp + 0x1a0]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x70], rax
movss xmm0, dword [rsp + 0x190]
movss dword [rsp + 0x68], xmm0
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x58], rax
movss xmm0, dword [rsp + 0x178]
movss dword [rsp + 0x50], xmm0
mov dword [rsp + 0x48], 2
mov byte [rsp + 0x40], 0
movss xmm0, dword [rsp + 0x160]
movss dword [rsp + 0x38], xmm0
movss xmm1, dword [rsp + 0x158]
movss dword [rsp + 0x30], xmm1
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x140]
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call qword [0x180341858]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18002b210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov ecx, dword [0x180335888]
mov rax, qword gs:[0x58]
mov edx, 4
mov rbx, qword [rax + rcx*8]
add rbx, rdx
mov eax, dword [rbx]
cmp dword [0x180341870], eax
jle 0x18002b2f4
lea rcx, [0x180341870]
call fcn.1801a9d00
cmp dword [0x180341870], 0xffffffff
jne 0x18002b2f4
movdqa xmm0, xmmword [0x180271d10]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180271d90]
movdqu xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [str.__Y______]
movdqu xmmword [rsp + 0x50], xmm0
xor edx, edx
nop dword [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x31], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x32], al
add rdx, 2
cmp rdx, 0x2e
jb 0x18002b2a0
mov byte [rsp + 0x5f], 0
mov dword [rsp + 0x20], 0
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rsp + 0x31]
call fcn.180068750
mov qword [0x180341898], rax
lea rcx, [0x180341870]
call fcn.1801a9ca0
mov eax, dword [rbx]
cmp dword [0x180341888], eax
jle 0x18002b338
lea rcx, [0x180341888]
call fcn.1801a9d00
cmp dword [0x180341888], 0xffffffff
jne 0x18002b338
mov rdx, qword [0x180341898]
movsxd rax, dword [rdx + 1]
add rdx, 5
add rdx, rax
mov qword [0x180341890], rdx
lea rcx, [0x180341888]
call fcn.1801a9ca0
mov dword [rsp + 0x90], 7
mov r9d, 3
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
jmp qword [0x180341890]
Function at 0x180031380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x88
mov ecx, dword [0x180335888]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180336f20], ecx
jle 0x18003145e
lea rcx, [0x180336f20]
call fcn.1801a9d00
cmp dword [0x180336f20], 0xffffffff
jne 0x18003145e
movdqa xmm0, xmmword [0x180272580]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x180272690]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x180271f30]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1802726a0]
movdqa xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0x4f435748
xor eax, eax
mov byte [rsp + 0x74], al
xor edx, edx
nop
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x31], al
inc rdx
cmp rdx, 0x43
jb 0x180031410
mov byte [rsp + 0x74], 0
mov dword [rsp + 0x20], 0
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rsp + 0x31]
call fcn.180068750
add rax, 0x15
mov qword [0x180336ed8], rax
lea rcx, [0x180336f20]
call fcn.1801a9ca0
mov rax, qword [0x180336ed8]
add rsp, 0x88
ret
Function at 0x18003ac50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov edx, dword [0x180335888]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rdi, qword [rax + rdx*8]
add rdi, rcx
mov eax, dword [rdi]
cmp dword [0x180336fe0], eax
jle 0x18003ad14
lea rcx, [0x180336fe0]
call fcn.1801a9d00
cmp dword [0x180336fe0], 0xffffffff
jne 0x18003ad14
movdqa xmm0, xmmword [0x180272a30]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [str.xhxxhpxhwh_r_nhx_t]
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
nop dword [rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x31], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x32], al
add rdx, 2
cmp rdx, 0x1e
jb 0x18003acc0
mov byte [rsp + 0x4f], 0
mov dword [rsp + 0x20], 2
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rsp + 0x31]
call fcn.180068750
mov qword [0x180336fc8], rax
lea rcx, [0x180336fe0]
call fcn.1801a9ca0
mov rax, qword [0x180336fc8]
test rax, rax
je 0x18003ad24
mov ecx, dword [rax]
jmp 0x18003ad26
xor ecx, ecx
mov dword [rbx], ecx
mov eax, dword [rdi]
cmp dword [0x180336fe4], eax
jle 0x18003adc4
lea rcx, [0x180336fe4]
call fcn.1801a9d00
cmp dword [0x180336fe4], 0xffffffff
jne 0x18003adc4
movdqa xmm0, xmmword [0x1802726e0]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [str.YIYYIQYIVI_IX_]
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
nop dword [rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x31], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rdx + 0x32], al
add rdx, 2
cmp rdx, 0x1e
jb 0x18003ad70
mov byte [rsp + 0x4f], 0
mov dword [rsp + 0x20], 2
mov r9, qword [0x1803367d0]
mov r8, qword [0x1803367c8]
lea rdx, [rsp + 0x31]
call fcn.180068750
mov qword [0x180336fd0], rax
lea rcx, [0x180336fe4]
call fcn.1801a9ca0
mov rax, qword [0x180336fd0]
test rax, rax
je 0x18003ade3
mov eax, dword [rax]
mov dword [rbx + 4], eax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov dword [rbx + 4], 0
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret