joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007e030
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, r8
mov rbx, rdx
mov rsi, rcx
lea rcx, [rsp + 0x58]
mov r8d, 0xb
mov rdx, rax
call fcn.18007dcf0
mov dword [rsp + 0x38], 0x800
mov dword [rsp + 0x3c], 0
mov rcx, qword [0x180219958]
test rcx, rcx
jne 0x18007e090
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18007e1cb
mov rcx, rax
mov qword [0x180219958], rax
mov r8d, 0x800
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18007e1cb
mov r14, rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x800
mov qword [rsp + 0x50], 0
mov rdi, qword [rsp + 0x58]
lea r13, [rsp + 0x38]
lea r15, [rsp + 0x3c]
lea r12, [rsp + 0x40]
nop word cs:[rax + rax]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, r15
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x18007e128
mov r8d, dword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
sub rax, rdx
cmp rax, r8
jae 0x18007e0e0
mov rcx, r12
call fcn.18017fd30
mov r14, qword [rsp + 0x40]
jmp 0x18007e0e0
test eax, eax
jne 0x18007e159
mov eax, dword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 0xb
jbe 0x18007e1ad
movabs rax, 0xde00000002
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
cmp qword [rsp + 0x48], 0
jne 0x18007e170
jmp 0x18007e182
shl rax, 0x20
or rax, 2
mov qword [rsi], rax
mov byte [rsi + 0x18], 0xc
cmp qword [rsp + 0x48], 0
je 0x18007e182
mov rcx, qword [0x180219958]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x60], 0
je 0x18007e19c
mov rcx, qword [0x180219958]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x10], rcx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
mov byte [rsi + 0x18], al
cmp qword [rsp + 0x60], 0
jne 0x18007e18a
jmp 0x18007e19c
mov ecx, 1
mov edx, 0x800
call fcn.18017ea70
ud2
Function at 0x18008f6a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18008f6c0
test al, 1
je 0x18008f891
test al, 2
jne 0x18008f891
test al, 8
jne 0x18008f7e5
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x18008f73d
xorps xmm6, xmm6
test eax, eax
jne 0x18008f769
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rbx + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.18008f580
mov byte [rsi + 0xa8], 4
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x18008f7c9
test eax, eax
jne 0x18008f803
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rdi + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x18008f803
test al, 0x10
je 0x18008f803
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x18008f891
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118a30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18008f891
jne 0x18008f884
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x18008f845
call fcn.18008f8a0
lea rcx, [rsi + 0x30]
call fcn.18008f580
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x18008f864
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x180219958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x180090ec0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180090ee0
test al, 1
je 0x1800910b1
test al, 2
jne 0x1800910b1
test al, 8
jne 0x180091005
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x180090f5d
xorps xmm6, xmm6
test eax, eax
jne 0x180090f89
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rbx + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.18008f580
mov byte [rsi + 0xa8], 4
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x180090fe9
test eax, eax
jne 0x180091023
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rdi + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x180091023
test al, 0x10
je 0x180091023
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x1800910b1
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180117aa0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800910b1
jne 0x1800910a4
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180091065
call fcn.1800572b0
lea rcx, [rsi + 0x30]
call fcn.18008f580
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x180091084
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x180219958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x180091790
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800917a0
test al, 1
je 0x180091841
test al, 2
jne 0x180091841
test al, 8
jne 0x1800917da
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.180091f90
jmp 0x1800917f4
test al, 0x10
je 0x1800917f4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x180091841
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118a30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180091841
jne 0x180091837
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.180091850
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x180092160
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180092170
test al, 1
je 0x180092211
test al, 2
jne 0x180092211
test al, 8
jne 0x1800921aa
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.180091f90
jmp 0x1800921c4
test al, 0x10
je 0x1800921c4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x180092211
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180117aa0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180092211
jne 0x180092207
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.180092220
nop
add rsp, 0xa0
pop rsi
ret
ud2

Function at 0x180094350
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180094370
test al, 1
je 0x180094542
test al, 2
jne 0x180094542
test al, 8
jne 0x180094496
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800943ed
xorps xmm6, xmm6
test eax, eax
jne 0x180094419
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rbx + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.180094250
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x18009447a
test eax, eax
jne 0x1800944b4
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rdi + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x1800944b4
test al, 0x10
je 0x1800944b4
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180094542
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118a30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x180094542
jne 0x180094535
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800944f6
call fcn.18008f8a0
lea rcx, [rsi + 0x30]
call fcn.180094250
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180094515
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x180219958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1800951c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800951e0
test al, 1
je 0x1800953b2
test al, 2
jne 0x1800953b2
test al, 8
jne 0x180095306
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x18009525d
xorps xmm6, xmm6
test eax, eax
jne 0x180095289
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rbx + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.180094250
mov qword [rsi + 0x30], 0xc
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800952ea
test eax, eax
jne 0x180095324
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rdi + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x180095324
test al, 0x10
je 0x180095324
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x1800953b2
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180117aa0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800953b2
jne 0x1800953a5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x180095366
call fcn.1800572b0
lea rcx, [rsi + 0x30]
call fcn.180094250
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x180095385
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x180219958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1800991c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800991d0
test al, 1
je 0x18009925d
test al, 2
jne 0x18009925d
test al, 8
jne 0x180099202
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.180099790
jmp 0x180099216
test al, 0x10
je 0x180099216
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x18009925d
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118a30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x18009925d
jne 0x180099256
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.180099270
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x180099930
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x180099940
test al, 1
je 0x1800999cd
test al, 2
jne 0x1800999cd
test al, 8
jne 0x180099972
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x28], 0x3b9aca01
lea rdx, [rsp + 0x20]
call fcn.180099790
jmp 0x180099986
test al, 0x10
je 0x180099986
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x1800999cd
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180117aa0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800999cd
jne 0x1800999c6
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800999e0
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800b20c0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b20e0
test al, 1
je 0x1800b22b2
test al, 2
jne 0x1800b22b2
test al, 8
jne 0x1800b2206
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800b215d
xorps xmm6, xmm6
test eax, eax
jne 0x1800b2189
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rbx + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.1800b2000
mov qword [rsi + 0x30], 3
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800b21ea
test eax, eax
jne 0x1800b2224
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rdi + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x1800b2224
test al, 0x10
je 0x1800b2224
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b22b2
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118a30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b22b2
jne 0x1800b22a5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800b2266
call fcn.18008f8a0
lea rcx, [rsi + 0x30]
call fcn.1800b2000
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b2285
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x180219958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2
Function at 0x1800b2fd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b2ff0
test al, 1
je 0x1800b31c2
test al, 2
jne 0x1800b31c2
test al, 8
jne 0x1800b3116
mov rdi, qword [rsi + 0x28]
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800b306d
xorps xmm6, xmm6
test eax, eax
jne 0x1800b3099
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rbx, qword [rcx + rax*8]
lea rcx, [rbx + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rbx + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xe8]
mov qword [rax + 0xe8], 1
mov qword [rax + 0xf0], rdi
lea rcx, [rsi + 0x30]
call fcn.1800b2000
mov qword [rsi + 0x30], 3
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movzx eax, byte [rax + 0x118]
cmp eax, 1
je 0x1800b30fa
test eax, eax
jne 0x1800b3134
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx + rax*8]
lea rcx, [rdi + 0xc8]
lea rdx, [0x180111950]
call fcn.1800fe400
mov byte [rdi + 0x118], 1
mov eax, dword [0x1802199d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmmword [rax + 0xe8], xmm6
jmp 0x1800b3134
test al, 0x10
je 0x1800b3134
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b31c2
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180117aa0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b31c2
jne 0x1800b31b5
mov rcx, qword [rsi + 0x20]
lock dec qword [rcx]
jne 0x1800b3176
call fcn.1800572b0
lea rcx, [rsi + 0x30]
call fcn.1800b2000
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x1800b3195
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x180219958]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_HeapFree]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
ud2

Function at 0x1800b3ab0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b3ac0
test al, 1
je 0x1800b3b4a
test al, 2
jne 0x1800b3b4a
test al, 8
jne 0x1800b3aef
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800b3910
jmp 0x1800b3b03
test al, 0x10
je 0x1800b3b03
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800b3b4a
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118a30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b3b4a
jne 0x1800b3b43
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800b3b50
nop
add rsp, 0x50
pop rsi
ret
ud2
Function at 0x1800b4050
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b4060
test al, 1
je 0x1800b40ea
test al, 2
jne 0x1800b40ea
test al, 8
jne 0x1800b408f
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x48], 5
lea rdx, [rsp + 0x28]
call fcn.1800b3910
jmp 0x1800b40a3
test al, 0x10
je 0x1800b40a3
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x1800b40ea
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180117aa0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b40ea
jne 0x1800b40e3
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1800b40f0
nop
add rsp, 0x50
pop rsi
ret
ud2

Function at 0x1800b9ae0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800b9af0
test al, 1
je 0x1800b9b92
test al, 2
jne 0x1800b9b92
test al, 8
jne 0x1800b9b2b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800b9940
jmp 0x1800b9b45
test al, 0x10
je 0x1800b9b45
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800b9b92
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118a30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800b9b92
jne 0x1800b9b88
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800b9ba0
nop
add rsp, 0x210
pop rsi
ret
ud2

Function at 0x1800ba0e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x210
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800ba0f0
test al, 1
je 0x1800ba192
test al, 2
jne 0x1800ba192
test al, 8
jne 0x1800ba12b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 7
lea rdx, [rsp + 0x28]
call fcn.1800b9940
jmp 0x1800ba145
test al, 0x10
je 0x1800ba145
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x1800ba192
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180117aa0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800ba192
jne 0x1800ba188
mov rcx, rsi
add rsp, 0x210
pop rsi
jmp fcn.1800ba1a0
nop
add rsp, 0x210
pop rsi
ret
ud2
Function at 0x1800cb5a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800cb5b0
test al, 1
je 0x1800cb652
test al, 2
jne 0x1800cb652
test al, 8
jne 0x1800cb5eb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800cbb90
jmp 0x1800cb605
test al, 0x10
je 0x1800cb605
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800cb652
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180118a30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800cb652
jne 0x1800cb648
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800cb660
nop
add rsp, 0xfa0
pop rsi
ret
ud2

Function at 0x1800cbd20
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xfa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1800cbd30
test al, 1
je 0x1800cbdd2
test al, 2
jne 0x1800cbdd2
test al, 8
jne 0x1800cbd6b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
call fcn.1800cbb90
jmp 0x1800cbd85
test al, 0x10
je 0x1800cbd85
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x1800cbdd2
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.180117aa0
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1800cbdd2
jne 0x1800cbdc8
mov rcx, rsi
add rsp, 0xfa0
pop rsi
jmp fcn.1800cbde0
nop
add rsp, 0xfa0
pop rsi
ret
ud2