joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180078230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x70
cmp qword [rcx + 0xdf0], 0
mov rbx, rcx
movaps xmmword [rsp + 0x60], xmm6
movaps xmm6, xmm1
movaps xmmword [rsp + 0x50], xmm7
movaps xmm7, xmm2
jne 0x180078271
mov r8d, 0x5f0
lea rdx, str.C:UsersTomoaDownloadsMelody_V1_1.18.12ImGuiimgui.cpp
lea rcx, str.Ctx___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
cmp byte [rbx + 0x37a9], 0
mov rbp, qword [rbx + 0xdf0]
je 0x180078440
movss xmm1, dword [0x1800de3d4]
xorps xmm2, xmm2
comiss xmm7, xmm1
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x90], r14
jbe 0x1800782c5
comiss xmm7, xmm2
cvttss2si eax, xmm7
jae 0x1800782be
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm7
jp 0x1800782bc
je 0x1800782be
dec eax
movd xmm7, eax
cvtdq2ps xmm7, xmm7
comiss xmm6, xmm1
jbe 0x1800782ea
comiss xmm6, xmm2
cvttss2si eax, xmm6
jae 0x1800782e3
movd xmm0, eax
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm6
jp 0x1800782e1
je 0x1800782e3
dec eax
movd xmm6, eax
cvtdq2ps xmm6, xmm6
lea r14, [rbp + 0x3e80]
mov qword [rsp + 0x88], rdi
mov ebx, dword [r14]
sub ebx, 1
movsxd rsi, ebx
js 0x180078341
imul rdi, rsi, 0x1c
cmp ebx, dword [r14]
jl 0x180078327
mov r8d, 0x732
lea rdx, str.C:UsersTomoaDownloadsMelody_V1_1.18.12ImGuiimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 8]
cmp dword [rdi + rax], 1
je 0x1800783d7
dec ebx
sub rdi, 0x1c
sub rsi, 1
jns 0x180078308
movsd xmm0, qword [rbp + 0xe00]
lea rax, [rsp + 0x28]
movsd qword [rsp + 0x28], xmm0
movss xmm0, dword [rax]
ucomiss xmm0, xmm6
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
movss xmm1, dword [rax + 4]
jp 0x18007837f
jne 0x18007837f
ucomiss xmm1, xmm7
jp 0x18007837f
je 0x180078438
mov eax, dword [rbp + 0x3ea4]
mov dword [rsp + 0x38], eax
inc eax
mov dword [rbp + 0x3ea4], eax
mov ecx, dword [r14]
mov r8d, dword [r14 + 4]
mov eax, dword [rbp + 0x3ea0]
movss dword [rsp + 0x3c], xmm6
movss dword [rsp + 0x40], xmm7
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x44], eax
cmp ecx, r8d
jne 0x18007840d
inc ecx
test r8d, r8d
je 0x1800783f9
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1800783fe
movss xmm0, dword [rdi + rax + 0xc]
movss xmm1, dword [rdi + rax + 0x10]
lea rax, [rsp + 0x20]
movss dword [rsp + 0x20], xmm0
movss dword [rsp + 0x24], xmm1
jmp 0x180078354
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, r14
call fcn.180092030
movsxd rax, dword [r14]
movups xmm0, xmmword [rsp + 0x30]
movsd xmm1, qword [rsp + 0x40]
imul rcx, rax, 0x1c
mov rax, qword [r14 + 8]
movups xmmword [rcx + rax], xmm0
movsd qword [rcx + rax + 0x10], xmm1
mov dword [rcx + rax + 0x18], 0
inc dword [r14]
mov r14, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x70
pop rbp
ret
Function at 0x18007af60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x180173960]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4ac1], 0
jne 0x18007afc8
cmp byte [rbx + 0x4ac2], 0
jne 0x18007afc8
movsx r9d, word [rbx + 0x5bf4]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1800810f0
test sil, 2
je 0x18007b100
jmp 0x18007b061
movss xmm1, dword [rbx + 0x3894]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1800d38f0]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x1800d1128]
addss xmm0, dword [rbx + 0xe00]
addss xmm1, dword [rbx + 0xe04]
or dword [rbx + 0x47e8], 1
mov qword [rbx + 0x4800], rax
movss dword [rbx + 0x47f8], xmm0
mov dword [rbx + 0x47ec], 1
movss dword [rbx + 0x47fc], xmm1
movss xmm0, dword [rbx + 0x38fc]
mov rax, qword [0x180173960]
mulss xmm0, dword [0x1800d0df0]
or dword [rax + 0x47e8], 0x40
movss dword [rax + 0x4848], xmm0
movsx r9d, word [rbx + 0x5bf4]
call fcn.1800810f0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x18007b0b1
lea r11, [0x1800d8410]
cmp r9b, 0x23
jne 0x18007b094
cmp byte [r8], r9b
jne 0x18007b094
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18007b081
not ecx
call fcn.18007f4b0
test rax, rax
je 0x18007b100
cmp byte [rax + 0xb6], 0
je 0x18007b100
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bf4]
movsx r9d, word [rbx + 0x5bf4]
call fcn.1800810f0
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.180078950
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x18007f410
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180173960]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18007f473
mov qword [rsp], rbx
lea rbx, [0x1800d8410]
nop dword [rax]
cmp r9b, 0x23
jne 0x18007f453
cmp byte [r8], r9b
jne 0x18007f453
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18007f440
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c50]
not eax
mov r8, qword [r10 + 0x5c58]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18007f49f
cmp dword [r8 + 8], eax
je 0x18007f4a6
add r8, 0x48
cmp r8, rcx
jne 0x18007f490
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x1800800e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xf0], 0
mov rsi, rcx
movsxd rdi, edx
jg 0x18008011c
mov r8d, 0x73b
lea rdx, str.C:UsersTomoaDownloadsMelody_V1_1.18.12ImGuiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rsi + 0xf8]
lea rdx, [0x1800d8410]
movsxd r8, dword [rsi + 0xf0]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [rsi]
not ebx
cmp dword [rcx + 0x3f50], ebx
jne 0x180080199
xor r9d, r9d
mov r8, rdi
mov ecx, ebx
lea edx, [r9 + 4]
call fcn.18007d250
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180080250
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xf0], 0
mov rdi, rdx
mov rbx, rcx
jg 0x180080283
mov r8d, 0x73b
lea rdx, str.C:UsersTomoaDownloadsMelody_V1_1.18.12ImGuiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm2, dword [rbx + 0x110]
lea r9, [0x1800d8410]
movss xmm0, dword [rdi]
movsxd rcx, dword [rbx + 0xf0]
subss xmm0, xmm2
mov rax, qword [rbx + 0xf8]
movss xmm3, dword [rbx + 0x114]
movss xmm1, dword [rdi + 4]
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x20]
movss xmm0, dword [rdi + 8]
movzx ecx, r8b
subss xmm0, xmm2
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x21]
movss dword [rsp + 0x24], xmm1
movss xmm1, dword [rdi + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x22]
movss dword [rsp + 0x28], xmm0
movss dword [rsp + 0x2c], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x23]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x24]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x25]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x26]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x27]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x28]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x29]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2a]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2b]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2c]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
mov rbx, qword [rsp + 0x40]
xor rcx, rax
movzx eax, byte [rsp + 0x2d]
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x2e]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0x2f]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x30
pop rdi
ret
Function at 0x180081290
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800812ed
lea rbx, [0x1800d8410]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800812d4
cmp r10, 2
jb 0x1800812d4
cmp byte [r9], r8b
jne 0x1800812d4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1800812b0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18008132f
lea rbx, [0x1800d8410]
cmp r8b, 0x23
jne 0x180081313
cmp byte [r9], r8b
jne 0x180081313
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180081300
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180083150
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ce0], 0
lea rbx, [rcx + 0x5ce8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1800831f7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1800831aa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180091d10
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180091690
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ce0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cf0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180173968]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1800831ff
mov rcx, rbx
call fcn.180091690
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18008c050
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x180173960]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5c3c], ecx
test rbx, rbx
je 0x18008c0bf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.18008c0d0
lea rdx, [0x1800ddebc]
mov rcx, rbx
mov rdi, rax
call fcn.180080f20
mov rbx, rax
test rax, rax
je 0x18008c0ba
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x18008feb0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x180173960]
cmp byte [rbx + 0x5c38], 0
jne 0x180090028
cmp dword [rbx + 0x5c60], 0
je 0x18008feed
mov r8d, 0x3299
lea rdx, str.C:UsersTomoaDownloadsMelody_V1_1.18.12ImGuiimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x180090021
lea rdx, [0x1800ddeb8]
mov qword [rsp + 0x40], rdi
call fcn.180080f20
mov rdi, rax
test rax, rax
je 0x18009001c
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x180090009
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180090009
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x180090009
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180090009
cmp rsi, 0xffffffffffffffff
je 0x180090009
mov rax, qword [0x180173960]
test rax, rax
je 0x18008ff93
inc dword [rax + 0xf0]
mov rdx, qword [0x180173970]
mov rcx, rsi
call qword [0x180105290]
mov rbp, rax
test rax, rax
je 0x180090009
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rsi
je 0x18008ffcf
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18008ffe5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x18008ffe5
mov rdx, rsi
mov rcx, rbp
call fcn.180082c90
mov rax, qword [0x180173960]
test rax, rax
je 0x18008fff7
dec dword [rax + 0xf0]
mov rdx, qword [0x180173970]
mov rcx, rbp
call qword [0x180105298]
jmp 0x180090012
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x5c38], 1
movss xmm0, dword [rbx + 0x5c3c]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x180090079
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5c3c], xmm0
jb 0x180090079
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x180090068
call fcn.18008c050
mov dword [rbx + 0x5c3c], 0
add rsp, 0x20
pop rbx
ret
mov byte [rbx + 0xd6], 1
mov dword [rbx + 0x5c3c], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1800ae560
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdx, qword [0x180173de0]
test rdx, rdx
jne 0x1800ae624
mov edx, 3
lea rcx, str.48_8B_15_________4C_8B_02_4C_89_06_40_84_FF_74___48_8B_CD_E8_________48_8B_C6_48_8B_4C_24___48_33_CC_E8_________48_8B_5C_24___48_8B_6C_24___48_8B_74_24___48_83_C4___5F_C3_B9_________E8_________CC_E8_________CC_CC_CC_CC_CC_CC_CC_CC_CC_CC_CC_48_89_5C_24___48_89_6C_24___56
call fcn.1800bfb10
mov qword [0x180173de0], rax
lea r8, [rsp + 0x20]
mov byte [rsp + 0x20], 0xe
mov r9, rax
mov byte [rsp + 0x21], 0x22
xor eax, eax
mov byte [rsp + 0x22], 0x26
xor edx, edx
mov byte [rsp + 0x23], 0x35
mov byte [rsp + 0x24], 0x3f
mov byte [rsp + 0x25], 0x26
mov byte [rsp + 0x26], 0x69
mov byte [rsp + 0x27], 0x74
mov byte [rsp + 0x28], 0x70
mov byte [rsp + 0x29], 0x3a
mov byte [rsp + 0x2a], 0x3b
mov byte [rsp + 0x2b], 0
mov byte [rsp + 0x2c], al
movzx eax, byte [rsp + 0x20]
nop
movzx eax, byte [r8]
lea ecx, [rdx + 0x4d]
xor cl, al
lea r8, [r8 + 1]
movsxd rax, edx
inc edx
mov byte [rsp + rax + 0x20], cl
cmp edx, 0xc
jb 0x1800ae5f0
mov rdx, r9
mov byte [rsp + 0x2c], 0
lea rcx, [rsp + 0x20]
call fcn.1800be830
mov rdx, qword [0x180173de0]
mov rax, qword [0x180173da0]
mov rcx, qword [0x1801739d0]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0x58
mov rbx, qword [rax]
add rbx, rdx
call fcn.1800b9080
test al, al
jne 0x1800ae67a
mov qword [0x180173c40], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c2730
add rsp, 0x50
pop rbx
ret
lea rcx, [rsp + 0x30]
nop
mov rdx, qword [rcx]
lea rax, [rcx + 8]
lea r8, [rsp + 0x48]
mov rcx, rax
cmp rax, r8
je 0x1800ae69a
mov rbx, qword [rdx + rbx]
jmp 0x1800ae680
mov rax, qword [rdx + rbx]
mov qword [0x180173c40], rax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c2730
add rsp, 0x50
pop rbx
ret
Function at 0x1800af710
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rdx
mov qword [rcx], rdx
mov rbx, rcx
mov edx, 8
mov rcx, rdi
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1800af800
mov byte [rbp - 0x28], 0x4d
lea r9, [rbp - 0x28]
mov byte [rbp - 0x27], 0x6b
xor eax, eax
mov byte [rbp - 0x26], 0x70
xor ecx, ecx
mov byte [rbp - 0x25], 0x66
mov byte [rbp - 0x24], 0x64
mov byte [rbp - 0x23], 0x60
mov byte [rbp - 0x22], 0x6e
mov byte [rbp - 0x21], 0x2b
mov byte [rbp - 0x20], 0x6a
mov byte [rbp - 0x1f], 0x78
mov byte [rbp - 0x1e], 0x60
mov byte [rbp - 0x1d], 0x6c
mov byte [rbp - 0x1c], 0x64
mov byte [rbp - 0x1b], 0x78
mov byte [rbp - 0x1a], 0x7d
mov byte [rbp - 0x19], 0x7d
mov byte [rbp - 0x18], 0x34
mov byte [rbp - 0x17], 0x65
mov byte [rbp - 0x16], 0x79
mov byte [rbp - 0x15], 0x7e
mov byte [rbp - 0x14], 0x76
mov byte [rbp - 0x13], 0x6d
mov byte [rbp - 0x12], 0x7f
mov byte [rbp - 0x11], 0x69
mov byte [rbp - 0x10], 0x3d
mov byte [rbp - 0xf], al
movzx eax, byte [rbp - 0x28]
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r8d, [rcx + 4]
xor r8b, dl
lea r9, [r9 + 1]
movsxd rdx, ecx
inc ecx
mov byte [rbp + rdx - 0x28], r8b
cmp ecx, 0x19
jb 0x1800af7d0
lea rcx, [rbp - 0x28]
mov byte [rbp - 0xf], 0
call fcn.1800be830
jmp 0x1800af8ab
lea r8, [rbx + 8]
mov rdx, rsi
mov rcx, rdi
call fcn.1800bffe8
mov r9d, eax
test eax, eax
jne 0x1800af820
cmp rdi, 0xa
jg 0x1800af8ab
mov byte [rbp - 0x40], 0x49
lea r8, [rbp - 0x40]
mov byte [rbp - 0x3f], 0x4d
xor eax, eax
mov byte [rbp - 0x3e], 0x59
xor ecx, ecx
mov byte [rbp - 0x3d], 0x44
mov byte [rbp - 0x3c], 0x7a
mov byte [rbp - 0x3b], 0x6c
mov byte [rbp - 0x3a], 0x6b
mov byte [rbp - 0x39], 0x7f
mov byte [rbp - 0x38], 0x69
mov byte [rbp - 0x37], 0x45
mov byte [rbp - 0x36], 0x61
mov byte [rbp - 0x35], 0x60
mov byte [rbp - 0x34], 0x7b
mov byte [rbp - 0x33], 0x31
mov byte [rbp - 0x32], 0x2f
mov byte [rbp - 0x31], 0x33
mov byte [rbp - 0x30], 0x31
mov byte [rbp - 0x2f], 0x7c
mov byte [rbp - 0x2e], al
movzx eax, byte [rbp - 0x40]
nop word [rax + rax]
movzx eax, byte [r8]
lea edx, [rcx + 4]
xor dl, al
lea r8, [r8 + 1]
movsxd rax, ecx
inc ecx
mov byte [rbp + rax - 0x40], dl
cmp ecx, 0x12
jb 0x1800af880
mov edx, r9d
mov byte [rbp - 0x2e], 0
lea rcx, [rbp - 0x40]
call fcn.1800be830
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800af8d0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x18016ffc0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, rdx
mov qword [rcx], rdx
mov rbx, rcx
mov edx, 8
mov rcx, rax
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x1800af9c0
mov byte [rbp - 0x28], 0x4d
lea r9, [rbp - 0x28]
mov byte [rbp - 0x27], 0x6b
xor eax, eax
mov byte [rbp - 0x26], 0x70
xor ecx, ecx
mov byte [rbp - 0x25], 0x66
mov byte [rbp - 0x24], 0x64
mov byte [rbp - 0x23], 0x60
mov byte [rbp - 0x22], 0x6e
mov byte [rbp - 0x21], 0x2b
mov byte [rbp - 0x20], 0x6a
mov byte [rbp - 0x1f], 0x78
mov byte [rbp - 0x1e], 0x60
mov byte [rbp - 0x1d], 0x6c
mov byte [rbp - 0x1c], 0x64
mov byte [rbp - 0x1b], 0x78
mov byte [rbp - 0x1a], 0x7d
mov byte [rbp - 0x19], 0x7d
mov byte [rbp - 0x18], 0x34
mov byte [rbp - 0x17], 0x65
mov byte [rbp - 0x16], 0x79
mov byte [rbp - 0x15], 0x7e
mov byte [rbp - 0x14], 0x76
mov byte [rbp - 0x13], 0x6d
mov byte [rbp - 0x12], 0x7f
mov byte [rbp - 0x11], 0x69
mov byte [rbp - 0x10], 0x3d
mov byte [rbp - 0xf], al
movzx eax, byte [rbp - 0x28]
nop word [rax + rax]
movzx edx, byte [r9]
lea r8d, [rcx + 4]
xor r8b, dl
lea r9, [r9 + 1]
movsxd rdx, ecx
inc ecx
mov byte [rbp + rdx - 0x28], r8b
cmp ecx, 0x19
jb 0x1800af990
lea rcx, [rbp - 0x28]
mov byte [rbp - 0xf], 0
call fcn.1800be830
jmp 0x1800afa6b
mov rcx, qword [rbx]
lea r8, [rbx + 8]
mov rdx, rdi
call fcn.1800bffe8
mov r9d, eax
test eax, eax
jne 0x1800af9e0
cmp qword [rbx], 0xa
jg 0x1800afa6b
mov byte [rbp - 0x40], 0x49
lea r8, [rbp - 0x40]
mov byte [rbp - 0x3f], 0x4d
xor eax, eax
mov byte [rbp - 0x3e], 0x59
xor ecx, ecx
mov byte [rbp - 0x3d], 0x44
mov byte [rbp - 0x3c], 0x7a
mov byte [rbp - 0x3b], 0x6c
mov byte [rbp - 0x3a], 0x6b
mov byte [rbp - 0x39], 0x7f
mov byte [rbp - 0x38], 0x69
mov byte [rbp - 0x37], 0x45
mov byte [rbp - 0x36], 0x61
mov byte [rbp - 0x35], 0x60
mov byte [rbp - 0x34], 0x7b
mov byte [rbp - 0x33], 0x31
mov byte [rbp - 0x32], 0x2f
mov byte [rbp - 0x31], 0x33
mov byte [rbp - 0x30], 0x31
mov byte [rbp - 0x2f], 0x7c
mov byte [rbp - 0x2e], al
movzx eax, byte [rbp - 0x40]
nop word [rax + rax]
movzx eax, byte [r8]
lea edx, [rcx + 4]
xor dl, al
lea r8, [r8 + 1]
movsxd rax, ecx
inc ecx
mov byte [rbp + rax - 0x40], dl
cmp ecx, 0x12
jb 0x1800afa40
mov edx, r9d
mov byte [rbp - 0x2e], 0
lea rcx, [rbp - 0x40]
call fcn.1800be830
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800c2730
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x88]
add rsp, 0x60
pop rbp
ret
Function at 0x1800b7b20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
add rcx, 0x10
xor edx, edx
jmp fcn.1800b0530
Function at 0x1800b97c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rdi, rdx
mov rbx, rcx
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov r8d, dword [0x180174948]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x180174410], eax
jg 0x1800b9912
cmp qword [0x180174418], 0
jne 0x1800b9835
lea rdx, str.48_8D_0D_________FF_50___48_8B_D8_48_8B_50___48_85_D2_0F_84_________8B_42___85_C0_0F_84_________8D_48___F0_0F_B1_4A___74___85_C0_0F_84_________EB___48_8B_03_48_8B_5B___48_89_44_24___48_89_5C_24___48_8D_54_24___48_8D_0D_________E8_________BE
lea rcx, [0x1800cc6b0]
call fcn.1800bf760
movsxd rcx, dword [rax + 3]
add rax, 7
add rax, rcx
mov qword [0x180174418], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180002290
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1800088f0
movabs rcx, 0xcbf29ce484222325
mov qword [rsp + 0x40], rcx
cmp qword [rsp + 0x58], 0
jbe 0x1800b98bb
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rdx, qword [rsp + 0x48]
movzx eax, byte [rdx]
movabs r8, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
imul rcx, r8
movsx rax, al
xor rcx, rax
mov qword [rsp + 0x40], rcx
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x1800b98a0
lea r8, [rsp + 0x40]
mov rdx, qword [0x180174418]
mov rcx, rbx
call qword [0x180174408]
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x1800b9901
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800b9901
inc rax
cmp rax, 0x1000
jb 0x1800b98fa
mov rcx, qword [rcx - 8]
mov qword [rsp + 0x48], rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
lea rcx, [0x180174410]
call fcn.1800c28fc
cmp dword [0x180174410], 0xffffffff
jne 0x1800b9806
lea rdx, str.48_89_5C_24___48_89_74_24___48_89_4C_24___57_48_83_EC___4C_8B_CA
lea rcx, [0x1800cc6b0]
call fcn.1800bf760
mov qword [0x180174408], rax
lea rcx, [0x180174410]
call fcn.1800c2890
jmp 0x1800b9806