joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140154240
Capabilities:
Allocate or change rwx memory
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [0x1410d4598]
test rcx, rcx
jne 0x140154271
xor r8d, r8d
lea edx, [rcx + 1]
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r8, rax
mov qword [0x1410d4598], rax
jmp 0x140154281
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r8, qword [0x1410d4598]
mov edi, 0x30
cmp rbx, rdi
cmovae rdi, rbx
mov rbx, qword [0x1410d45b0]
add rdi, 0x17
and rdi, 0xfffffffffffffff8
test rbx, rbx
je 0x1401542b0
cmp qword [rbx + 0x20], rdi
jae 0x140154305
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1401542a1
lea rbx, [rdi + 0x1000f]
mov qword [rsp + 0x30], rsi
and rbx, 0xffffffffffff0000
mov r9d, 0x40
mov rdx, rbx
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140154377
mov rcx, qword [0x1410d4598]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x20]
lea rax, [rdi + 0x40]
cmp rcx, rax
jbe 0x140154327
sub rcx, rdi
mov qword [rbx + 0x20], rcx
add rbx, rcx
mov qword [rbx + 8], rcx
mov qword [rbx + rdi + 8], rdi
jmp 0x140154355
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x140154338
mov rax, qword [rbx + 0x18]
mov qword [rdx + 0x18], rax
mov rdx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x10]
test rdx, rdx
je 0x14015434b
mov qword [rdx + 0x10], rax
jmp 0x140154352
mov qword [0x1410d45b0], rax
mov rdi, rcx
add qword [0x1410d45b8], rdi
mov rcx, r8
mov qword [rbx], rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea rax, [rbx + 0x10]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
sub rbx, 0x10
add qword [0x1410d45c0], rbx
mov qword [rax + 8], rdx
lea rax, [rdi + 0x40]
cmp rbx, rax
jbe 0x1401543d2
mov rcx, qword [0x1410d45b0]
lea rax, [rsi + rdi]
add qword [0x1410d45b8], rdi
sub rbx, rdi
mov qword [rsi], rdi
mov qword [rax + 8], rdi
mov qword [rax], rdx
mov qword [rax + 0x20], rbx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rdx
test rcx, rcx
je 0x1401543c5
mov qword [rcx + 0x18], rax
mov qword [0x1410d45b0], rax
lea rcx, [rbx + rax]
jmp 0x1401543e0
add qword [0x1410d45b8], rbx
lea rcx, [rsi + rbx]
mov qword [rsi], rbx
mov qword [rcx], 1
mov qword [rcx + 8], rbx
mov rcx, qword [0x1410d4598]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rbx, qword [rsp + 0x38]
lea rax, [rsi + 0x10]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14015ff3c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14015ff4f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14016a248
lea rdx, [0x1410c6ff8]
lea rcx, [rsp + 0x20]
call fcn.14017cc44
int3

Function at 0x14016ac20
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1410d5620]
xor edx, edx
jmp fcn.14015ff3c
Function at 0x14016b610
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1410d5620]
jmp fcn.14015ff3c

Function at 0x14018e490
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14018e264
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14018e264
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14018e264
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14018e264
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14018e264
cmp dword [rcx + 0x84], 0xe
jbe 0x14018e264
cmp dword [rcx + 0xf8], esi
je 0x14018e264
mov ecx, r14d
call fcn.14018e3ac
mov ecx, 2
call fcn.14018b8e8
nop
cmp byte [0x1410d5c60], 0
jne 0x14018e32e
mov r15d, 1
mov eax, r15d
xchg dword [0x1410d5c50], eax
test ebx, ebx
jne 0x14018e2d7
mov rdi, qword [0x1410cc870]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x1410d5c58]
cmp rcx, rax
je 0x14018e2ce
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400073f0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1410d5d78]
jmp 0x14018e2e3
cmp ebx, r15d
jne 0x14018e2e9
lea rcx, [0x1410d5d90]
call fcn.14018ebfc
nop
test ebx, ebx
jne 0x14018e300
lea rdx, [0x1401aea28]
lea rcx, [0x1401aea00]
call fcn.14018eec4
lea rdx, [0x1401aea38]
lea rcx, [0x1401aea30]
call fcn.14018eec4
movzx eax, byte [0x1410d5c60]
test esi, esi
cmove eax, r15d
mov byte [0x1410d5c60], al
jmp 0x14018e32e
mov ecx, 2
call fcn.14018b93c
test esi, esi
jne 0x14018e345
mov ecx, r14d
call fcn.14018e360
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14018e1f4
Function at 0x14019124c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1401910ec
call fcn.14017f798
mov dword [rax], 0x16
call fcn.14017f194
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401910d4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1401910d4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x14019111e
lock or dword [rax + 0x14], 0x10
jmp 0x1401910d4
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x14019113b
mov rcx, qword [rbp + 0x10]
call fcn.140192498
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14018a6ec
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140188974
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140191192
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1401910d4
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1401911fe
mov rcx, qword [rbp + 0x10]
call fcn.14018a6ec
cmp eax, 0xffffffff
je 0x1401911e5
mov rcx, qword [rbp + 0x10]
call fcn.14018a6ec
cmp eax, 0xfffffffe
je 0x1401911e5
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14018a6ec
movsxd rdi, eax
lea rsi, [0x1410d5dd0]
mov rcx, rbx
sar rdi, 6
call fcn.14018a6ec
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1401911ec
lea rax, [0x1410ccd70]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401911fe
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140191234
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140191230
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140191230
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1401910d7
jmp 0x1401910a4
Function at 0x1800068b0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x138
mov rax, qword [0x18005c010]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r10, rcx
test rcx, rcx
je 0x1800069fb
mov eax, 0xff
lea rdx, [rsp + 0x20]
nop
mov byte [rdx], 0
lea rdx, [rdx + 1]
sub rax, 1
jne 0x1800068e0
movzx eax, byte [rcx]
xor edx, edx
mov r9d, edx
test al, al
je 0x180006917
lea r8, [rsp + 0x20]
sub r8, r10
cmp al, 0x2e
je 0x180006917
mov byte [r8 + rcx], al
inc r9d
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x180006901
movsxd rax, r9d
lea r8, [rax + r10]
test r8, r8
je 0x1800069fb
mov word [rsp + rax + 0x20], 0x642e
inc r8
lea eax, [r9 + 2]
movsxd rcx, eax
movzx eax, byte [r8]
mov word [rsp + rcx + 0x20], 0x6c6c
cmp al, 0x23
jne 0x1800069b8
movzx eax, byte [r8 + 1]
mov r10d, 1
cmp al, 0x2d
jne 0x180006961
movzx eax, byte [r8 + 2]
mov r10d, 0xffffffff
mov r9, rdx
sete r9b
inc r9
add r9, r8
cmp al, 0x30
jl 0x18000698d
cmp al, 0x39
ja 0x18000698d
movzx eax, al
lea edx, [rdx + rdx*4]
inc r9
lea edx, [rdx - 0x18]
lea edx, [rax + rdx*2]
movzx eax, byte [r9]
cmp al, 0x30
jge 0x180006972
imul r10d, edx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, r10d
call fcn.180006a20
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180015f20
add rsp, 0x138
ret
test al, al
je 0x1800069d4
nop dword [rax]
rol edx, 7
lea r8, [r8 + 1]
movsx eax, al
xor edx, eax
movzx eax, byte [r8]
test al, al
jne 0x1800069c0
mov r8d, edx
lea rcx, [rsp + 0x20]
xor edx, edx
call fcn.180006a20
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180015f20
add rsp, 0x138
ret
xor eax, eax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180015f20
add rsp, 0x138
ret
Function at 0x180006a20
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov edi, r8d
mov rbx, rcx
cmp edx, 1
jne 0x180006a4d
mov r9, qword [0x18005f418]
test r9, r9
jne case.default.0x180006a75
jmp 0x180006af3
test rcx, rcx
jne 0x180006af8
lea eax, [rdx - 1]
cmp eax, 0xd
ja case.default.0x180006a75
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x6c3c]
add rcx, rdx
jmp rcx
mov rbx, qword [0x18005f410]
jmp 0x180006af3
mov rbx, qword [0x18005f408]
jmp 0x180006af3
mov rbx, qword [0x18005f400]
jmp 0x180006af3
mov rbx, qword [0x18005f3f8]
jmp 0x180006af3
mov rbx, qword [0x18005f3f0]
jmp 0x180006af3
mov rbx, qword [0x18005f3e8]
jmp 0x180006af3
mov rbx, qword [0x18005f3e0]
jmp 0x180006af3
mov rbx, qword [0x18005f3d8]
jmp 0x180006af3
mov rbx, qword [0x18005f3d0]
jmp 0x180006af3
mov rbx, qword [0x18005f3c8]
jmp 0x180006af3
mov rbx, qword [0x18005f3c0]
jmp 0x180006af3
mov rbx, qword [0x18005f3b8]
jmp 0x180006af3
mov rbx, qword [0x18005f3b0]
jmp 0x180006af3
mov rbx, qword [0x18005f3a8]
test rbx, rbx
je case.default.0x180006a75
cmp byte [rbx], 0
je case.default.0x180006a75
mov edx, 1
xor ecx, ecx
mov r8d, 0xa48d6762
lea r9d, [rdx + 0x2a]
call fcn.180006c80
mov rcx, rbx
call rax
mov r9, rax
test rax, rax
jne case.default.0x180006a75
lea edx, [rax + 1]
xor ecx, ecx
lea r9d, [rax + 2]
mov r8d, 0xc8ac8026
call fcn.180006c80
mov rcx, rbx
call rax
mov r9, rax
test edi, edi
jne 0x180006b4e
mov rax, r9
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [r9 + 0x3c]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov ebx, dword [rax + r9 + 0x88]
mov ebp, dword [rax + r9 + 0x8c]
add rbx, r9
mov eax, edi
shr eax, 0x10
test ax, ax
jne 0x180006b84
movzx eax, di
sub eax, dword [rbx + 0x10]
jmp 0x180006c02
mov r8d, dword [rbx + 0x20]
xor r10d, r10d
mov r11d, dword [rbx + 0x24]
add r8, r9
mov esi, dword [rbx + 0x18]
add r11, r9
test esi, esi
je 0x180006be7
nop dword [rax]
mov edx, dword [r8]
add rdx, r9
jne 0x180006baf
mov eax, 0xffffffff
jmp 0x180006bd3
movzx ecx, byte [rdx]
xor eax, eax
test cl, cl
je 0x180006bd3
nop dword [rax + rax]
rol eax, 7
lea rdx, [rdx + 1]
movsx ecx, cl
xor eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x180006bc0
cmp eax, edi
je 0x180006bfe
add r8, 4
add r11, 2
inc r10d
cmp r10d, esi
jb 0x180006ba0
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx eax, word [r11]
test eax, eax
js 0x180006be7
mov ecx, dword [rbx + 0x1c]
add rcx, r9
movsxd rdx, eax
mov r8d, dword [rcx + rdx*4]
add r8, r9
cmp r8, rbx
jbe 0x180006c31
mov rdx, r8
sub rdx, rbx
cmp rdx, rbp
jae 0x180006c31
mov rcx, r8
call fcn.1800068b0
mov r8, rax
test r8, r8
je 0x180006be7
mov rax, r8
jmp 0x180006be9
Function at 0x180006c80
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18005f420]
test rax, rax
je 0x180006ccf
cmp r9d, 0x21c
jg 0x180006ccf
mov qword [rsp + 0x20], rbx
movsxd rbx, r9d
mov rax, qword [rax + rbx*8]
test rax, rax
jne 0x180006cc5
lea edx, [rax + 1]
xor ecx, ecx
call fcn.180006a20
mov rcx, rax
mov rax, qword [0x18005f420]
mov qword [rax + rbx*8], rcx
mov rax, rcx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov edx, 1
xor ecx, ecx
add rsp, 0x28
jmp fcn.180006a20
Function at 0x180007340
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x80
movdqa xmm0, xmmword [0x180052f10]
mov edx, 0x3bd09a55
movdqa xmm1, xmmword [0x180052ef0]
mov qword [rax + 8], rbx
mov rbx, qword [0x18005f3a0]
movdqu xmmword [rax - 0x38], xmm0
mov qword [rax + 0x18], rdi
movdqa xmm0, xmmword [0x180052ee0]
movdqu xmmword [rax - 0x28], xmm1
mov qword [rax + 0x20], r14
movdqa xmm1, xmmword [0x180052ed0]
movdqu xmmword [rax - 0x18], xmm0
movdqa xmm0, xmmword [0x180052ec0]
movdqu xmmword [rax - 0x68], xmm1
movdqa xmm1, xmmword [0x180052f00]
movdqu xmmword [rax - 0x58], xmm0
movdqu xmmword [rax - 0x48], xmm1
call fcn.180007e70
mov edx, 0xc9
mov r8d, 2
mov rcx, rbx
call rax
xor esi, esi
mov r14d, dword [rax]
mov edi, dword [rax + 4]
add r14, rbx
test edi, edi
jne 0x1800073dd
mov r10d, esi
jmp 0x180007477
mov qword [rsp + 0x98], rbp
mov rbx, rsi
call fcn.180007660
test rax, rax
je 0x180007425
mov r8, rdi
mov rcx, rax
mov rbp, rdi
call fcn.180007780
mov rbx, rax
mov r10, rax
test rax, rax
je 0x180007425
nop dword [rax + rax]
mov byte [rbx], sil
lea rbx, [rbx + 1]
sub rbp, 1
jne 0x180007410
mov rax, rdi
mov rbx, r10
jmp 0x180007430
mov r10, rbx
mov rax, rdi
test rbx, rbx
je 0x180007443
mov byte [rbx], sil
lea rbx, [rbx + 1]
sub rax, 1
jne 0x180007430
lea rdx, [r14 + 0x67]
jmp 0x18000744c
lea rdx, [r14 + 0x67]
test rbx, rbx
je 0x18000746f
test rdx, rdx
je 0x18000746f
mov rcx, r10
sub rdx, r10
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub edi, 1
jne 0x180007460
mov rbp, qword [rsp + 0x98]
mov r14, qword [rsp + 0xa8]
mov r8d, esi
mov rdi, qword [rsp + 0xa0]
mov r9, r10
mov rbx, qword [rsp + 0x90]
movabs r11, 0xaaaaaaaaaaaaaaab
nop
movsxd rcx, r8d
lea r9, [r9 + 1]
mov rax, r11
inc r8d
mul rcx
shr rdx, 3
lea rax, [rdx + rdx*2]
shl rax, 2
sub rcx, rax
movzx eax, byte [rsp + rcx*4 + 0x20]
xor byte [r9 - 1], al
cmp r8d, 0x12e00
jb 0x1800074a0
mov r9, r10
nop dword [rax]
nop dword [rax + rax]
movsxd r8, esi
lea r9, [r9 + 1]
mov rax, r11
inc esi
mul r8
shr rdx, 3
lea rcx, [rdx + rdx*2]
shl rcx, 2
sub r8, rcx
movzx ecx, byte [rsp + r8*4 + 0x50]
xor byte [r9 - 1], cl
cmp esi, 0x12e00
jb 0x1800074e0
mov rax, r10
add rsp, 0x80
pop rsi
ret
Function at 0x180007540
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
mov rdi, qword [0x18005f420]
test rdi, rdi
je 0x180007568
mov r10, qword [rdi + 0x48]
mov bpl, 1
test r10, r10
jne 0x180007640
jmp 0x18000756b
xor bpl, bpl
mov r11, qword [0x18005f418]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], r14
movsxd rax, dword [r11 + 0x3c]
mov ebx, dword [rax + r11 + 0x88]
mov r14d, dword [rax + r11 + 0x8c]
add rbx, r11
mov r8d, dword [rbx + 0x20]
mov r10d, dword [rbx + 0x24]
add r8, r11
mov esi, dword [rbx + 0x18]
add r10, r11
test esi, esi
je 0x180007625
mov edx, dword [r8]
add rdx, r11
je 0x1800075db
movzx ecx, byte [rdx]
xor eax, eax
test cl, cl
je 0x1800075db
rol eax, 7
lea rdx, [rdx + 1]
movsx ecx, cl
xor eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x1800075c1
cmp eax, 0x697a6afe
je 0x1800075ed
add r8, 4
add r10, 2
inc r9d
cmp r9d, esi
jb 0x1800075b0
jmp 0x180007625
movzx edx, word [r10]
mov ecx, dword [rbx + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
cmp r10, rbx
jbe 0x180007620
mov rdx, r10
sub rdx, rbx
cmp rdx, r14
jae 0x180007620
mov rcx, r10
call fcn.1800068b0
mov rdi, qword [0x18005f420]
mov r10, rax
test r10, r10
jne 0x180007628
xor r10d, r10d
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test bpl, bpl
je 0x180007640
mov qword [rdi + 0x48], r10
xor ecx, ecx
mov edx, 0x10e8
mov r8d, 0x3000
lea r9d, [rcx + 4]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
jmp r10

Function at 0x180007660
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
mov rbx, qword [0x18005f420]
test rbx, rbx
je 0x18000768b
mov rcx, qword [rbx + 0x4a8]
mov bpl, 1
test rcx, rcx
jne 0x18000776d
jmp 0x18000768e
xor bpl, bpl
mov r11, qword [0x18005f418]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
movsxd rax, dword [r11 + 0x3c]
mov edi, dword [rax + r11 + 0x88]
mov r14d, dword [rax + r11 + 0x8c]
add rdi, r11
mov r8d, dword [rdi + 0x20]
mov r10d, dword [rdi + 0x24]
add r8, r11
mov esi, dword [rdi + 0x18]
add r10, r11
test esi, esi
je 0x180007750
mov edx, dword [r8]
add rdx, r11
je 0x18000770a
movzx ecx, byte [rdx]
xor eax, eax
test cl, cl
je 0x18000770a
nop dword [rax]
nop dword [rax + rax]
rol eax, 7
lea rdx, [rdx + 1]
movsx ecx, cl
xor eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x1800076f0
cmp eax, 0x68807354
je 0x18000771c
add r8, 4
add r10, 2
inc r9d
cmp r9d, esi
jb 0x1800076d3
jmp 0x180007750
mov ecx, dword [rdi + 0x1c]
movzx edx, word [r10]
add rcx, r11
mov ecx, dword [rcx + rdx*4]
add rcx, r11
cmp rcx, rdi
jbe 0x18000774b
mov rdx, rcx
sub rdx, rdi
cmp rdx, r14
jae 0x18000774b
call fcn.1800068b0
mov rbx, qword [0x18005f420]
mov rcx, rax
test rcx, rcx
jne 0x180007752
xor ecx, ecx
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
test bpl, bpl
je 0x18000776d
mov qword [rbx + 0x4a8], rcx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
jmp rcx
Function at 0x180007780
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x18005f420]
mov r14, r8
mov r15, rcx
test rdi, rdi
je 0x1800077b5
mov r9, qword [rdi + 0x4b0]
mov bpl, 1
test r9, r9
jne 0x180007893
jmp 0x1800077b8
xor bpl, bpl
mov r11, qword [0x18005f418]
xor r9d, r9d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r12
movsxd rax, dword [r11 + 0x3c]
mov ebx, dword [rax + r11 + 0x88]
mov r12d, dword [rax + r11 + 0x8c]
add rbx, r11
mov r8d, dword [rbx + 0x20]
mov r10d, dword [rbx + 0x24]
add r8, r11
mov esi, dword [rbx + 0x18]
add r10, r11
test esi, esi
je 0x180007875
nop dword [rax]
mov edx, dword [r8]
add rdx, r11
je 0x18000782b
movzx ecx, byte [rdx]
xor eax, eax
test cl, cl
je 0x18000782b
rol eax, 7
lea rdx, [rdx + 1]
movsx ecx, cl
xor eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x180007811
cmp eax, 0x5550b067
je 0x18000783d
add r8, 4
add r10, 2
inc r9d
cmp r9d, esi
jb 0x180007800
jmp 0x180007875
mov ecx, dword [rbx + 0x1c]
movzx edx, word [r10]
add rcx, r11
mov r9d, dword [rcx + rdx*4]
add r9, r11
cmp r9, rbx
jbe 0x180007870
mov rdx, r9
sub rdx, rbx
cmp rdx, r12
jae 0x180007870
mov rcx, r9
call fcn.1800068b0
mov rdi, qword [0x18005f420]
mov r9, rax
test r9, r9
jne 0x180007878
xor r9d, r9d
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
test bpl, bpl
je 0x180007893
mov qword [rdi + 0x4b0], r9
mov r8, r14
xor edx, edx
mov rcx, r15
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp r9

Function at 0x1800078b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov rsi, rcx
mov r8d, dword [rax + rcx + 0x88]
test r8d, r8d
jne 0x1800078d4
xor eax, eax
add rsp, 0x28
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rbx
lea rax, [rcx + r8]
mov ebx, dword [rax + 0x20]
mov qword [rsp + 0x48], rdi
add rbx, rsi
mov edi, dword [rax + 0x24]
mov qword [rsp + 0x50], r12
add rdi, rsi
mov qword [rsp + 0x58], r14
xor r12d, r12d
mov r14d, dword [rax + 0x1c]
mov r11d, r12d
mov qword [rsp + 0x20], r15
add r14, rsi
mov r15d, dword [rax + 0x18]
test r15, r15
je 0x18000796b
mov r9d, dword [rbx]
mov rcx, rdx
call fcn.180007520
mov r10, rax
add r9, rsi
je 0x18000795b
test rdx, rdx
je 0x18000795b
test rax, rax
je 0x18000796b
mov r8, rdx
mov rcx, r9
sub r8, r9
nop dword [rax]
movzx eax, byte [rcx]
cmp al, byte [rcx + r8]
jb 0x18000795b
ja 0x18000795b
inc rcx
mov rax, rcx
sub rax, r9
cmp rax, r10
jb 0x180007940
jmp 0x18000796b
inc r11
add rbx, 4
add rdi, 2
cmp r11, r15
jb 0x180007913
movzx eax, word [rdi]
mov r15, qword [rsp + 0x20]
cmp r12w, ax
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
jae 0x18000798c
lea r14, [r14 + rax*4]
mov eax, dword [r14]
mov r14, qword [rsp + 0x58]
add rax, rsi
add rsp, 0x28
pop rsi
pop rbp
ret
Function at 0x180007e70
Capabilities:
Access peb ldr_data
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword gs:[0x60]
mov ebx, edx
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x20]
test r8, r8
je 0x180007ed1
nop dword [rax]
mov r9, qword [r8 + 0x50]
xor edx, edx
movzx r10d, word [r8 + 0x48]
nop dword [rax + rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
ror edx, 0xd
mov eax, edx
add rax, rcx
cmp cl, 0x61
lea rdx, [rax - 0x20]
cmovb rdx, rax
sub r10, 1
jne 0x180007ea0
cmp edx, 0x6a4abc5b
je 0x180007ed9
mov r8, qword [r8]
test r8, r8
jne 0x180007e90
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov r10, qword [r8 + 0x20]
movsxd rax, dword [r10 + 0x3c]
mov r11d, dword [rax + r10 + 0x88]
mov r8d, dword [r11 + r10 + 0x20]
mov r9d, dword [r11 + r10 + 0x24]
add r8, r10
add r9, r10
nop dword [rax]
mov edx, dword [r8]
add rdx, r10
xor eax, eax
movzx ecx, byte [rdx]
nop dword [rax + rax]
ror eax, 0xd
lea rdx, [rdx + 1]
movsx ecx, cl
add eax, ecx
movzx ecx, byte [rdx]
test cl, cl
jne 0x180007f10
cmp eax, ebx
je 0x180007f31
add r8, 4
add r9, 2
jmp 0x180007f00
mov ecx, dword [r11 + r10 + 0x1c]
movzx edx, word [r9]
add rcx, r10
mov rbx, qword [rsp + 8]
mov eax, dword [rcx + rdx*4]
add rax, r10
ret