joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001210
Capabilities:
Create process on windows
Create process suspended
Resume thread

Disassembly:
push rdi
sub rsp, 0x100
lea rax, str.C:Program_Files__x86_Windows_NTAccessorieswordpad.exe
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.140001000
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1400010a4
movzx eax, al
test eax, eax
je 0x14000130d
mov dword [rsp + 0x90], 0x68
lea rax, [rsp + 0x98]
mov rdi, rax
xor eax, eax
mov ecx, 0x60
rep stosb byte [rdi], al
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:WindowsSystem32_notepad.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14000130b
mov r8d, 0x176
lea rdx, [0x1400060a0]
mov rcx, qword [rsp + 0x70]
call fcn.1400010ec
movzx eax, al
test eax, eax
je 0x1400012f4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140001329
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.14000134c
nop
mov eax, 1
jmp 0x140001340
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.14000134c
nop
xor eax, eax
add rsp, 0x100
pop rdi
ret

Function at 0x140001acc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b16
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b16
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b16
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b16
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b16
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b18
xor al, al
add rsp, 0x28
ret
Function at 0x18002aa54
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
mov rdi, qword [0x180156b28]
mov r12d, dword [rdx + 0x10]
mov rbp, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x18002aa99
mov rbp, qword [rdx]
mov al, byte [rdi]
neg al
sbb r8, r8
and r8d, 0x10
add r8, 0x10
add r8, rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r11d, dword [rcx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x18002ab1e
mov r10d, dword [r11 + 0x18]
test r10d, r10d
je 0x18002ab1e
mov r15d, dword [r11 + 0x20]
dec r10d
lea rcx, [r15 + r10*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov esi, 0xf5539855
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x18002ab19
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x18002aafd
cmp esi, 0x7ee3413a
je 0x18002ab23
test r10d, r10d
jne 0x18002aae1
mov rax, qword [rax]
jmp 0x18002aabc
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [r11 + 0x24]
add rax, r9
movzx eax, word [rax + r10*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r8
xor r9d, r9d
mov r8d, r12d
mov rdx, rbp
mov rcx, qword [rdi + 8]
call r10
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18002ab91
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18002ab8c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002abc7
mov rcx, r8
call fcn.1800d0680
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], select
mov byte [rbx], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800d0660
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1800d939c
int3
Function at 0x18002bbe0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
xor r12d, r12d
mov r15d, dword [rdx + 0x10]
mov rsi, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x18002bc21
mov rsi, qword [rdx]
mov al, byte [r12]
neg al
sbb r11, r11
and r11d, 0x10
add r11, 0x10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x18002bca5
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x18002bca5
mov r14d, dword [r10 + 0x20]
dec r9d
lea rcx, [r14 + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov edi, 0xf5539855
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x18002bca0
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x18002bc84
cmp edi, 0x7ee3413a
je 0x18002bcaa
test r9d, r9d
jne 0x18002bc68
mov rax, qword [rax]
jmp 0x18002bc43
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [r10 + 0x24]
add rax, r8
movzx eax, word [rax + r9*2]
mov r10d, dword [rcx + rax*4]
add r10, r8
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], r11
xor r9d, r9d
mov r8d, r15d
mov rdx, rsi
mov rcx, qword [ioctlsocket]
call r10
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18002bd1c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18002bd17
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002bd51
mov rcx, r8
call fcn.1800d0680
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], select
mov byte [rbx], r12b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800d0660
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1800d939c
int3
Function at 0x18002c7c4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18002c7e4
xor eax, eax
jmp 0x18002c8ca
cmp qword [rcx + 0x68], 0
je 0x18002c7f5
call fcn.18002d83c
jmp 0x18002c8ca
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18002c80c
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18002c80e
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18002c840
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.1800f9180
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18002c8c4
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18002c877
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x18002c8a0
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1800d8b8c
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x18002c8c4
cmp rdi, rbx
ja 0x18002c87e
test rdi, rdi
je 0x18002c8c4
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.1800d8b8c
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180030f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x180030fa0
movzx eax, byte [rcx + r9]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x180030f82
mov rax, r8
ret
Function at 0x180033eac
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov qword [r11 - 0x18], rcx
mov rax, qword [0x180156bf0]
test rax, rax
jne 0x180033f80
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov r9, r11
mov rdx, qword [r9 + 0x30]
movsxd rax, dword [rdx + 0x3c]
mov r8d, dword [rax + rdx + 0x88]
add r8, rdx
cmp r8, rdx
je 0x180033f65
mov ecx, dword [r8 + 0x18]
test ecx, ecx
je 0x180033f65
mov r14d, dword [r8 + 0x20]
dec ecx
mov esi, ecx
lea rax, [r14 + rcx*4]
mov r10d, dword [rax + rdx]
add r10, rdx
mov edi, 0x25e22bce
mov al, byte [r10]
inc r10
test al, al
je 0x180033f61
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x180033f40
cmp edi, 0x65e60154
je 0x180034002
test ecx, ecx
jne 0x180033f22
mov rax, qword [r9]
mov r9, rax
cmp rax, r11
je 0x180033f77
cmp qword [rax + 0x30], 0
jne 0x180033efe
xor eax, eax
mov qword [0x180156bf0], rax
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180033f8d
mov rcx, qword [rbx]
call rax
cmp eax, 0xffffffff
setne dil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180033fcc
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180033fc7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003401f
mov rcx, r8
call fcn.1800d0680
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], select
mov byte [rbx], 0
mov al, dil
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800d0660
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov ecx, dword [r8 + 0x1c]
add rcx, rdx
mov eax, dword [r8 + 0x24]
add rax, rdx
movzx eax, word [rax + rsi*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
jmp 0x180033f79
call fcn.1800d939c
int3
Function at 0x180034028
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rax, qword [0x180156bf8]
mov rbx, rcx
mov qword [rsp + 0x38], r15
test rax, rax
jne 0x18003410f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800340f4
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x1800340f4
mov r14d, dword [r9 + 0x20]
dec ecx
mov edi, 0xd1e902d5
mov esi, ecx
lea rax, [r14 + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x1800340f0
movsx eax, al
xor eax, edi
imul edi, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x1800340cf
cmp edi, 0x81b03302
je 0x18003418f
test ecx, ecx
jne 0x1800340b1
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x180034105
cmp qword [rax + 0x30], r15
jne 0x18003408d
mov rax, r15
mov qword [0x180156bf8], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x8000
lea rcx, [0x1801009b8]
call rax
test eax, eax
jne 0x1800341ec
mov r9, qword [rsp + 0x38]
lea rdx, [rsp + 0x60]
mov r8d, 0x104
xor ecx, ecx
mov qword [rsp + 0x20], r8
call fcn.1800d9b1c
xorps xmm0, xmm0
lea rax, [rsp + 0x60]
xorps xmm1, xmm1
or r9, 0xffffffffffffffff
movups xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
inc r9
cmp byte [rax + r9], r15b
jne 0x180034163
lea rax, [rsp + 0x60]
add rax, r9
lea rcx, [rsp + 0x60]
cmp rcx, rax
jne 0x1800341ac
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
jmp 0x1800341bb
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rsi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180034108
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180035760
movups xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x40]
mov word [rsp + 0x40], r15w
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx], xmm0
movdqa xmm0, xmmword [0x180139ec0]
movdqu xmmword [rsp + 0x50], xmm0
movups xmmword [rbx + 0x10], xmm1
call fcn.180032bc0
jmp 0x180034202
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
mov rax, rbx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.1800d0660
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180034230
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x170
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
and dword [rsp + 0x20], 0
mov rax, qword [0x180156c00]
test rax, rax
jne 0x180034312
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov r10, rdi
mov rdx, qword [r10 + 0x30]
movsxd rax, dword [rdx + 0x3c]
mov r8d, dword [rax + rdx + 0x88]
add r8, rdx
cmp r8, rdx
je 0x1800342f7
mov r9d, dword [r8 + 0x18]
test r9d, r9d
je 0x1800342f7
mov r14d, dword [r8 + 0x20]
dec r9d
lea rax, [r14 + r9*4]
mov ecx, dword [rax + rdx]
add rcx, rdx
mov r11d, 0x7d8129d2
mov al, byte [rcx]
inc rcx
test al, al
je 0x1800342f2
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x1800342cf
cmp r11d, 0xff926e2
je 0x180034376
test r9d, r9d
jne 0x1800342b3
mov rax, qword [r10]
mov r10, rax
cmp rax, rdi
je 0x180034309
cmp qword [rax + 0x30], 0
jne 0x18003428e
xor eax, eax
mov qword [0x180156c00], rax
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call rax
mov r8d, eax
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x18], 0
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.18002fba0
mov dword [rsp + 0x20], 1
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18003435a
mov rcx, qword [rbx]
or r9, 0xffffffffffffffff
test rdx, rdx
je 0x1800343a7
lea rax, [rdx - 1]
mov r8, r9
cmp rax, r9
cmovb r8, rax
add r8, rcx
jmp 0x18003439c
mov ecx, dword [r8 + 0x1c]
add rcx, rdx
mov eax, dword [r8 + 0x24]
add rax, rdx
movzx eax, word [rax + r9*2]
mov eax, dword [rcx + rax*4]
add rax, rdx
jmp 0x18003430b
cmp r8, rcx
je 0x1800343a7
dec r8
cmp byte [r8], 0x5c
jne 0x180034394
sub r8, rcx
jmp 0x1800343aa
mov r8, r9
cmp r8, r9
je 0x180034424
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
cmp rdx, r8
cmovb r8, rdx
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1800343d4
mov rdx, qword [rbx]
lea rcx, [rsp + 0x28]
call fcn.18002fba0
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.18002dc90
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x180034424
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003441f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180034451
call fcn.1800d0680
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800d0660
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.1800d939c
int3
Function at 0x180035e24
Capabilities:
Access peb ldr_data
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rbx, rcx
mov qword [rbp + 0x17], rcx
xor r15d, r15d
mov dword [rbp - 0x49], r15d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], r15
mov qword [rcx + 8], r15
mov qword [rcx + 0x10], r15
lea eax, [r15 + 1]
mov dword [rbp - 0x49], eax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x10]
movsxd rdx, dword [rcx + 0x3c]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x10]
movzx r14d, word [rdx + rcx + 6]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x10]
movsxd rdx, dword [rcx + 0x3c]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x10]
movzx r8d, word [rdx + rcx + 0x14]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x10]
movsxd rax, dword [rcx + 0x3c]
add r8, rax
mov rax, qword gs:[0x60]
mov rdi, qword [rax + 0x10]
add rdi, 0x18
add rdi, r8
movzx esi, r15w
cmp r15w, r14w
jae 0x180036024
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], r15
mov qword [rbp + 0x37], r15
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], r15b
jne 0x180035f08
mov rdx, rdi
lea rcx, [rbp + 0x1f]
call fcn.18002fba0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0xf
cmova rdx, qword [rbp + 0x1f]
mov r8, qword [rbp + 0x2f]
lea rcx, [rbp - 0x39]
call fcn.18002fc60
movups xmm2, xmmword [rdi]
movaps xmmword [rbp - 0x19], xmm2
movups xmm3, xmmword [rdi + 0x10]
movaps xmmword [rbp - 9], xmm3
movsd xmm4, qword [rdi + 0x20]
movsd qword [rbp + 7], xmm4
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x180035f97
movaps xmm0, xmmword [rbp - 0x39]
movups xmmword [rdx], xmm0
movaps xmm1, xmmword [rbp - 0x29]
movups xmmword [rdx + 0x10], xmm1
mov eax, select
mov byte [rbp - 0x39], r15b
movups xmmword [rdx + 0x20], xmm2
movups xmmword [rdx + 0x30], xmm3
movsd qword [rdx + 0x40], xmm4
add qword [rbx + 8], 0x48
jmp 0x180035fa7
lea r8, [rbp - 0x39]
mov rcx, rbx
call fcn.18003fe8c
mov rax, qword [rbp - 0x21]
cmp rax, 0xf
jbe 0x180035fdc
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180035fd6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036050
call fcn.1800d0680
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 0xf
jbe 0x180036013
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003600e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036056
call fcn.1800d0680
inc si
add rdi, 0x28
cmp si, r14w
jb 0x180035ef5
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1800d0660
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1800d939c
nop
call fcn.1800d939c
int3
Function at 0x180036200
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword gs:[0x60]
mov rsi, rcx
xorps xmm0, xmm0
xor ebx, ebx
mov rcx, qword [rax + 0x10]
mov rax, qword gs:[0x60]
movsxd r8, dword [rcx + 0x3c]
mov rcx, qword [rax + 0x10]
xor eax, eax
mov edi, dword [r8 + rcx + 0x50]
lea rcx, [rsp + 0x28]
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
call fcn.180035d2c
mov rax, qword gs:[0x60]
xor edx, edx
mov r10, qword [rsp + 0x30]
mov r8, qword [rsp + 0x28]
sub r10, r8
mov rbp, qword [rax + 0x10]
sar r10, 2
sub rdi, r10
je 0x1800362b2
xor r9d, r9d
test r10, r10
je 0x1800362ad
xor eax, eax
mov r11d, dword [r8 + rax*4]
lea eax, [r9 + rdx]
movzx eax, byte [rax + rbp]
cmp eax, r11d
je 0x1800362a2
cmp r11d, 0xffffffff
jne 0x18003630f
inc r9d
mov eax, r9d
cmp rax, r10
jb 0x18003628b
mov ebx, edx
add rbx, rbp
mov qword [rsi], rbx
test r8, r8
je 0x1800362ef
mov rdx, qword [rsp + 0x38]
mov rax, r8
sub rdx, r8
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x1800362e7
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003631e
mov rcx, r8
call fcn.1800d0680
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800d0660
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
inc edx
mov eax, edx
cmp rax, rdi
jb 0x180036281
jmp 0x1800362b2
call fcn.1800d939c
int3
Function at 0x18003cf2c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x180156c40]
mov rbx, rcx
mov qword [rsp + 0x20], rcx
test rax, rax
jne 0x18003cffc
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18003cfdc
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x18003cfdc
mov esi, dword [r9 + 0x20]
dec ecx
mov ebx, 0x10ae4ef1
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x18003cfd8
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x18003cfbb
cmp ebx, 0xf830c77f
je 0x18003d02e
test ecx, ecx
jne 0x18003cf9d
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x18003cfee
cmp qword [rax + 0x30], 0
jne 0x18003cf79
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov qword [0x180156c40], rax
lea r9, [rsp + 0x28]
mov edx, 1
mov r8d, 0x120
mov rcx, rbx
call rax
mov rdx, qword [0x180157318]
cmp rdx, qword [0x180157320]
je 0x18003d048
mov qword [rdx], rbx
add qword [0x180157318], 8
jmp 0x18003d059
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x18003cff0
lea r8, [rsp + 0x20]
lea rcx, [0x180157310]
call fcn.180030e18
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d0660
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret