joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8800
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4b8a99
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xa8], rax
nop
lea rax, [0x004d4cc0]
call fcn.0040c6a0
mov qword [rsp + 0x70], rax
mov qword [rax + 8], 9
lea rcx, [0x004e06ea]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004d4cc0]
call fcn.0040c6a0
mov qword [rsp + 0x68], rax
mov qword [rax + 8], 8
lea rcx, [0x004e047a]
mov qword [rax], rcx
mov byte [rax + 0x10], 1
nop
lea rax, [0x004d4c00]
call fcn.0040c6a0
cmp dword [0x00657010], 0
jne 0x4b8897
mov rcx, qword [rsp + 0x70]
jmp 0x4b88a4
call fcn.004612e0
mov rcx, qword [rsp + 0x70]
mov qword [r11], rcx
mov qword [rsp + 0x60], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xd
lea rcx, [0x004e14ec]
mov qword [rax], rcx
nop
lea rax, [0x004d4c00]
call fcn.0040c6a0
cmp dword [0x00657010], 0
jne 0x4b88e0
mov rcx, qword [rsp + 0x68]
jmp 0x4b88ed
call fcn.004612e0
mov rcx, qword [rsp + 0x68]
mov qword [r11], rcx
mov qword [rsp + 0x58], rax
mov qword [rax + 0x18], rcx
mov qword [rax + 8], 0xc
lea rcx, [0x004e106c]
mov qword [rax], rcx
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rcx
lea rax, [0x004c5680]
call fcn.0040c6a0
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], 0x3000
mov qword [rax + 0x18], 0x40
mov rbx, rax
mov edi, 4
mov rax, qword [rsp + 0x58]
mov rcx, rdi
call fcn.004b18e0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
jbe 0x4b8a8e
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rcx
lea rax, [0x004c5620]
call fcn.0040c6a0
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x90]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0xb0]
mov qword [rax + 0x10], rcx
mov rbx, rax
mov ecx, 3
mov rdi, rcx
mov rax, qword [rsp + 0x60]
nop dword [rax]
call fcn.004b18e0
movzx ecx, word [0x00656da4]
mov word [rsp + 0x3e], cx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x88], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x80], rdx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x78], rdx
lea rax, [0x004c56e0]
nop dword [rax]
call fcn.0040c6a0
mov qword [rax], 0xffffffffffffffff
mov rcx, qword [rsp + 0x88]
mov qword [rax + 8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0x20
mov rcx, qword [rsp + 0x78]
mov qword [rax + 0x20], rcx
movzx ecx, word [rsp + 0x3e]
mov word [rsp], cx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 5
mov qword [rsp + 0x18], 5
call fcn.004ac280
xorps xmm15, xmm15
mov r14, qword [0x00656fd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
xor ebx, ebx
mov rcx, rbx
mov rdi, rcx
mov rsi, rcx
nop dword [rax]
call fcn.0045dd20
add rsp, 0x98
pop rbp
ret
xor eax, eax
mov rcx, rax
call fcn.00461660
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0045f3e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
nop dword [rax]
jmp fcn.004b8800
Function at 0x180024b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
mov r9, rcx
jne 0x180024b57
movzx eax, byte [rcx + 0x10]
test al, al
je 0x180024b57
cmp al, 1
jne 0x180024b19
test edx, edx
jne 0x180024b57
mov r10, qword [rcx + 8]
test r8, r8
je 0x180024b32
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + 0x50]
mov eax, dword [rcx + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x180024b54
mov rax, qword [r9]
mov rcx, qword [r10]
mov edx, dword [rax + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x180024b54
cmp byte [rcx + 0xa], 0
jne fcn.18001ccc0
xor eax, eax
ret
jmp fcn.180024740
Function at 0x18007ac80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rsi, qword [rcx + 0xa0]
mov rbx, rcx
mov rax, qword [rcx]
mov rdi, qword [rcx + 0x10]
mov qword [rsp + 0x60], rax
test rsi, rsi
je 0x18007ae9a
mov qword [rsp + 0x68], rbp
xor r9d, r9d
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x38], r14
nop dword [rax]
nop word [rax + rax]
movsxd rbp, dword [rsi + 0x10]
lea r12, [rdi + 0x88]
mov r15d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [rax + 0x20]
movzx eax, byte [rbx + 0x1f]
test al, al
jne 0x18007acf8
inc dword [rbx + 0x38]
mov r14d, dword [rbx + 0x38]
jmp 0x18007ad08
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r14d, dword [rbx + rax*4 + 0xe0]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r15 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x18007ad35
mov r9d, edx
mov dword [rsp + 0x20], r15d
mov edx, 0x37
mov rcx, rdi
call fcn.180033a50
jmp 0x18007ad60
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [r12]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r15d
mov qword [rax + rcx*8 + 0x10], r9
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], WSAStartup
mov r9, qword [r9 + 0x68]
call fcn.180079f60
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x18007ad9f
mov rcx, rdi
call fcn.180033910
test eax, eax
jne 0x18007ae81
movsxd rax, dword [rdi + 0x90]
xor r9d, r9d
lea rcx, [rax + rax*2]
mov rax, qword [r12]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r9d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r9d
add eax, 2
mov dword [rdx + 8], eax
mov byte [rdx + 1], r9b
mov qword [rdx + 0x10], r9
mov word [rdx + 2], r9w
mov qword [rdx + 0x18], 0x7f
mov qword [rdx + 0x20], r9
mov qword [rdx + 0x28], r9
mov qword [rdx + 0x30], 0x61
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r9
mov qword [rdx + 0x48], 0x80
mov qword [rdx + 0x50], r9
mov qword [rdx + 0x58], r9
mov qword [rdx + 0x60], 0x7a
mov qword [rdx + 0x68], r9
mov qword [rdx + 0x70], r9
add dword [rdi + 0x90], 5
test rdx, rdx
je 0x18007ae81
mov dword [rdx + 0x3c], r14d
lea ecx, [r15 + 1]
mov dword [rdx + 4], ecx
lea eax, [r15 - 1]
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x54], ecx
mov ecx, 8
mov word [rdx + 0x4a], cx
mov dword [rdx + 0x34], eax
mov dword [rdx + 0x50], r14d
test r14d, r14d
je 0x18007ae70
movzx eax, byte [rbx + 0x1f]
cmp al, cl
jae 0x18007ae70
mov dword [rbx + rax*4 + 0xe0], r14d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
mov rax, qword [rsp + 0x60]
test rsi, rsi
jne 0x18007acd0
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov r15, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800e59b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1800e59d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1800e5a4c
mov rdi, r14
mov rcx, rbx
call fcn.1800db3a0
test rax, rax
jle 0x1800e5a24
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1801a1710
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1800e5a3c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1800e5a44
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1800e59e6
sub r14, rdi
jmp 0x1800e5b2f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1800e5a63
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800e5a65
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800e5a97
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1801a1710
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1800e5b2c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800e5ad2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1800e5b0d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1801b80d8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1800e5b2c
cmp rbp, rax
ja 0x1800e5ae0
test rbp, rbp
je 0x1800e5b2c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1801b80d8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x1800e72c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x77], 0
mov rbp, rcx
je 0x1800e7473
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x9bf3d983efabd7e7
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + r14]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
shl cl, 3
shr rbx, cl
lea ecx, [rax + r12]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
shl cl, 3
shr r10, cl
lea ecx, [rax + rdx]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x9bf3d983efabd7e7
shl cl, 3
shr r9, cl
lea ecx, [rax + r8]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
shl cl, 3
movabs r9, 0x9bf3d983efabd7e7
shr r8, cl
xor byte [rax + 4], r8b
xor byte [rax + 0xc], r8b
movzx ecx, byte [rsp + 0x40]
mov r8, qword [rsp + 0x50]
add cl, al
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
add rax, 0x11
mov rdx, qword [rsp + 0x48]
lea rcx, [r14 + rax]
cmp rcx, 0x77
jb 0x1800e7360
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x77], 0
add rsp, 0x30
pop rbp
ret
Function at 0x1800e7480
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x57], 0
mov rbp, rcx
je 0x1800e7660
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x8719637309815153
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [r15 + rax]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x8719637309815153
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
movabs r9, 0x8719637309815153
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
mov r8, qword [rsp + 0x50]
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
add rax, 0x1d
mov rdx, qword [rsp + 0x48]
lea rcx, [rax + r14]
cmp rcx, 0x57
jb 0x1800e7520
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x57], 0
add rsp, 0x30
pop rbp
ret
Function at 0x1800fb990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800fb9c4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800fb9b0
ret
Function at 0x180100680
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x18010074c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x18010074c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x180100765
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x18010073c
cmp byte [rax], 0x5c
jne 0x180100736
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x180100736
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x180100722
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x180100733
test r8b, 0x10
jne 0x180100736
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x180100736
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1800fc8f0
test edi, edi
jne 0x1801006a0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1800fc8e0
int3
Function at 0x180107f40
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x4b], 0
mov rbp, rcx
je 0x180108111
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0xbb2103bf0b4d771d
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [r15 + rax]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0xbb2103bf0b4d771d
xor byte [rax + 0x12], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
movabs r9, 0xbb2103bf0b4d771d
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
mov r8, qword [rsp + 0x50]
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
add rax, 0x19
mov rdx, qword [rsp + 0x48]
lea rcx, [rax + r14]
cmp rcx, 0x4b
jb 0x180107fe0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x4b], 0
add rsp, 0x30
pop rbp
ret
Function at 0x18010aee0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18010aff3
mov rax, qword [0x18024bca8]
mov qword [0x18024bcb8], rcx
test rax, rax
jne 0x18010afd2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x18010afa4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x18010afa4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x17f9aeaf
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18010af9f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x18010af80
cmp edx, 0xe7c53917
je 0x18010affd
test r8d, r8d
jne 0x18010af60
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18010afba
cmp qword [rax + 0x30], 0
jne 0x18010af30
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x18024bca8], rax
mov qword [rsp + 0x28], 0
lea r8, [0x18010a680]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call rax
mov eax, 1
add rsp, 0x38
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18010afbc
Function at 0x18010ba00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x20], rcx
call fcn.18010a1d0
mov r9, rax
xor r14d, r14d
cmp byte [rax + 0xd1], r14b
je 0x18010ba66
mov edx, r14d
movabs r8, 0x91219b1ff7f5f1d5
nop dword [rax + rax]
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [rdx + r9], al
inc rdx
cmp rdx, 0xd1
jb 0x18010ba40
mov byte [r9 + 0xd1], r14b
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop
inc r8
cmp byte [r9 + r8], r14b
jne 0x18010ba80
mov rdx, r9
mov rcx, rsi
call fcn.1800dd050
nop
mov ecx, dword [0x180248ca8]
mov rax, qword gs:[0x58]
mov rdx, qword [rax + rcx*8]
mov ecx, 0xefc
mov eax, dword [rcx + rdx]
mov r8d, 0xf20
test al, 1
jne 0x18010bae9
or eax, 1
mov dword [rcx + rdx], eax
lea rbx, [rdx + r8]
mov word [rbx + 7], 0x165
mov dword [rbx], 0x5728b64f
mov word [rbx + 4], 0x120
mov byte [rbx + 6], 0x41
lea rcx, [0x1801e3770]
call fcn.18015cf9c
nop
jmp 0x18010baed
lea rbx, [rdx + r8]
cmp byte [rbx + 8], 0
je 0x18010bb16
xor byte [rbx], 0xd
xor byte [rbx + 1], 0xd3
xor byte [rbx + 2], 0x49
xor byte [rbx + 3], 0x25
xor byte [rbx + 4], 0x45
xor byte [rbx + 5], 0x73
xor byte [rbx + 6], 0x61
xor byte [rbx + 7], 0x65
mov byte [rbx + 8], 0
xorps xmm0, xmm0
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x30], r14
mov qword [rsi + 0x38], r14
inc rdi
cmp byte [rbx + rdi], 0
jne 0x18010bb25
mov r8, rdi
mov rdx, rbx
lea rcx, [rsi + 0x20]
call fcn.1800dd050
xorps xmm0, xmm0
movups xmmword [rsi + 0x40], xmm0
mov qword [rsi + 0x50], r14
mov qword [rsi + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsi + 0x40], 0
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x18010d030
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1802407e8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x78], ax
mov dword [rsp + 0x40], 0x32
mov rax, qword [0x18024bce8]
test rax, rax
jne 0x18010d146
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x18010d127
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x18010d127
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0xd5626859
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18010d122
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x18010d100
cmp edx, 0x805cc87b
je 0x18010d1f8
test r8d, r8d
jne 0x18010d0e0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18010d13d
cmp qword [rax + 0x30], 0
jne 0x18010d0b0
xor eax, eax
mov qword [0x18024bce8], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call rax
test eax, eax
jne 0x18010d214
mov ecx, dword [0x180248ca8]
mov rax, qword gs:[0x58]
mov rdx, qword [rax + rcx*8]
mov ecx, 0xfbc
mov eax, dword [rcx + rdx]
mov ebx, 0xf58
add rbx, rdx
test al, 1
jne 0x18010d1a7
or eax, 1
mov dword [rcx + rdx], eax
mov dword [rbx + 6], 0x19f6a3f
mov dword [rbx], 0xce1187dc
mov word [rbx + 4], 0xdcbe
lea rcx, [0x1801e38e0]
call fcn.18015cf9c
nop
cmp byte [rbx + 9], 0
je 0x18010d1d4
xor byte [rbx], 0x9f
xor byte [rbx + 1], 0xbd
xor byte [rbx + 2], 0x4d
xor byte [rbx + 3], 0x9b
xor byte [rbx + 4], 0xcd
xor byte [rbx + 5], 0xb9
xor byte [rbx + 6], 0x4d
xor byte [rbx + 7], 0x19
xor byte [rbx + 8], 0x9f
mov byte [rbx + 9], 0
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x18010d1e0
lea rcx, [rbp + 0x40]
mov rdx, rbx
call fcn.1800dc810
jmp 0x18010d262
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x18010d13f
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x48]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18010d231
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.1800dd050
lea rcx, [rbp + 0x40]
lea rdx, [rsp + 0x20]
call fcn.1800dcc20
lea rcx, [rsp + 0x20]
call fcn.1800db3e0
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18015c7e0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret