joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002b350
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
movdqa xmmword [rsp + 0x80], xmm8
movdqa xmmword [rsp + 0x70], xmm7
movdqa xmmword [rsp + 0x60], xmm6
mov rax, qword [0x180277178]
movzx eax, byte [rax]
test al, al
jne 0x18002b398
mov r8d, dword [0x18028ec98]
test r8b, 1
je 0x18002b4d3
cmp byte [0x18028ec80], 1
jne 0x18002b497
cmp qword [rcx + 0x18], 0
je 0x18002b49b
lea rax, [rcx + 0x20]
mov rsi, rcx
mov rcx, rax
mov rdi, rdx
call fcn.18005c700
mov rcx, qword [rsi]
mov r14, qword [rsi + 8]
mov r15, r14
and r15, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm6, xmm0, 0
mov qword [rsp + 0x28], rcx
lea r13, [rcx - 0x30]
mov rsi, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
pcmpeqd xmm7, xmm7
xor ebp, ebp
mov rax, qword [rsp + 0x28]
movdqu xmm8, xmmword [rax + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm6
pmovmskb r12d, xmm0
test r12d, r12d
jne 0x18002b44e
pcmpeqb xmm8, xmm7
pmovmskb eax, xmm8
test eax, eax
jne 0x18002b4cf
add r15, rbp
add r15, 0x10
add rbp, 0x10
and r15, r14
jmp 0x18002b3fc
lea eax, [r12 - 1]
and ax, r12w
mov r12d, eax
je 0x18002b41a
tzcnt eax, r12d
add rax, r15
and rax, r14
neg rax
lea rbx, [rax + rax*2]
shl rbx, 4
cmp rdi, qword [r13 + rbx + 0x10]
jne 0x18002b440
lea rax, [rbx + r13]
mov rdx, qword [rax + 8]
mov rcx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18002b440
mov rax, qword [rsp + 0x28]
add rax, rbx
lea rcx, [rax - 0x30]
test rax, rax
cmove rcx, rax
jmp 0x18002b49d
xor eax, eax
jmp 0x18002b4a8
xor ecx, ecx
lea rax, [rcx + 0x18]
test rcx, rcx
cmove rax, rcx
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x18002b48a
cmp r8d, 0xff
mov rdi, rdx
mov rbx, rcx
ja 0x18002b545
mov ecx, r8d
or ecx, 0x20000000
mov eax, r8d
lock cmpxchg dword [0x18028ec98], ecx
jne 0x18002b545
lea rax, [0x18028ec98]
movd xmm0, r8d
pshufd xmm0, xmm0, 0x50
lea rcx, [0x18028ec48]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
movq qword [rsp + 0x58], xmm0
lea rsi, [rsp + 0x30]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.18018df00
mov rcx, rsi
call fcn.180029200
mov rdx, rdi
mov rcx, rbx
jmp 0x18002b398
lea rdx, [0x18028ec98]
lea r9, [0x18028ec48]
lea rcx, [rsp + 0x30]
lea r8, [rsp + 0x27]
call fcn.1801844d0
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x18002b586
cmp eax, 2
mov rdx, rdi
mov rcx, rbx
je 0x18002b398
mov rax, qword [rsp + 0x38]
movq xmm0, qword [rsp + 0x40]
jmp 0x18002b509
mov rax, qword [rsp + 0x38]
mov r8d, 0xffffff00
lock xadd dword [rax], r8d
mov ecx, r8d
and ecx, 0x3fffff00
cmp ecx, 0x100
setne cl
cmp r8d, 0x40000000
setb dl
or dl, cl
mov rdx, rdi
mov rcx, rbx
jne 0x18002b398
add r8d, 0xffffff00
mov rcx, rax
mov edx, r8d
call fcn.18018c540
mov rcx, rbx
mov rdx, rdi
jmp 0x18002b398
Function at 0x18002c4e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [0x180277178]
movzx eax, byte [rax]
mov ecx, 0x20000001
test al, al
je 0x18002c531
mov eax, 1
lock cmpxchg dword [0x18028e6f0], ecx
mov esi, 1
lea rcx, [0x18028e6f0]
jne 0x18002c55b
mov edx, 1
jmp 0x18002c5e8
mov eax, 1
lock cmpxchg dword [0x18028e6f0], ecx
mov esi, 1
lea rcx, [0x18028e6f0]
jne 0x18002c5a0
mov edx, 1
mov eax, 1
jmp 0x18002c5e3
mov edx, eax
cmp eax, 0x100
jae 0x18002c57d
mov r8d, edx
or r8d, 0x20000000
mov eax, edx
lock cmpxchg dword [0x18028e6f0], r8d
mov esi, edx
je 0x18002c5e8
lea rdx, [0x18028e6f0]
lea rcx, [rbp - 0x30]
lea r8, [rbp - 0x58]
mov r9, r8
call fcn.180184750
mov rcx, qword [rbp - 0x28]
mov edx, dword [rbp - 0x20]
mov esi, dword [rbp - 0x1c]
jmp 0x18002c5e8
mov edx, eax
cmp eax, 0x100
jae 0x18002c5c2
mov r8d, edx
or r8d, 0x20000000
mov eax, edx
lock cmpxchg dword [0x18028e6f0], r8d
mov eax, edx
je 0x18002c5e3
lea rdx, [0x18028e6f0]
lea rcx, [rbp - 0x30]
lea r8, [rbp - 0x58]
mov r9, r8
call fcn.180184750
mov rcx, qword [rbp - 0x28]
mov edx, dword [rbp - 0x20]
mov eax, dword [rbp - 0x1c]
test al, 1
cmovne esi, eax
mov byte [0x18028e6fc], 1
mov eax, edx
or eax, 0x20000000
lock cmpxchg dword [rcx], esi
je 0x18002c62d
xor edx, esi
or edx, 0x20000000
mov eax, dword [rcx]
nop word cs:[rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x18002c610
cmp eax, 0x40000000
jb 0x18002c62d
xor eax, edx
mov edx, eax
call fcn.18018c540
call fcn.18001b970
mov qword [rbp - 0x30], rax
test rax, rax
je 0x18002c644
lea rcx, [rbp - 0x30]
call fcn.18015eb20
mov rax, qword [0x180277148]
mov rax, qword [rax]
cmp rax, 4
jb 0x18002c6ba
lea rax, [0x1801a1ec8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rcx, str.src_lib.rs
call fcn.18007b990
lea rcx, str.dfint_hookdfint_:
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], 0xa
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x40], 0xa
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x30]
lea r8, [rbp - 0x58]
mov edx, 4
xor r9d, r9d
call fcn.18007b8a0
nop
add rsp, 0x88
pop rsi
pop rbp
ret

Function at 0x18002d620
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
mov r8d, dword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rdx + 0x14]
lock cmpxchg dword [rcx], edx
je 0x18002d664
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word [rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x18002d650
cmp eax, 0x40000000
jae 0x18002d665
ret
xor eax, edx
mov edx, eax
jmp fcn.18018e0a0
Function at 0x180033e00
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
mov r8d, dword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rdx + 0x14]
lock cmpxchg dword [rcx], edx
je 0x180033e44
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word [rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x180033e30
cmp eax, 0x40000000
jae 0x180033e45
ret
xor eax, edx
mov edx, eax
jmp fcn.18018eaa0

Function at 0x180033e50
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
mov r8d, dword [rcx + 8]
mov rcx, qword [rcx]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rdx + 0xc]
lock cmpxchg dword [rcx], edx
je 0x180033e94
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word cs:[rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x180033e80
cmp eax, 0x40000000
jae 0x180033e95
ret
xor eax, edx
mov edx, eax
jmp fcn.18018eaa0
Function at 0x1800352d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
cmp qword [rdx + 0x10], 0
je 0x180035529
mov r14d, r9d
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov dword [rbp - 0x40], 0
mov qword [rbp - 0x48], 0
mov qword [rbp], 1
mov qword [rbp - 8], 0
mov byte [rbp + 0xf], 0
lea rcx, [rbp - 0x30]
call fcn.180178bb0
mov r12, qword [rbp - 0x30]
mov r13, qword [rbp - 0x28]
mov r15, qword [rbp - 0x20]
mov rax, qword [0x180277178]
movzx eax, byte [rax]
test al, al
jne 0x18003549d
mov ecx, dword [0x18028e8f8]
test cl, 1
jne 0x18003549d
cmp ecx, 0x100
jae 0x180035391
mov edx, ecx
or edx, 0x20000000
mov eax, ecx
lock cmpxchg dword [0x18028e8f8], edx
jne 0x180035391
lea rax, [0x18028e8f8]
movd xmm0, ecx
pshufd xmm0, xmm0, 0x50
jmp 0x1800353d5
mov qword [rbp], r13
mov qword [rbp - 8], r12
mov byte [rbp + 0xf], 0
lea rdx, [0x18028e8f8]
lea r9, [0x18028e8f0]
lea rcx, [rbp - 0x30]
lea r8, [rbp - 9]
call fcn.1801844d0
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x18003545b
cmp eax, 2
je 0x18003549d
mov rax, qword [rbp - 0x28]
movq xmm0, qword [rbp - 0x20]
lea rcx, [0x18028e8f0]
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x58], rax
movq qword [rbp - 0x50], xmm0
mov qword [rbp], r13
mov qword [rbp - 8], r12
mov byte [rbp + 0xf], 0
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x60]
call fcn.18018f0b0
mov r8d, dword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rbp - 0x1c]
lock cmpxchg dword [rcx], edx
je 0x18003549d
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word [rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x180035430
cmp eax, 0x40000000
jb 0x18003549d
xor eax, edx
mov qword [rbp], r13
mov qword [rbp - 8], r12
mov byte [rbp + 0xf], 0
mov edx, eax
call fcn.18018eaa0
jmp 0x18003549d
mov rcx, qword [rbp - 0x28]
mov edx, 0xffffff00
lock xadd dword [rcx], edx
mov eax, edx
and eax, 0x3fffff00
cmp eax, 0x100
setne al
cmp edx, 0x40000000
setb r8b
or r8b, al
jne 0x18003549d
add edx, 0xffffff00
mov qword [rbp], r13
mov qword [rbp - 8], r12
mov byte [rbp + 0xf], 0
call fcn.18018eaa0
mov rcx, qword [0x18028e8f0]
mov qword [rbp], r13
mov qword [rbp - 8], r12
mov byte [rbp + 0xf], 0
mov edx, r14d
call fcn.18003bfc0
mov r14d, eax
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x18], r12
mov r12, qword [rdi + 0x10]
cmp r12, qword [rdi]
jne 0x1800354d4
mov rcx, rdi
call fcn.180014db0
mov rax, qword [rdi + 8]
lea rcx, [r12 + r12*2]
shl rcx, 4
mov rdx, qword [rbp - 0x18]
mov qword [rax + rcx], rdx
mov rdx, qword [rbp - 0x38]
mov qword [rax + rcx + 8], rdx
mov qword [rax + rcx + 0x10], r15
mov dword [rax + rcx + 0x18], ebx
mov rdx, qword [rbp - 0x48]
mov qword [rax + rcx + 0x1c], rdx
mov edx, dword [rbp - 0x40]
mov dword [rax + rcx + 0x24], edx
mov edx, r14d
shr edx, 0x10
mov byte [rax + rcx + 0x2a], dl
mov word [rax + rcx + 0x28], r14w
inc r12
mov qword [rdi + 0x10], r12
mov qword [rsi + 0x10], 0
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x180039340
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
mov r8d, dword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rdx + 0x14]
lock cmpxchg dword [rcx], edx
je 0x180039384
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word [rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x180039370
cmp eax, 0x40000000
jae 0x180039385
ret
xor eax, edx
mov edx, eax
jmp fcn.18018f9c0
Function at 0x18003c880
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rcx, [rbp - 0x28]
call fcn.180178bb0
lea rdx, [rdi + 0x18]
mov byte [rbp + 0x36], 1
lea rcx, [rbp - 0x40]
call fcn.180178bb0
mov rax, qword [0x180277178]
movzx eax, byte [rax]
test al, al
jne 0x18003c9fd
mov ecx, dword [0x18028ecc0]
test cl, 1
jne 0x18003c9fd
cmp ecx, 0x100
jae 0x18003c90c
mov edx, ecx
or edx, 0x20000000
mov eax, ecx
lock cmpxchg dword [0x18028ecc0], edx
jne 0x18003c90c
lea rax, [0x18028ecc0]
movd xmm0, ecx
pshufd xmm0, xmm0, 0x50
jmp 0x18003c948
mov byte [rbp + 0x37], 1
lea rdx, [0x18028ecc0]
lea r9, [0x18028eca8]
lea rcx, [rbp - 0x10]
lea r8, [rbp + 0xf]
call fcn.1801844d0
mov eax, dword [rbp - 0x10]
test eax, eax
je 0x18003c9c3
cmp eax, 2
je 0x18003c9fd
mov rax, qword [rbp - 8]
movq xmm0, qword [rbp]
lea rcx, [0x18028eca8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], rax
movq qword [rbp - 0x48], xmm0
mov byte [rbp + 0x37], 1
lea rcx, [rbp - 0x10]
lea rdx, [rbp - 0x58]
call fcn.180190710
mov r8d, dword [rbp]
mov rcx, qword [rbp - 8]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rbp + 4]
lock cmpxchg dword [rcx], edx
je 0x18003c9fd
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word cs:[rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x18003c9a0
cmp eax, 0x40000000
jb 0x18003c9fd
xor eax, edx
mov byte [rbp + 0x37], 1
mov edx, eax
call fcn.18018f9c0
jmp 0x18003c9fd
mov rcx, qword [rbp - 8]
Function at 0x180051640
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
mov r8d, dword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rdx + 0x14]
lock cmpxchg dword [rcx], edx
je 0x180051684
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word [rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x180051670
cmp eax, 0x40000000
jae 0x180051685
ret
xor eax, edx
mov edx, eax
jmp fcn.1801927f0

Function at 0x180052690
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x10], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rcx, [rbp - 0x40]
call fcn.180178bb0
mov rax, qword [0x180277178]
movzx eax, byte [rax]
test al, al
jne 0x1800527ed
mov ecx, dword [0x18028ecc0]
test cl, 1
jne 0x1800527ed
cmp ecx, 0x100
jae 0x180052709
mov edx, ecx
or edx, 0x20000000
mov eax, ecx
lock cmpxchg dword [0x18028ecc0], edx
jne 0x180052709
lea rax, [0x18028ecc0]
movd xmm0, ecx
pshufd xmm0, xmm0, 0x50
jmp 0x180052745
mov byte [rbp + 0xf], 1
lea rdx, [0x18028ecc0]
lea r9, [0x18028eca8]
lea rcx, [rbp - 0x28]
lea r8, [rbp - 9]
call fcn.1801844d0
mov eax, dword [rbp - 0x28]
test eax, eax
je 0x1800527b3
cmp eax, 2
je 0x1800527ed
mov rax, qword [rbp - 0x20]
movq xmm0, qword [rbp - 0x18]
lea rcx, [0x18028eca8]
mov qword [rbp - 0x58], rcx
mov qword [rbp - 0x50], rax
movq qword [rbp - 0x48], xmm0
mov byte [rbp + 0xf], 1
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x58]
call fcn.180192d50
mov r8d, dword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov eax, r8d
or eax, 0x20000000
and byte [rbx + 0xff0ec55], cl
mov cl, 0x11
mov rcx, qword [rbp - 0x20]
mov edx, 0xffffff00
lock xadd dword [rcx], edx
mov eax, edx

Function at 0x18005c620
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
mov r8d, dword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rdx + 0x14]
lock cmpxchg dword [rcx], edx
je 0x18005c664
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word [rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x18005c650
cmp eax, 0x40000000
jae 0x18005c665
ret
xor eax, edx
mov edx, eax
jmp fcn.180193ee0
Function at 0x18005d6e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x18005d722
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x18005d72a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x18005d73b
jmp 0x18005d752
xor r10d, r10d
jmp 0x18005d7dd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x18005d752
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x18005d769
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x18005d789
add r11, r8
jmp 0x18005d8b9
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x18005d852
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x18005d800
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x18005d86f
mov r9d, dword [rdx + r10]
mov r8d, 4
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jb 0x18005d880
jmp 0x18005d89b
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x18005d89b
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x18005d8b5
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800680f0
Capabilities:
Encode data using xor

Disassembly:
mov rdx, rcx
mov r8d, dword [rcx + 0x10]
mov rcx, qword [rcx + 8]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rdx + 0x14]
lock cmpxchg dword [rcx], edx
je 0x180068134
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word [rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x180068120
cmp eax, 0x40000000
jae 0x180068135
ret
xor eax, edx
mov edx, eax
jmp fcn.1801958d0
Function at 0x18006a5c0
Capabilities:
Encode data using xor

Disassembly:
movabs r8, 0x517cc1b727220a95
cmp rdx, 8
jb 0x18006a5ef
lea rax, [rdx - 8]
mov r10, rax
shr r10, 3
inc r10
mov r9d, r10d
and r9d, 3
cmp rax, 0x18
jae 0x18006a5f3
xor eax, eax
jmp 0x18006a63d
xor eax, eax
jmp 0x18006a66b
and r10, 0xfffffffffffffffc
xor eax, eax
nop dword [rax]
rol rax, 5
xor rax, qword [rcx]
imul rax, r8
rol rax, 5
xor rax, qword [rcx + 8]
imul rax, r8
rol rax, 5
xor rax, qword [rcx + 0x10]
imul rax, r8
rol rax, 5
xor rax, qword [rcx + 0x18]
imul rax, r8
add rcx, 0x20
add rdx, 0xffffffffffffffe0
add r10, 0xfffffffffffffffc
jne 0x18006a600
test r9, r9
je 0x18006a66b
shl r9d, 3
xor r10d, r10d
nop dword [rax]
rol rax, 5
xor rax, qword [rcx + r10]
imul rax, r8
add r10, 8
cmp r9, r10
jne 0x18006a650
add rcx, r10
sub rdx, r10
cmp rdx, 3
jbe 0x18006a687
mov r9d, dword [rcx]
rol rax, 5
xor rax, r9
imul rax, r8
add rcx, 4
add rdx, 0xfffffffffffffffc
test rdx, rdx
je 0x18006a708
mov r10, rdx
mov r9, rcx
and r10, 3
je 0x18006a6b7
nop dword [rax + rax]
movzx r11d, byte [r9]
rol rax, 5
inc r9
xor rax, r11
imul rax, r8
dec r10
jne 0x18006a6a0
cmp rdx, 4
jb 0x18006a708
add rcx, rdx
rol rax, 5
movzx edx, byte [r9]
xor rax, rdx
imul rax, r8
movzx edx, byte [r9 + 1]
rol rax, 5
xor rax, rdx
imul rax, r8
movzx edx, byte [r9 + 2]
rol rax, 5
xor rax, rdx
imul rax, r8
movzx edx, byte [r9 + 3]
rol rax, 5
xor rax, rdx
imul rax, r8
add r9, 4
cmp r9, rcx
jne 0x18006a6c0
ret
Function at 0x18007baa0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
test eax, eax
je 0x18007bafd
cmp eax, 1
jne 0x18007bb28
mov r8d, dword [rcx + 0x10]
mov rdx, rcx
mov rcx, qword [rcx + 8]
mov eax, r8d
or eax, 0x20000000
mov edx, dword [rdx + 0x14]
lock cmpxchg dword [rcx], edx
je 0x18007bb28
xor edx, r8d
or edx, 0x20000000
mov eax, dword [rcx]
nop word cs:[rax + rax]
mov r8d, eax
xor r8d, edx
lock cmpxchg dword [rcx], r8d
jne 0x18007bae0
cmp eax, 0x40000000
jb 0x18007bb28
xor eax, edx
mov edx, eax
jmp fcn.180198470
mov rcx, qword [rcx + 8]
mov edx, 0xffffff00
lock xadd dword [rcx], edx
mov eax, edx
and eax, 0x3fffff00
cmp eax, 0x100
setne al
cmp edx, 0x40000000
setb r8b
or r8b, al
je 0x18007bb29
ret
add edx, 0xffffff00
jmp fcn.180198470
Function at 0x18008a630
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x440
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3b8], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rdx]
mov rdi, qword [r9]
movzx ecx, byte [rax + 0x88]
cmp cl, 2
je 0x18008a66b
test cl, 1
je 0x18008a7b1
movzx eax, byte [rax + 0x82]
cmp al, 2
je 0x18008a67e
test al, 1
je 0x18008a7b1
mov rax, qword [r8 + 0x10]
mov qword [rbp + 0x178], rax
movups xmm0, xmmword [r8]
movups xmmword [rbp + 0x168], xmm0
movzx eax, byte [r8 + 0x18]
mov ecx, dword [r8 + 0x19]
mov dword [rbp + 0x3a9], ecx
mov ecx, dword [r8 + 0x1c]
mov dword [rbp + 0x3ac], ecx
mov qword [rbp + 0x380], 0
movups xmm0, xmmword [rbp + 0x160]
movups xmmword [rbp + 0x388], xmm0
mov rcx, qword [rbp + 0x170]
mov qword [rbp + 0x398], rcx
mov rcx, qword [rbp + 0x178]
mov qword [rbp + 0x3a0], rcx
mov byte [rbp + 0x3a8], al
mov byte [rbp + 0x378], 3
mov qword [rbp + 0x350], 0
lea rcx, [rbp - 0x60]
call fcn.1800cf3d0
movups xmm0, xmmword [rbp + 0x350]
movups xmm1, xmmword [rbp + 0x360]
movups xmm2, xmmword [rbp + 0x370]
movaps xmmword [rbp + 0x180], xmm2
movaps xmmword [rbp + 0x170], xmm1
movaps xmmword [rbp + 0x160], xmm0
lea rcx, [rbp + 0x190]
lea rdx, [rbp - 0x60]
mov r8d, 0x1c0
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp + 0x380]
movups xmm1, xmmword [rbp + 0x390]
movups xmm2, xmmword [rbp + 0x3a0]
movaps xmmword [rbp - 0x40], xmm2
movaps xmmword [rbp - 0x50], xmm1
movaps xmmword [rbp - 0x60], xmm0
lea rcx, [rbp + 0x160]
lea rdx, [rbp - 0x60]
call fcn.1800a6a40
lock inc qword [rdi]
jle 0x18008a881
movzx eax, byte [rbp + 0x188]
cmp al, 2
jae 0x18008a7d0
mov rcx, qword [rbp + 0x170]
mov rdx, qword [rbp + 0x178]
lock inc qword [rcx]
jle 0x18008a881
movzx eax, byte [rbp + 0x188]
mov r8, qword [rbp + 0x180]
jmp 0x18008a7d0
mov edi, 2
cmp byte [r8 + 0x18], 2
je 0x18008a7ce
mov rax, qword [r8]
lock dec qword [rax]
jne 0x18008a7ce
mov rcx, r8
call fcn.180029ca0
jmp 0x18008a841
movaps xmm0, xmmword [rbp + 0x160]
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], r8
mov byte [rbp - 0x38], al
mov qword [rbp - 0x30], rdi
cmp al, 3
je 0x18008a80f
cmp al, 2
je 0x18008a80f
mov rax, qword [rbp + 0x170]
lock dec qword [rax]
jne 0x18008a80f
lea rcx, [rbp + 0x170]
call fcn.180029ca0
lea rcx, [rbp + 0x190]
call fcn.1800897c0
mov rdi, qword [rbp - 0x60]
movups xmm0, xmmword [rbp - 0x58]
movups xmm1, xmmword [rbp - 0x48]
mov rax, qword [rbp - 0x38]
movzx ecx, byte [rbp - 0x30]
mov edx, dword [rbp - 0x2f]
mov dword [rbp + 0x160], edx
mov edx, dword [rbp - 0x2c]
mov dword [rbp + 0x163], edx
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm1
mov qword [rsi + 0x30], rax
mov byte [rsi + 0x38], cl
mov eax, dword [rbp + 0x160]
mov ecx, dword [rbp + 0x163]
mov dword [rsi + 0x39], eax
mov dword [rsi + 0x3c], ecx
mov qword [rsi + 8], rdi
movabs rax, 0x8000000000000002
mov qword [rsi], rax
mov rax, rsi
add rsp, 0x440
pop rdi
pop rsi
pop rbp
ret
ud2