joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180148b58
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp byte [0x1802bd274], 0
je 0x180148c39
cmp qword [0x1802bd4b8], 0
je 0x180148c39
cmp qword [0x1802bd4c0], 0
jbe 0x180148c39
call fcn.180148f9c
test al, al
je 0x180148c39
and dword [rsp + 0x38], 0
cmp byte [0x1802bd4d0], 0
jne 0x180148bc1
mov rdx, qword [0x1802bd4c0]
lea r9, [0x1802bd4c8]
mov rcx, qword [0x1802bd4b8]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [0x1802bd4c0]
xor ecx, ecx
mov r9d, dword [0x1802bd4d4]
mov rax, r8
mov rdx, qword [0x1802bd4b8]
shr rax, 2
test rax, rax
je 0x180148bf0
xor dword [rdx + rcx*4], r9d
inc rcx
cmp rcx, rax
jb 0x180148be4
shl rax, 2
jmp 0x180148bfd
xor byte [rax + rdx], r9b
inc rax
cmp rax, r8
jb 0x180148bf6
cmp byte [0x1802bd4d0], 0
je 0x180148c32
mov r8d, dword [0x1802bd4c8]
lea r9, [rsp + 0x38]
mov rdx, qword [0x1802bd4c0]
mov rcx, qword [0x1802bd4b8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [0x1802bd4d0], 0
sete byte [0x1802bd4d0]
add rsp, 0x28
ret

Function at 0x180148ff0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13d0
call fcn.18026a280
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rcx
cmp byte [0x1802bd274], 0
je 0x1801490e1
cmp qword [0x1802bd4b8], 0
jne 0x1801490e1
call fcn.180148f9c
test al, al
je 0x1801490e1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.180143828
nop
mov rdx, qword [rsp + 0x20]
cmp rdx, qword [rsp + 0x28]
je 0x1801490d7
mov r8, qword [rdx]
cmp rbx, r8
jbe 0x18014906b
mov rcx, qword [rdx + 0x18]
add rcx, r8
cmp rbx, rcx
jb 0x180149071
add rdx, 0x30
jmp 0x18014904c
mov qword [0x1802bd4b8], r8
mov rax, qword [rdx + 0x18]
mov qword [0x1802bd4c0], rax
mov byte [0x1802bd4d0], 0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
or dword [rsp + 0x13c4], 0xffffffff
mov dword [rsp + 0x44], eax
mov edx, 1
mov r8d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x44], eax
inc rdx
cmp rdx, r8
jb 0x1801490a7
mov dword [rsp + 0x40], r8d
lea rcx, [rsp + 0x40]
call fcn.1800983a8
mov dword [0x1802bd4d4], eax
lea rcx, [rsp + 0x20]
call fcn.1800938e8
add rsp, 0x13d0
pop rbx
ret
Function at 0x1801490ec
Capabilities:
Enumerate threads
Resume thread
Suspend thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov ebp, edx
mov r14b, cl
xor edx, edx
mov esi, r8d
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1801491b8
and qword [rsp + 0x34], 0
lea rdx, [rsp + 0x20]
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
movdqu xmmword [rsp + 0x24], xmm0
call qword [sym.imp.KERNEL32.dll_Thread32First]
jmp 0x1801491ab
cmp dword [rsp + 0x20], 0x10
jb 0x180149195
mov r8d, dword [rsp + 0x28]
cmp r8d, esi
je 0x180149195
cmp dword [rsp + 0x2c], ebp
jne 0x180149195
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x180149195
mov rcx, rax
test r14b, r14b
je 0x180149186
call qword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x18014918c
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x18014914c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1801491d4
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x1802bde19], 0
je 0x180149335
test cl, cl
lea rax, [0x1802bde80]
mov rcx, qword [0x1802bde08]
lea rsi, [0x1802bde38]
cmovne rsi, rax
lea rdi, [0x1802bde50]
lea rax, [0x1802bde98]
mov r8d, 0x40
cmovne rdi, rax
lea rbx, [0x1802bde20]
lea rax, [0x1802bde68]
mov rdx, qword [rsi + 8]
lea r9, [rsp + 0x38]
cmovne rbx, rax
sub rdx, qword [rsi]
and dword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180149285
mov r8, qword [rsi + 8]
sub r8, qword [rsi]
mov rdx, qword [rsi]
mov rcx, qword [0x1802bde08]
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov rdx, qword [rsi + 8]
lea r9, [rsp + 0x38]
sub rdx, qword [rsi]
mov r8d, dword [rsp + 0x38]
mov rcx, qword [0x1802bde08]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rdi + 8]
lea r9, [rsp + 0x38]
sub rdx, qword [rdi]
mov r8d, 0x40
mov rcx, qword [0x1802bde10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1801492dd
mov r8, qword [rdi + 8]
sub r8, qword [rdi]
mov rdx, qword [rdi]
mov rcx, qword [0x1802bde10]
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov rdx, qword [rdi + 8]
lea r9, [rsp + 0x38]
sub rdx, qword [rdi]
mov r8d, dword [rsp + 0x38]
mov rcx, qword [0x1802bde10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, qword [rbx + 8]
lea r9, [rsp + 0x38]
sub rdx, qword [rbx]
mov r8d, 0x40
mov rcx, qword [0x1802bde00]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180149335
mov r8, qword [rbx + 8]
sub r8, qword [rbx]
mov rdx, qword [rbx]
mov rcx, qword [0x1802bde00]
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov rdx, qword [rbx + 8]
lea r9, [rsp + 0x38]
sub rdx, qword [rbx]
mov r8d, dword [rsp + 0x38]
mov rcx, qword [0x1802bde00]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18014ab20
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xe
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014ab2d
mov byte [rcx + 0x12], r10b
ret

Function at 0x18014ab64
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x19
jb 0x18014ab6b
mov byte [rcx + 0x1d], 0
ret

Function at 0x18014aba8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x1b
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014abb5
mov byte [rcx + 0x1f], r10b
ret

Function at 0x18014abd0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xc
jb 0x18014abd7
mov byte [rcx + 0x10], 0
ret

Function at 0x18014ac24
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xe
jb 0x18014ac2b
mov byte [rcx + 0x12], 0
ret

Function at 0x18014ac4c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x10
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014ac59
mov byte [rcx + 0x14], r10b
ret

Function at 0x18014ac74
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xf
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014ac81
mov byte [rcx + 0x13], r10b
ret

Function at 0x18014ac9c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x10
jb 0x18014aca3
mov byte [rcx + 0x14], 0
ret

Function at 0x18014acc4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xd
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014acd1
mov byte [rcx + 0x11], r10b
ret

Function at 0x18014ad5c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xf
jb 0x18014ad63
mov byte [rcx + 0x13], 0
ret

Function at 0x18014ada0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x12
jb 0x18014ada7
mov byte [rcx + 0x16], 0
ret

Function at 0x18014adc8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xc
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014add5
mov byte [rcx + 0x10], r10b
ret
Function at 0x18014ae80
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x15
jb 0x18014ae87
mov byte [rcx + 0x19], 0
ret

Function at 0x18014aec4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xb
jb 0x18014aecb
mov byte [rcx + 0xf], 0
ret

Function at 0x18014af08
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 9
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014af15
mov byte [rcx + 0xd], r10b
ret

Function at 0x18014af44
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xa
jb 0x18014af4b
mov byte [rcx + 0xe], 0
ret

Function at 0x18014af88
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x13
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014af95
mov byte [rcx + 0x17], r10b
ret

Function at 0x18014afc4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x16
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014afd1
mov byte [rcx + 0x1a], r10b
ret

Function at 0x18014b024
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 7
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014b031
mov byte [rcx + 0xb], r10b
ret

Function at 0x18014b068
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x19
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014b075
mov byte [rcx + 0x1d], r10b
ret

Function at 0x18014b090
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xb
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014b09d
mov byte [rcx + 0xf], r10b
ret

Function at 0x18014b0b8
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 9
jb 0x18014b0bf
mov byte [rcx + 0xd], 0
ret

Function at 0x18014b118
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xa
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014b125
mov byte [rcx + 0xe], r10b
ret

Function at 0x18014b15c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 4
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18014b169
mov byte [rcx + 8], r10b
ret
Function at 0x18014bd30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0d08]
mov rbx, rdx
test rax, rax
jne 0x18014bdd3
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18014bd88
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0d08], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0d08]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18014bdfc
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18014be28
cmp dword [rbp - 0x10], 0x10000
je 0x18014be28
cmp qword [rbp - 0x18], 0x1000
jb 0x18014be28
cmp dword [rbp - 8], 0x1000000
je 0x18014be24
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18014be2a
mov al, 1
jmp 0x18014be2a
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18014c40c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1802c0d20]
mov rbx, rdx
test rax, rax
jne 0x18014c4af
mov byte [rbp - 0x40], 0x60
xor ecx, ecx
mov byte [rbp - 0x3f], 0x73
mov byte [rbp - 0x3e], 0x7c
mov byte [rbp - 0x3d], 0x7e
mov byte [rbp - 0x3c], 0x7f
mov byte [rbp - 0x3b], 0x6b
mov byte [rbp - 0x3a], 0x76
mov byte [rbp - 0x39], 0x5b
mov byte [rbp - 0x38], 0x7f
mov byte [rbp - 0x37], 0x6f
mov byte [rbp - 0x36], 0x7c
mov byte [rbp - 0x35], 0x83
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x40]
mov al, byte [rbp + rcx - 0x40]
sub al, 0xa
mov byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xc
jb 0x18014c464
lea rcx, [0x18027fdd8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x40]
mov qword [0x1802c0d20], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.VCRUNTIME140.dll_memset]
mov rax, qword [0x1802c0d20]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
test rax, rax
je 0x18014c4d8
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x18014c504
cmp dword [rbp - 0x10], 0x10000
je 0x18014c504
cmp qword [rbp - 0x18], 0x1000
jb 0x18014c504
cmp dword [rbp - 8], 0x1000000
je 0x18014c500
cmp dword [rbp - 8], 0x40000
sete al
jmp 0x18014c506
mov al, 1
jmp 0x18014c506
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x18014e0f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r12, r8
mov rdi, rdx
test rdx, rdx
jne 0x18014e12a
xor eax, eax
jmp 0x18014e2d3
movsxd r13, dword [rdx + 0x3c]
mov ecx, dword [rdx + r13 + 0x88]
add rcx, rdi
mov r15d, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x20]
add r15, rdi
mov esi, dword [rcx + 0x24]
add rbp, rdi
add rsi, rdi
test r12d, 0xffff0000
jne 0x18014e168
movzx eax, r12w
sub eax, dword [rcx + 0x10]
mov ebx, dword [r15 + rax*4]
add rbx, rdi
jmp 0x18014e2d0
mov r14d, dword [rcx + 0x18]
jmp 0x18014e18c
mov ecx, dword [rbp]
mov rdx, r12
add rcx, rdi
dec r14d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcmp]
test eax, eax
je 0x18014e196
add rbp, 4
add rsi, 2
test r14d, r14d
jne 0x18014e16e
jmp 0x18014e2d0
movzx eax, word [rsi]
mov edx, dword [rdi + r13 + 0x88]
mov ecx, dword [r15 + rax*4]
cmp rdx, rcx
ja 0x18014e2cc
mov eax, dword [rdi + r13 + 0x8c]
add eax, edx
cmp rcx, rax
jae 0x18014e2cc
lea rsi, [rcx + rdi]
mov rcx, rsi
lea rdx, [0x18027fe10]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
mov r15d, 2
mov rbp, rax
mov edx, r15d
lea rdi, [rax + 1]
sub rdi, rsi
lea rcx, [rdi + 4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x18014e2d0
lea r8, [rdi + 1]
mov qword [rsp + 0x20], rdi
mov r9, rsi
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_mbstowcs_s]
lea rdi, [r14 + rdi*2]
lea ecx, [r15 + 4]
lea rsi, [0x1802804e8]
rep movsb byte [rdi], byte [rsi]
lea edi, [r15 + 2]
mov rcx, r14
mov r8d, edi
lea rdx, str.api_
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x18014e258
mov r8d, edi
lea rdx, str.ext_
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x18014e2a1
mov rdx, qword [rsp + 0x88]
lea r9, [rsp + 0x78]
mov r8, r14
call fcn.18014d748
mov rsi, rax
test rax, rax
je 0x18014e2a1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, qword [rsp + 0x78]
mov rdx, r15
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
test rax, rax
je 0x18014e2d0
lea rcx, [rdi + rdi]
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, qword [rsp + 0x70]
lea r8, [rbp + 1]
mov rdx, rax
mov r9, r14
call fcn.18014e0f8
mov rcx, r14
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18014e2d0
lea rbx, [rcx + rdi]
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18014e2ec
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdx, r9
mov r8, qword [rsp + 0x50]
mov rcx, rsi
mov rbx, r9
call qword [sym.imp.VCRUNTIME140.dll_memcmp]
test eax, eax
je 0x18014e35a
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x38]
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18014e35a
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x38]
mov rdi, rbx
mov rdx, qword [rsp + 0x50]
rep movsb byte [rdi], byte [rsi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18014fd64
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x35
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18014fd71
xor edx, edx
mov word [rcx + 0x6e], dx
ret
Function at 0x180169414
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x54
jb 0x180169421
mov word [rcx + 0xac], r11w
ret

Function at 0x1801694e4
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x68
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x1801694f1
xor edx, edx
mov word [rcx + 0xd4], dx
ret

Function at 0x180169528
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x43
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x180169535
xor edx, edx
mov word [rcx + 0x8a], dx
ret

Function at 0x180169598
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x2e
jb 0x1801695a5
mov word [rcx + 0x60], r11w
ret

Function at 0x1801695cc
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x5e
jb 0x1801695d9
mov word [rcx + 0xc0], r11w
ret

Function at 0x180169650
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x4e
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18016965d
xor edx, edx
mov word [rcx + 0xa0], dx
ret

Function at 0x1801696d8
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x47
jb 0x1801696e5
mov word [rcx + 0x92], r11w
ret

Function at 0x180169750
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x6d
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18016975d
xor edx, edx
mov word [rcx + 0xde], dx
ret

Function at 0x18016979c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x3b
jb 0x1801697a9
mov word [rcx + 0x7a], r11w
ret

Function at 0x1801697d0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x21
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1801697dd
mov byte [rcx + 0x25], r10b
ret
Function at 0x18016a62c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x24
jb 0x18016a639
mov word [rcx + 0x4c], r11w
ret

Function at 0x18016a6e8
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x4d
jb 0x18016a6f5
mov word [rcx + 0x9e], r11w
ret

Function at 0x18016a750
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x39
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18016a75d
xor edx, edx
mov word [rcx + 0x76], dx
ret

Function at 0x18016a79c
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x3d
jb 0x18016a7a9
mov word [rcx + 0x7e], r11w
ret

Function at 0x18016a808
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
lea rax, [rcx + 4]
mov r9d, r11d
mov r10, rax
movzx edx, word [r10]
mov r8d, dword [rcx]
add r8w, r9w
inc r9
xor r8w, dx
mov word [r10], r8w
lea r10, [r10 + 2]
cmp r9, 0x31
jb 0x18016a815
mov word [rcx + 0x66], r11w
ret

Function at 0x18016a83c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x33
mov r9, rax
movzx edx, word [r9]
mov r8d, dword [rcx]
xor r8w, dx
mov word [r9], r8w
lea r9, [r9 + 2]
sub r10, 1
jne 0x18016a849
xor edx, edx
mov word [rcx + 0x6a], dx
ret