joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180018c50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x180018c70
and qword [r8], 0
lea rdx, [0x180054e30]
call fcn.180018b68
mov rbx, rax
test rax, rax
je 0x180018d61
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x180018d58
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180018d58
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180018d58
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180018d58
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x180018d58
mov rax, qword [0x180060f98]
test rax, rax
je 0x180018cf5
inc dword [rax + 0x3bc]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x180018d58
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x180018d45
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180060f98]
test rax, rax
je 0x180018d3a
dec dword [rax + 0x3bc]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180018d61
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x180018d53
mov qword [rsi], rbp
mov rax, rdi
jmp 0x180018d63
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180026150
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x180060f98]
cmp byte [rbx + 0x2f30], 0
je 0x180026211
cmp qword [rbx + 0x2f38], 0
lea rbp, [rax + 0x10]
lea rdi, [rbx + 0x2f40]
je 0x180026203
mov r9d, dword [rdi + 4]
test r9d, r9d
jns 0x1800261bb
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1800275f0
mov rcx, qword [rsp + 0x40]
and dword [rdi], 0
mov rdx, rcx
mov rcx, rdi
mov r8, rbp
call fcn.180019348
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x2f38]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x180060f66]
movsxd r8, eax
mov rax, qword [rbx + 0x2f48]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180026211
mov rdx, rcx
mov r8, rbp
mov rcx, rdi
call fcn.180019348
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x1800267b8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x180060f98]
mov rbx, rcx
and dword [rax + 0x2ef8], 0
test rcx, rcx
je 0x180026821
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.18002682c
lea rdx, [0x180054e34]
mov rcx, rbx
mov rdi, rax
call fcn.180018b68
mov rbx, rax
test rax, rax
je 0x180026821
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18003ff40
Capabilities:
Access peb ldr_data

Disassembly:
cmp qword [rcx + 0x30], 0
jne 0x18003ff5e
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rdx, qword [rax + 0x20]
jmp 0x18003ff62
mov rdx, qword [rcx + 0x10]
movups xmm0, xmmword [rdx - 0x10]
movaps xmmword [rcx], xmm0
movups xmm1, xmmword [rdx]
movaps xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x10]
movaps xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x20]
movaps xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x30]
movaps xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x40]
movaps xmmword [rcx + 0x50], xmm1
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x60], xmm0
mov rax, qword [rcx + 0x30]
ret

Function at 0x18003ffa0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov rax, qword [rdx + 0x18]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x18003ffe4
nop word [rax + rax]
cmp qword [rax + 0x30], rcx
je 0x18003ffcf
mov rax, qword [rax]
test rax, rax
jne 0x18003ffc0
ret
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rdx], rcx
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov qword [rdx + 8], rcx
ret

Function at 0x18003fff0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 1
call fcn.18003fe50
mov rcx, rax
call fcn.180040070
mov rcx, rax
mov rdx, rbx
call fcn.180040100
test rax, rax
jne 0x18004005b
lea ecx, [rax + 3]
call fcn.18003fe50
mov rcx, rax
call fcn.180040070
mov rcx, rax
mov rdx, rbx
call fcn.180040100
test rax, rax
jne 0x18004005b
lea ecx, [rax + 2]
call fcn.18003fe50
mov rcx, rax
call fcn.180040070
mov rcx, rax
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180040100
add rsp, 0x20
pop rbx
ret

Function at 0x180040100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov r11, rcx
mov rbx, rdx
mov ecx, dword [rax + rcx + 0x88]
add rcx, r11
mov esi, dword [rcx + 0x1c]
mov ebp, dword [rcx + 0x24]
add rsi, r11
add rbp, r11
cmp rdx, 0xffff
ja 0x180040154
sub bx, word [rcx + 0x10]
movzx eax, bx
cmp eax, dword [rcx + 0x14]
jae 0x18004018e
movzx eax, bx
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x180040190
mov r10d, dword [rcx + 0x20]
xor r9d, r9d
mov edi, dword [rcx + 0x18]
add r10, r11
test edi, edi
je 0x18004018e
nop word [rax + rax]
mov edx, dword [r10]
mov rcx, rbx
add rdx, r11
call 0x180040860
test eax, eax
je 0x1800401a5
inc r9d
add r10, 4
cmp r9d, edi
jb 0x180040170
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x180040190
Function at 0x180040430
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180060020]
xor rax, rsp
mov qword [rbp - 8], rax
movdqa xmm0, xmmword [0x180055740]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x74706563
mov dword [rbp - 0x1c], 0x486e6f69
mov dword [rbp - 0x18], 0x6c646e61
mov word [rbp - 0x14], 0x7265
mov byte [rbp - 0x12], 0
call fcn.18003fff0
lea rdx, [0x180040420]
mov ecx, 1
call rax
movdqa xmm0, xmmword [0x180055730]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x20], 0x69666974
mov dword [rbp - 0x1c], 0x69746163
mov word [rbp - 0x18], 0x6e6f
mov byte [rbp - 0x16], 0
call fcn.18003fff0
lea r9, [rbp - 0x10]
xor r8d, r8d
lea rdx, [0x18003fe30]
xor ecx, ecx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180045160
add rsp, 0x50
pop rbp
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180040790
test eax, eax
jne 0x18004063f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180040720
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.180040650
mov qword [0x180060fa8], rax
mov r8d, 0x40
movsxd rax, dword [rdi + 0x3c]
mov edx, dword [rax + rdi + 0x50]
call fcn.1800401c0
mov r8d, 1
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.180040580
lea r8, [0x180040970]
mov rdx, rdi
sub r8, rdi
mov rcx, rdi
add r8, rbx
call r8
mov rcx, rbx
call fcn.180040250
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180040430

Function at 0x180040e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov dword [rbp - 0x10], 0x61657243
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], 0x69466574
mov dword [rbp - 8], 0x57656c
call fcn.18003fff0
mov rcx, rbx
mov r10, rax
call fcn.18003fed0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call r10
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x46746547
mov rsi, rax
mov dword [rbp - 0xc], 0x53656c69
mov dword [rbp - 8], 0x657a69
call fcn.18003fff0
xor edx, edx
mov rcx, rsi
call rax
mov edx, eax
mov r8d, 4
mov ebx, eax
call fcn.1800401c0
lea rcx, [rbp - 0x10]
mov dword [rbp - 0x10], 0x64616552
mov rdi, rax
mov dword [rbp - 0xc], 0x656c6946
mov byte [rbp - 8], 0
call fcn.18003fff0
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
call rax
mov dword [rbp + 0x18], 0x6c43744e
lea rcx, [rbp + 0x18]
mov dword [rbp + 0x1c], 0x65736f
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x18], rax
call fcn.18003fff0
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x60]
mov rax, rdi
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x1800418e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180041b00
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800419e7
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180041944
mov rax, qword [0x180060008]
cmp qword [rsp + 0x20], rax
ja 0x180041944
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180041906
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180041973
jmp 0x1800419e7
cmp dword [rsp + 0x50], 0x10000
jne 0x1800419ca
cmp qword [rsp + 0x48], 0x10000
jb 0x1800419ca
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800419b8
mov rax, qword [rsp + 0x28]
jmp 0x1800419e9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800419e2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180041b00
mov qword [rsp + 0x20], rax
jmp 0x180041906
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800419f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180041b40
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180041af3
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180041a4b
mov rax, qword [0x180060008]
cmp qword [rsp + 0x20], rax
ja 0x180041a4b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180041a0d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180041a7a
jmp 0x180041af3
cmp dword [rsp + 0x50], 0x10000
jne 0x180041ad1
cmp qword [rsp + 0x48], 0x10000
jb 0x180041ad1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180041abf
mov rax, qword [rsp + 0x28]
jmp 0x180041af5
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180041aee
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180041b40
mov qword [rsp + 0x20], rax
jmp 0x180041a0d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180041b90
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180042120
mov qword [rsp + 0x28], 0
cmp qword [0x180060938], 0
jne 0x180041bd8
cmp qword [0x180060930], 0
je 0x180041bd8
mov rax, qword [0x180060930]
mov qword [0x180060938], rax
cmp qword [0x180060938], 0
je 0x180041c7e
mov rax, qword [0x180060938]
cmp qword [rax + 0x10], 0
je 0x180041c7e
mov rax, qword [0x180060938]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180041c7e
mov rax, qword [0x180060938]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180041c7e
mov rax, qword [0x180060938]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180041c44
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180041c4b
xor eax, eax
jmp 0x180041df9
mov rax, qword [0x180060938]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180041df9
mov rax, qword [0x180060930]
mov qword [0x180060938], rax
jmp 0x180041ca0
mov rax, qword [0x180060938]
mov rax, qword [rax + 8]
mov qword [0x180060938], rax
cmp qword [0x180060938], 0
je 0x180041ced
cmp qword [0x180060938], 0
je 0x180041ceb
mov rax, qword [0x180060938]
cmp qword [rax + 0x10], 0
je 0x180041ceb
mov rax, qword [0x180060938]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180041ceb
mov rax, qword [0x180060938]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180041ceb
jmp 0x180041c1c
jmp 0x180041c8e
mov rcx, qword [rsp + 0x60]
call fcn.180043d50
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180041e00
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180041df7
mov rax, qword [rsp + 0x48]
mov qword [0x180060938], rax
mov rax, qword [0x180060938]
mov dword [rax], 0x52727464
mov rax, qword [0x180060938]
mov qword [rax + 0x10], 0
mov rax, qword [0x180060938]
mov rcx, qword [0x180060930]
mov qword [rax + 8], rcx
mov rax, qword [0x180060938]
mov qword [0x180060930], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180060938]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180041da8
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180041de2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180041d9e
mov rax, qword [0x180060938]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180041c1c
xor eax, eax
add rsp, 0x58
ret
Function at 0x180003400
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180003461
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180003420
mov ecx, dword [r9]
jmp 0x180003548
cmp ecx, 0x4e0
jb 0x180003548
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x180003480
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800034d0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800039d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], rbp
mov r15, r9
lea rbp, [r8 - 1]
mov qword [rsp + 0x58], r13
sar rbp, 1
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov r12, rdx
mov r10, rdx
cmp rdx, rbp
jge 0x180003a67
nop dword [rax]
lea rbx, [r10 + r10]
lea rax, [rbx + 2]
lea rax, [rax + rax*2]
lea rdx, [rdi + rax*8]
lea r8, [rdx - 0x18]
call fcn.1800026b0
movzx r10d, al
lea rcx, [rsi + rsi*2]
xor r10, 1
inc r10
add r10, rbx
mov rsi, r10
lea rdx, [r10 + r10*2]
mov rax, qword [rdi + rdx*8]
mov qword [rdi + rcx*8], rax
mov eax, dword [rdi + rdx*8 + 8]
mov dword [rdi + rcx*8 + 8], eax
mov eax, dword [rdi + rdx*8 + 0xc]
mov dword [rdi + rcx*8 + 0xc], eax
mov eax, dword [rdi + rdx*8 + 0x10]
mov dword [rdi + rcx*8 + 0x10], eax
cmp r10, rbp
jl 0x180003a10
cmp r10, rbp
mov rbp, qword [rsp + 0x50]
jne 0x180003aa4
test r14b, 1
jne 0x180003aa4
lea rcx, [rsi + rsi*2]
lea rdx, [r14 + r14*2]
mov rax, qword [rdi + rdx*8 - 0x18]
lea rsi, [r14 - 1]
mov qword [rdi + rcx*8], rax
mov eax, dword [rdi + rdx*8 - 0x10]
mov dword [rdi + rcx*8 + 8], eax
mov eax, dword [rdi + rdx*8 - 0xc]
mov dword [rdi + rcx*8 + 0xc], eax
mov eax, dword [rdi + rdx*8 - 8]
mov dword [rdi + rcx*8 + 0x10], eax
mov r13, qword [rsp + 0x58]
cmp r12, rsi
jge 0x180003af9
nop
lea rbx, [rsi - 1]
mov r8, r15
sar rbx, 1
lea rax, [rbx + rbx*2]
lea r14, [rdi + rax*8]
mov rdx, r14
call fcn.1800026b0
test al, al
je 0x180003af9
mov rax, qword [r14]
lea rcx, [rsi + rsi*2]
mov qword [rdi + rcx*8], rax
mov rsi, rbx
mov eax, dword [r14 + 8]
mov dword [rdi + rcx*8 + 8], eax
mov eax, dword [r14 + 0xc]
mov dword [rdi + rcx*8 + 0xc], eax
mov eax, dword [r14 + 0x10]
mov dword [rdi + rcx*8 + 0x10], eax
cmp r12, rbx
jl 0x180003ab0
mov rax, qword [r15]
lea rcx, [rsi + rsi*2]
mov rbx, qword [rsp + 0x60]
mov qword [rdi + rcx*8], rax
mov eax, dword [r15 + 8]
mov dword [rdi + rcx*8 + 8], eax
mov eax, dword [r15 + 0xc]
mov dword [rdi + rcx*8 + 0xc], eax
mov eax, dword [r15 + 0x10]
mov dword [rdi + rcx*8 + 0x10], eax
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180003c70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov rax, qword gs:[0x60]
mov rsi, r8
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180003d07
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180003d07
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe44f4e45
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180003d02
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180003ce0
cmp r8d, 0x25f5cdc6
je 0x180003d0c
test r9d, r9d
jne 0x180003cc0
mov rax, qword [rax]
jmp 0x180003c90
mov ecx, dword [rbx + 0x24]
mov r8, rsi
add rcx, r10
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
add rax, r10
xor edx, edx
mov dword [rsp + 0x30], ecx
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
jmp rax

Function at 0x180008420
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x180008441
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18000846e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180008470
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1800084c9
test ecx, ecx
jle 0x1800084a9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1800084c9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1800084c9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
or dword [rsi], ecx
invalid
Function at 0x1800084f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180008521
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x180008538
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18000855b
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000855d
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180008599
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18000862e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1800085d4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18000860e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18000862e
cmp rbx, rax
ja 0x1800085e0
test rbx, rbx
je 0x18000862e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
add byte [rsi], cl
or dword [rcx], ecx
or dword [rcx], ecx
invalid