joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005e670
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x3c], 0
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x18005e69b
call sym.FactoryGameEGS_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::UpdateSettings_void____ptr64
mov ecx, dword [rbx + 0xc]
test ecx, ecx
je 0x18005e6e2
sub ecx, 1
je 0x18005e6c7
cmp ecx, 1
jne 0x18005e6e2
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov r8, rsi
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, rbx
call sym.FactoryGameEGS_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::ProcessHighShelf_float_const____ptr64__float____ptr64__float_const____ptr64__int____ptr64
jmp 0x18005e6fb
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov r8, rsi
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, rbx
call sym.FactoryGameEGS_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::ProcessLowShelf_float_const____ptr64__float____ptr64__float_const____ptr64__int____ptr64
jmp 0x18005e6fb
mov eax, dword [rsp + 0x60]
mov r9, rdi
mov r8, rsi
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, rbx
call sym.FactoryGameEGS_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::ProcessBell_float_const____ptr64__float____ptr64__float_const____ptr64__int____ptr64
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp sym.FactoryGameEGS_SignalProcessing.dll_protected:_void___cdecl_Audio::FDynamicStateVariableFilter::ClearFilterDenormals_void____ptr64
Function at 0x18008dc20
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
mov r9, rdx
mov edx, ecx
test r8d, r8d
jle 0x18008dc92
cmp r8d, 0x10
jb 0x18008dc92
movaps xmm2, xmmword [0x1800f11d0]
lea rax, [r9 + 0x20]
movsxd r10, r8d
and r10, 0xfffffffffffffff0
nop dword [rax]
nop dword [rax + rax]
movups xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
add edx, 0x10
movaps xmm1, xmm2
add rcx, 0x10
mulps xmm1, xmm0
movups xmmword [rax - 0x60], xmm1
movaps xmm1, xmm2
movups xmm0, xmmword [rax - 0x50]
mulps xmm0, xmm2
movups xmmword [rax - 0x50], xmm0
movups xmm0, xmmword [rax - 0x40]
mulps xmm1, xmm0
movups xmmword [rax - 0x40], xmm1
movups xmm0, xmmword [rax - 0x30]
mulps xmm0, xmm2
movups xmmword [rax - 0x30], xmm0
cmp rcx, r10
jl 0x18008dc50
movsxd rcx, edx
movsxd r8, r8d
cmp rcx, r8
jge 0x18008dd01
movaps xmm2, xmmword [0x1800ecd00]
mov rax, r8
sub rax, rcx
cmp rax, 4
jl 0x18008dcea
mov rdx, r8
lea rax, [r9 + 8]
sub rdx, rcx
lea rax, [rax + rcx*4]
sub rdx, 4
shr rdx, 2
inc rdx
lea rcx, [rcx + rdx*4]
nop dword [rax]
movups xmm0, xmmword [rax - 8]
lea rax, [rax + 0x10]
xorps xmm0, xmm2
movups xmmword [rax - 0x18], xmm0
sub rdx, 1
jne 0x18008dcd0
cmp rcx, r8
jge 0x18008dd01
movss xmm0, dword [r9 + rcx*4]
xorps xmm0, xmm2
movss dword [r9 + rcx*4], xmm0
inc rcx
cmp rcx, r8
jl 0x18008dcea
ret

Function at 0x18008fb60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 8]
jmp sym.FactoryGameEGS_SignalProcessing.dll_public:_bool___cdecl_Audio::FSpectrumAnalyzer::PerformAnalysisIfPossible_bool____ptr64
Function at 0x18009ecf0
Capabilities:
Encode data using xor

Disassembly:
movsxd rcx, dword [rsp + 0x28]
mov r10, r9
movss xmm3, dword [0x1800ecd00]
movaps xmm0, xmm2
mov r9, rcx
xorps xmm0, xmm3
movaps xmm1, xmm2
and r9, 0xfffffffffffffffc
sub rdx, r10
unpcklps xmm1, xmm0
movlhps xmm1, xmm1
test r9, r9
jle 0x18009ed45
lea r8, [r9 - 1]
mov rax, r10
shr r8, 2
inc r8
nop dword [rax]
movups xmm0, xmmword [rdx + rax]
lea rax, [rax + 0x10]
mulps xmm0, xmm1
movups xmmword [rax - 0x10], xmm0
sub r8, 1
jne 0x18009ed30
cmp r9, rcx
jge 0x18009ed89
sub rcx, r9
lea rax, [r10 + 4]
dec rcx
lea rax, [rax + r9*4]
shr rcx, 1
inc rcx
nop
lea rax, [rax + 8]
movaps xmm0, xmm2
mulss xmm0, dword [rdx + rax - 0xc]
movaps xmm1, xmm2
movss dword [rax - 0xc], xmm0
mulss xmm1, dword [rax + rdx - 8]
xorps xmm1, xmm3
movss dword [rax - 8], xmm1
sub rcx, 1
jne 0x18009ed60
ret
Function at 0x1800a7e50
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov eax, dword [rcx + 0x44]
mov ebp, edx
movaps xmmword [rsp + 0x50], xmm6
mov rbx, rcx
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x20], xmm9
mov edi, r8d
test eax, eax
je 0x1800a7fdb
xor r15d, r15d
xor eax, eax
lock cmpxchg dword [rcx + 0x1c], r15d
mov edx, eax
xor eax, eax
lock cmpxchg dword [rcx + 0x20], r15d
mov ecx, eax
cmp eax, edx
jl 0x1800a7ea8
sub ecx, edx
jmp 0x1800a7eaf
mov eax, dword [rbx + 0x18]
sub eax, edx
add ecx, eax
cmp ecx, ebp
jge 0x1800a7fdb
test r8d, r8d
je 0x1800a801a
cmp dword [rbx + 0x18], ebp
jb 0x1800a801a
mov rsi, qword [rbx + 0x48]
nop
test rsi, rsi
jne 0x1800a7ef6
xor ecx, ecx
call qword [sym.imp.FactoryGameEGS_Core.dll_public:_static_class_FEvent____ptr64___cdecl_FGenericPlatformProcess::GetSynchEventFromPool_bool_]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [rbx + 0x48], rcx
mov rsi, rax
jne 0x1800a7ef0
mov rsi, rcx
jmp 0x1800a7ef6
call qword [sym.imp.FactoryGameEGS_Core.dll_public:_static_void___cdecl_FGenericPlatformProcess::ReturnSynchEventToPool_class_FEvent____ptr64_]
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [sym.imp.FactoryGameEGS_Core.dll_double_FGenericPlatformTime::SecondsPerCycle]
xorps xmm6, xmm6
cvtsi2sd xmm6, qword [rsp + 0x90]
movsd xmm7, qword [0x1800f0e68]
xorps xmm0, xmm0
mulsd xmm6, qword [rax]
mov eax, dword [rbx + 0x44]
cvtsi2sd xmm0, rdi
addsd xmm6, xmm7
mulsd xmm0, qword [0x1800f0df8]
addsd xmm6, xmm0
test eax, eax
je 0x1800a7fdb
movsd xmm8, qword [0x1800f0e50]
xorps xmm9, xmm9
xor eax, eax
lock cmpxchg dword [rbx + 0x1c], r15d
mov edx, eax
xor eax, eax
lock cmpxchg dword [rbx + 0x20], r15d
mov ecx, eax
cmp eax, edx
jl 0x1800a7f70
sub ecx, edx
jmp 0x1800a7f77
mov eax, dword [rbx + 0x18]
sub eax, edx
add ecx, eax
cmp ecx, ebp
jge 0x1800a7fdb
mov rax, qword [rsi]
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call qword [rax + 0x20]
cmp edi, 0xffffffff
je 0x1800a7fd0
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [sym.imp.FactoryGameEGS_Core.dll_double_FGenericPlatformTime::SecondsPerCycle]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0xa8]
movaps xmm1, xmm6
mulsd xmm0, qword [rax]
addsd xmm0, xmm7
subsd xmm1, xmm0
mulsd xmm1, xmm8
comisd xmm1, xmm9
jbe 0x1800a8007
cvttsd2si rdi, xmm1
mov eax, dword [rbx + 0x44]
test eax, eax
jne 0x1800a7f54
mov al, 1
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rbx + 0x44]
test eax, eax
je 0x1800a7fdb
mov rcx, rbx
call sym.FactoryGameEGS_SignalProcessing.dll_public:_int___cdecl_Audio::FPatchOutput::GetNumSamplesAvailable_void_const___ptr64
cmp eax, ebp
jge 0x1800a7fdb
xor al, al
jmp 0x1800a7fdd
Function at 0x1800b7b98
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov eax, r9d
movaps xmmword [rsp], xmm6
mov r10, rdx
xorps xmm6, xmm6
cdq
sub eax, edx
sar eax, 1
movsxd r9, eax
xor eax, eax
test r9, r9
jle 0x1800b7c5a
movss xmm0, dword [r8 + rax*8]
movss xmm5, dword [rcx]
movss xmm4, dword [rcx + 4]
subss xmm0, xmm5
movss xmm2, dword [rcx + 8]
mulss xmm0, dword [0x1800f2888]
addss xmm5, xmm0
addss xmm0, dword [r8 + rax*8]
movss dword [rcx], xmm0
movss xmm3, dword [r8 + rax*8 + 4]
movaps xmm0, xmm3
subss xmm0, xmm4
addss xmm4, xmm5
mulss xmm0, dword [0x1800f286c]
addss xmm4, xmm0
addss xmm0, xmm3
xorps xmm3, xmmword [0x1800ecd00]
movaps xmm1, xmm3
subss xmm1, xmm2
addss xmm2, xmm5
mulss xmm4, dword [0x1800ecab8]
movss dword [rcx + 4], xmm0
mulss xmm1, dword [0x1800f286c]
addss xmm2, xmm1
addss xmm3, xmm1
mulss xmm2, xmm2
movss dword [rcx + 8], xmm3
movss dword [r10 + rax*4], xmm4
inc rax
addss xmm6, xmm2
cmp rax, r9
jl 0x1800b7bbc
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x1800dbd6c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
test byte [rsp + 0x88], 1
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r13, rcx
je 0x1800dbdb4
mov r8d, 0x31
lea rdx, str..._.._.._third_party_opus_src_silk_NLSF_VQ.c
lea rcx, str.assertion_failed:___LPC_order__1____0
call fcn.1800ab7c4
movsxd rbp, dword [rsp + 0x80]
test rbp, rbp
jle 0x1800dbea9
movsxd r9, dword [rsp + 0x88]
xor r11d, r11d
mov r10, r9
neg r10
add r10, r10
sub rbx, rdi
lea r14, [r9 - 2]
lea rax, [r9 + r9]
xor r12d, r12d
and dword [rsp + 0x88], r12d
test r14, r14
js 0x1800dbe8f
mov ebp, dword [rsp + 0x88]
lea r13, [r14 + rsi]
inc r14
mov r15, r9
shr r15, 1
lea rax, [rdi + r14*2]
mov r14, rax
movzx ecx, byte [r13 + 1]
movzx eax, word [rbx + r14]
shl cx, 7
sub ax, cx
sar ebp, 1
movzx ecx, byte [r13]
lea r13, [r13 - 2]
movsx r8d, ax
movsx eax, word [r14]
lea r14, [r14 - 4]
imul r8d, eax
shl cx, 7
mov eax, r8d
sar r8d, 1
sub eax, ebp
cdq
xor eax, edx
sub eax, edx
add r12d, eax
movzx eax, word [rbx + r14 + 2]
sub ax, cx
movsx ebp, ax
movsx eax, word [r14 + 2]
imul ebp, eax
mov eax, ebp
sub eax, r8d
cdq
xor eax, edx
sub eax, edx
add r12d, eax
sub r15, 1
jne 0x1800dbe13
movsxd rbp, dword [rsp + 0x80]
lea r14, [r9 - 2]
mov r13, qword [rsp + 0x60]
lea rax, [r9 + r9]
mov dword [r13 + r11*4], r12d
add rsi, r9
inc r11
add rdi, rax
add rbx, r10
cmp r11, rbp
jl 0x1800dbde4
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800dd3fc
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x1800dd474
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x1800dd474
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x1800dd474
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x1800dd468
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x1800dd486
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1800dd456
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x1800dd476
Function at 0x2fc4d56f0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d67d0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d60f2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f8108]
test eax, eax
je 0x2fc4d618a
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f8110]
mov qword [rbp - 8], rax
jmp 0x2fc4d616e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d6162
cmp qword [rbp - 0x10], 0
je 0x2fc4d6162
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d6128
lea rax, [0x2fc4f80e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d618b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d6290
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d62b8
mov eax, 0
jmp 0x2fc4d6306
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d62e1
mov eax, 0
jmp 0x2fc4d6306
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d6301
mov eax, 0
jmp 0x2fc4d6306
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d630c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d638a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d6381
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d6381
mov rax, qword [rbp - 8]
jmp 0x2fc4d639f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d6354
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ce160
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4cf240
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4ceb62
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f1108]
test eax, eax
je 0x2fc4cebfa
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f1110]
mov qword [rbp - 8], rax
jmp 0x2fc4cebde
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4cebd2
cmp qword [rbp - 0x10], 0
je 0x2fc4cebd2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4ceb98
lea rax, [0x2fc4f10e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4cebfb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4ced00
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4ced28
mov eax, 0
jmp 0x2fc4ced76
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4ced51
mov eax, 0
jmp 0x2fc4ced76
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4ced71
mov eax, 0
jmp 0x2fc4ced76
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4ced7c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4cedfa
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4cedf1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4cedf1
mov rax, qword [rbp - 8]
jmp 0x2fc4cee0f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4cedc4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180004f08
Capabilities:
Encode data using xor

Disassembly:
mov r9d, dword [rsp + 0x30]
lea r11d, [r8 + 0x6c]
lea eax, [r11 + 0x52]
add r8d, 0xfffff8dc
lea r10d, [rcx + 0x12a]
lea edx, [r9 - 0x9ff]
cmp r10d, eax
jl 0x180004f92
lea ecx, [rdx + 0x8ea]
lea eax, [r9 - 0x322]
cmp eax, ecx
jge 0x180004fdf
mov rax, qword [section..data]
mov rcx, qword [rsp + 0x28]
cmp dword [rax + 0x14], 0x6b08
jae 0x180004f6f
mov eax, dword [0x18022f088]
sub eax, dword [rcx + 0x64]
xor eax, dword [rcx + 0x5c]
xor eax, 0x8a3a
mov dword [rcx + 0x5c], eax
jmp 0x180004f79
mov dword [0x18022f094], 0x2d978
mov eax, dword [rcx + 0xf4]
xor eax, dword [rcx + 0x84]
xor eax, 0x98ae612c
mov dword [rcx + 0x84], eax
jmp 0x180004fdf
mov rax, qword [rsp + 0x28]
mov ecx, dword [rax + 0x50]
sub ecx, 0x6b8
imul ecx, r10d
cmp dword [0x18022f174], ecx
jbe 0x180004fdf
mov rax, qword [section..data]
mov ecx, dword [rax + 0x38]
mov eax, edx
and eax, r8d
cmp ecx, eax
jne 0x180004fdf
mov r9d, dword [0x18022f038]
add r9d, edx
or r9d, 0x742
xor r8d, r9d
mov eax, edx
and eax, r8d
add ecx, 3
cmp ecx, eax
je 0x180004fd0
lea eax, [r11 + 0x26f]
ret
Function at 0x180004fe8
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x88]
lea ebx, [r8 - 0x869]
mov esi, eax
lea ebp, [r9 - 0xa2]
xor esi, 0xeb4
mov r10d, ecx
lea r15d, [rax - 0x869]
lea eax, [r15 + 0x95b]
cmp ebx, eax
je 0x18000524c
mov rdi, qword [rsp + 0x80]
mov eax, dword [rdi + 0xb4]
add eax, 0x17ee
mov dword [0x18022f094], eax
cmp esi, r8d
jge 0x18000524c
lea ecx, [rbx + 0x95b]
lea eax, [r10 - 0x81]
cmp eax, ecx
jge 0x1800051ce
add dword [rdi + 0x84], 0x2e184
lea r9d, [rdx - 0x100]
mov eax, r15d
lea edx, [rbx + 0x9f0]
xor eax, 0x8c6
lea ecx, [r15 + 0x6ee]
xor ebp, 0xfb4
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], eax
mov dword [r11 - 0x38], r8d
lea r8, [0x18022f010]
call fcn.18000732c
add esi, 0x27e
mov r10d, 0x77bda
xor r9d, r9d
mov rax, qword [section..data]
mov ecx, dword [rax + 0x10c]
add ecx, dword [0x18022f07c]
mov rax, qword [0x18022f0d8]
xor ecx, 1
sub dword [0x18022f074], ecx
movsxd rcx, dword [0x18022f098]
mov r8d, dword [r9 + rax]
add r9, 4
imul r8d, dword [rdi + 0x84]
mov rax, qword [rdi + 0xd0]
mov edx, r8d
shr edx, 8
mov byte [rcx + rax], dl
inc dword [0x18022f098]
movsxd rcx, dword [rdi + 0x88]
mov rax, qword [0x18022f0e0]
mov byte [rcx + rax], r8b
mov eax, r10d
sub eax, dword [rdi + 0x8c]
inc dword [rdi + 0x88]
add dword [0x18022f07c], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0x8c]
add ecx, dword [rdi + 0x150]
mov eax, dword [rdi + 0x10]
xor ecx, r10d
imul eax, ecx
mov dword [rdi + 0x10], eax
mov eax, dword [0x18022f020]
add dword [rdi + 0x6c], eax
mov eax, dword [0x18022f0ec]
mov ecx, dword [0x18022f060]
inc eax
sub ecx, dword [0x18022f110]
add ecx, eax
mov dword [0x18022f0ec], ecx
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x38]
add eax, dword [0x18022f104]
xor eax, 0x2334c5
sub dword [rcx + 0x8c], eax
mov eax, dword [0x18022f0b4]
mov ecx, dword [rdi + 0x120]
dec eax
add ecx, eax
mov rax, qword [section..data]
mov dword [0x18022f0b4], ecx
mov ecx, dword [rax + 0x78]
sub ecx, 0x12
or dword [rdi + 0xa4], ecx
cmp r9, 0xadb08
jl 0x1800050c0
jmp 0x18000524c
mov edx, dword [0x18022f048]
mov r14d, ebp
mov eax, edx
and eax, ebx
imul eax, dword [rdi + 0x168]
cmp ebp, eax
jbe 0x18000524c
mov r8, qword [section..data]
mov eax, dword [r8 + 0xe4]
mov ecx, dword [rdi + 0x6c]
sub eax, 0x670
cmp ecx, eax
jb 0x180005238
mov eax, dword [r8 + 0x100]
sub eax, ebx
cmp ebp, eax
ja 0x180005238
or ecx, 0x670
sub ecx, 0x790
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
mov edx, dword [0x18022f048]
mov eax, r15d
mov r8, qword [section..data]
sub eax, esi
add eax, 0x6ee
or ebx, eax
mov eax, edx
add r14d, 3
and eax, ebx
imul eax, dword [rdi + 0x168]
cmp r14d, eax
ja 0x1800051ed
mov rbx, qword [rsp + 0x60]
lea eax, [rsi - 0x2a3]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180005964
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov ebp, dword [rsp + 0x68]
lea esi, [rdx - 0x869]
mov r14, qword [rsp + 0x60]
mov edi, r8d
mov r8, qword [section..data]
mov ebx, r9d
add ebp, 0xfffffc71
lea r9d, [rcx + 0xbe]
xor edi, 0xecb
xor ebx, 0xfd
mov eax, dword [r8 + 4]
cmp dword [0x18022f118], eax
jb 0x1800059d0
mov dword [r14 + 0x84], 0x83b
mov r8, qword [section..data]
mov eax, dword [0x18022f094]
add ebx, 0x372
mov ecx, dword [r8 + 0x120]
add eax, 0x60a1800f
add ecx, eax
lea eax, [rdx - 0x8fd]
mov dword [0x18022f094], ecx
cmp esi, eax
je 0x180005ac5
lea eax, [rsi + 0x68d]
cmp r9d, eax
jle 0x180005a2f
mov eax, dword [0x18022f020]
cmp dword [r8 + 0xf8], eax
jbe 0x180005ac5
lea rax, [0x180264200]
mov qword [r8 + 0xc8], rax
jmp 0x180005ac5
mov eax, dword [0x18022f028]
and eax, ebx
cmp ebp, eax
jae 0x180005ac5
mov edx, dword [0x18022f17c]
mov ecx, dword [r8 + 0x150]
add edx, ebp
add ecx, dword [r8 + 0x100]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov rcx, qword [section..data]
mov edx, dword [r14 + 0x12c]
mov r10d, dword [r14 + 0xf4]
mov eax, esi
sub r10d, edi
mov r11d, dword [rcx + 0x168]
mov r8d, dword [rcx + 0x16c]
xor r11, rax
mov ecx, dword [0x18022f024]
add r8d, ebp
movsxd rax, ebp
add ecx, 0xfffff7dc
mov qword [rsp + 0x28], r11
or rcx, 0x724
movsxd r9, edi
xor r9, rax
imul r8d, ebx
mov eax, dword [r14 + 0x28]
or rdx, rax
mov dword [rsp + 0x20], r10d
mov eax, ebp
or rdx, rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
lea eax, [rdi + 0xa4]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret