joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14081b96e
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x18]
ret 8
neg qword [rsp + 8]
lea r14, [r14 + r14*2 + 0xef82f4f]
and r14d, dword [rsp + 0xb]
add r14, qword [rsp + 8]
xor dword [rsp + 8], 0x1f1f202a
neg r14
or r14, r14
add qword [rsp + 0x10], 0xffffffffbf6fe3bc
bswap r14d
add qword [rsp], 0xffffffffbf70d101
movzx r14d, r14b
add qword [rsp + 0x18], 0x191c7
cmp word [rsp + 8], 0x280e
cmovg r14w, word [rsp + 8]
add qword [rsp + 8], r14
je 0x14081b980
neg r14b
jo 0x1408845dc
and r14w, 0x223d
cmp dword [rsp + 8], 0x7bf614db
setns byte [rsp + 8]
sub byte [rsp + 8], 0xf6
or r14, 0x69002d5c
mov word [rsp + 8], r14w
mov r14, qword [rsp + 0x20]
test dword [rsp + 8], 0x305f2339
setle byte [rsp + 8]
sub qword [rsp + 8], 0x5cf37bed
xor byte [rsp + 8], 0x85
not dword [rsp + 8]
or byte [rsp + 8], 0xf0
add qword [rsp + 8], 0x3db1003e
mov word [rsp + 8], 0x482a
ja 0x1407bbd97
xchg dword [rdx], ecx
mov edx, 0x36db9f98
cmp ecx, 0x9e81d723
test dword [rax], ebp
push rsp
push rbx
add ebp, dword [rbx]
invalid
lea r13, [r13 + 0x13be4067]
movsx r13d, byte [rsp + 0x33]
neg byte [rsp + 0x30]
cmp r9, qword [rsp + 0x30]
mov r13, qword [rsp + 0x50]
mov r9, qword [rsp + 0x28]
lea rsp, [rsp + 0x58]
ret 8
mov word [rsp + 0x10], 0x48a
movabs rdx, 0x7d8d28745e59130e
and word [rsp + 0x10], 0x16db
cmp byte [rsp + 0x10], dh
cmovne edx, dword [rsp + 0x10]
neg rdx
movsxd rdx, dword [rsp + 0x10]
and dx, 0x37ac
neg edx
lea rdx, [rdx*2 + 0x67a63d6]
mov qword [rsp + 0x10], 0xffffffffff676540
not dx
neg dx
xor dx, 0x1a8
and edx, 0x79747ac4
setg dl
ja 0x1408c37d3
ja 0x1408612d8
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.14090a415
lea rdi, [rdi + rdi + 0x31553ef7]
add rdi, 0x73077d57
neg di
sub edi, edi
lea rdi, [rdi + rdi*2 + 0x34fc61be]
jle 0x140441219
and rsi, rsi
pop r9
sub rbx, qword [rsp + 8]
sub word [rsp + 8], 0x5748
test byte [rsp + 8], 0xb7
bswap rdx
movzx r13w, word [rsp + 0xe]
movzx si, si
lea rbx, [r13 + rsi*2 + 0x8d87814]
jne 0x140884664
mov rbx, qword [rsp + 0x28]
jne fcn.140442ccc
and sil, byte [rsp + 0x1a]
mov r13, qword [rsp + 0x18]
mov byte [rsp + 0x18], 0x87
test qword [rsp + 0x18], 0x31b859d0
lea r13, [rsi*4 + 0x39f47120]
bswap rsi
call fcn.1408a7a11
push r14
mov r14, rdx
and r14w, 0x140d
test dl, 0xb2
jo 0x1408caa66
movsx edx, dx
call fcn.140901c30
push rdx
not word [rsp + 0x10]
jg 0x140884590
and byte [rdx - 0x69], bh
imul ebp, ebp, 0x62237bc9
push rsp
xor al, 6
push rdx
cmp esi, esi
cmp ebp, dword [rdx + 0x42]
cmp esi, ebp
xchg ecx, eax
rcr dword [rbp - 0x60cc809c], 0xbd
ficom dword [rsi - 0x12]
cmp dword [rdx - 0x55], esp
pop rbx
not ecx
popfq
not byte [rdx + 0x5fbda104]
stosq qword [rdi], rax
movabs byte [0x1c52bd98bea312bd], al
xchg esi, eax
and esp, dword [rdx - 0x33]
jmp 0x1452a8926

Function at 0x14081c0bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor esi, 0x3f9b3d5a
jbe 0x1408db54f
mov r11, r13
not r11w
setb r13b
mov rbx, qword [rsp + 0x48]
sub word [rsp + 0x58], 0x62b5
movzx esi, r11b
Function at 0x14081fa63
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add r15w, word [rsp + 0xc]
neg word [rsp + 8]
add r15b, 0x31
cmp qword [rsp + 8], r15
movzx r15w, r15b
mov r15, qword [rsp + 0x10]
mov word [rsp + 8], 0x2e6f
call fcn.14086edd4
invalid
test dword [rsp + 0x40], 0x1e7d27e1
jge 0x140445229
push r15
push 0x21a5696f
pushfq
mov r15, qword [rsp + 8]
or r15w, 0x5a09
add byte [rsp + 8], r15b
and dword [rsp + 8], r15d
cmp word [rsp + 8], 0x27e9
not word [rsp + 8]
jg 0x14081aaee

Function at 0x14083756a
Capabilities:
Encode data using xor

Disassembly:
neg byte [rsp + 0x40]
or bpl, bpl
cmp bpl, 1
setae byte [rsp + 0x40]
neg rbp
mov rbp, qword [rsp + 0x38]
jae 0x1407e143a
mov qword [rsp + 0x50], 0xa495cd1
or word [rsp + 0x50], 0x7a2e
add dword [rsp + 0x40], 0x35385a19
xor qword [rsp + 0x40], 0x35a60b89
sub byte [rsp + 0x40], 0xa7
or word [rsp + 0x50], 0x214b
xor dword [rsp + 0x40], 0x62d047b7
add dword [rsp + 0x50], 0x2670f79
xor dword [rsp + 0x50], 0x680c21fc
not dword [rsp + 0x50]
sub qword [rsp + 0x50], 0x12ad3d72
add byte [rsp + 0x50], 0xce
call fcn.1407cfd60
test dword [rdi - 0x9187a72], 0x69a47f42
loope 0x140837654
or eax, 0xc388713d
scasb al, byte [rdi]
popfq
wait
sti
and eax, 0x5d9c7c63
push rsp
packssdw mm1, qword [rax + rbx*8 + 0x4f]
nop
cdq
retf
invalid

Function at 0x1408395f6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not rdi
jl 0x1407d528b
add qword [rsp + 8], 0xffffffffffc0f872
mov r8, qword [rsp + 0x18]
call fcn.1407ae1b6
pushfq
add qword [rsp + 8], 0xffffffffffb482bb
call fcn.140830550

Function at 0x14083d99b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp eax, 0x41c068a1
push rax
pushfq
push 0xffffffff9c5041c0
movabs r8, 0x307a09ce635e0277
push 0x16c054c3
not r8
neg byte [rsp]
sub qword [rsp], r8
test dword [rsp], r8d
call fcn.140824ea9
lea r13, [r14*2 + 0x12cf4f68]
not r13b
neg r8d
lea r14, [r8*4 + 0x16a83cf3]
mov r14, qword [rsp + 0x50]
call fcn.14081149b
jl 0x1407e74f8
imul eax, dword [rbp - 0x7798cbb8], 0x38c5c64
mov gs, word [rbp + riz + 0x1e]
jne 0x1407e74fa
invalid
neg r14b
sete byte [rsp + 0x38]
xor word [rsp + 0x38], r8w
sete byte [rsp + 0x38]
lea r8, [r14*4 + 0x64714716]
add r8w, word [rsp + 0x39]
and r14d, 0x3b4869be
jne 0x1407e7524
Function at 0x14086db86
Capabilities:
Encode data using xor

Disassembly:
jge 0x1408463be
lea rsi, [rdx + 0x5a1d3388]
jg 0x1408d1f0f
mov rsi, qword [rsp + 0x20]
lea rdx, [rdx*2 + 0x542c0480]
cmp word [rsp + 8], 0x28b2
mov dl, byte [rsp + 8]
seta dl
xor edx, dword [rsp + 0xa]
add qword [rsp + 8], 0x1ae44e6b
add qword [rsp + 0x28], 0xfffffffffff01b38
lea rdx, [rdx*2 + 0x50e76162]
not dword [rsp + 8]
lea rdx, [rdx + rdx + 0x4ff2176f]
test byte [rsp + 8], 0xe2
jns 0x14079d6ec
jo 0x1407f370e
push r14
pushfq
movabs r14, 0x6ed7793070d5760b
call fcn.140429005
leave
xor byte [rax + rbx*4 - 0x4f28aea3], bh
cmp edi, 0xffffffbf
or byte [rsi + rbx*2 + 0x71], bl
push rsi
sbb eax, 0xa8f8333e
or al, 0x23
mov edi, ebp
jle 0x1408d1f1c
rcl bh, 0xae
imul ecx, dword [rbp + 0x6a], 6
xchg edx, eax
out 0xfa, eax
jne 0x1408d1fc2
cmp byte [rax + rbp - 0x18], dh
invalid
fmul qword [rcx + rbx*2 + 0x26e1b051]
xchg esi, eax
in al, dx
mov bl, 0x41
invalid

Function at 0x1408777ab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
call fcn.1408103a2
push 0x20
mov esp, eax
xor bh, byte [rdi]
loop 0x14043ccf0
xor al, 0x15
push rbp
je 0x14043cca0
test dword fs:[rbx + rax], ebp
loope 0x14043ccee
lodsd eax, dword [rsi]
int1
pop rsi
fsubr qword [rax - 0x3b]
test dword [rbx], esi
outsb dx, byte [rsi]
mov byte [rsi], ch
xchg edx, eax
int3
or eax, 0xe2a8dc4a
invalid
mov edx, dword [rsi + 0x5d3df344]
invalid
xchg esi, eax
cmp eax, 0xb2a825d
cmp eax, 0xb2a825d
enter 0xffffffffffffdaf3, 0x4f
cmp byte [r11 + r12*8 - 0x57777d41], r12b
test eax, 0xc4a8916
xchg ebx, eax
and bl, cl
jbe 0x14043cced
stc
xchg ecx, eax
mov ss, word [rcx + 0x3d]
movsd dword [rdi], dword [rsi]
invalid
sub bl, 0x62
add bx, 0x79ab
test rbx, 0x3b70583f
movsx ebx, bx
push r10
jae 0x14043cc78

Function at 0x140895f34
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x38], 0x19342fc5
cmovne r9d, dword [rsp + 0x3b]
movsxd r9, dword [rsp + 0x38]
mov byte [rsp + 0x38], r9b
neg r9
setb byte [rsp + 0x38]
jno 0x1407f0a28

Function at 0x1408be762
Capabilities:
Encode data using xor

Disassembly:
push r11
add dil, byte [rsp + 0x2e]
setns r11b
or r10w, word [rsp + 0x2c]
cmp r11, 0x6cd4022e
movsx r11d, r13w
push r9
cmovo r10, rbp
and r11, qword [rsp + 0x30]
mov byte [rsp + 0x30], r13b
not rbp
sub qword [rsp + 8], 0x16a77453
and r13w, word [rsp + 0xe]
mov r13, qword [rsp + 0x40]
or qword [rsp + 0x30], 0x3a263753
mov r14, r11
add word [rsp + 8], r10w
or r11, r14
xor word [rsp + 0x30], r14w
add r11w, r15w
add qword [rsp + 0x18], 0xfffffffffff6c8df
add dword [rsp + 0x30], r10d
lea r10, [r10 + rbp*2 + 0x641a4945]
movzx rbp, word [rsp + 0x30]
mov r14, qword [rsp + 0x10]
lea rsp, [rsp + 0x18]
ret
movsx esi, sil
add qword [rsp + 8], 0xffffffffbf766858
lea r9, [r12*8 + 0x32e94b06]
xor r9w, 0x1390
add word [rsp + 0x28], 0x6635
mov r9, qword [rsp + 0x48]
setb byte [rsp + 0x28]
mov rbx, qword [rsp + 0x28]
movabs rbp, 0x141a38413643304a
bswap ebp
add rbx, qword [rsp + 0x28]
lea rbx, [r12*2 + 0xd069f7]
sub qword [rsp + 0x28], rsi
setb r10b
xor sil, 0x43
call fcn.140861300
cmp edi, 0x663504e1
push r14
jne 0x14042ea28
loope 0x1408be706
invalid
Function at 0x1408da6eb
Capabilities:
Encode data using xor

Disassembly:
push r14
pushfq
movabs r14, 0x78404ec5749d0f4f
push r15
or r14w, 0x7ed6
mov r14d, 0xce12f5c
movabs r15, 0x65c5079133854e92
movsxd r15, r14d
push r15
xor byte [rsp], 0xa1
push rdi
je 0x1408da715
call fcn.1408f2eff
Function at 0x14002934c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c944
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c944
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002949c
cmp rax, 0xffffffffffffffff
je 0x14002949c
xor edi, edi
test rbp, rbp
jle 0x140029447
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f258
mov rbx, rax
test rax, rax
jne 0x1400293d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002943d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a278
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d620
cmp eax, 0xffffffff
je 0x14002941d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400293e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a278
jmp 0x14002943d
cmp byte [rsi + 0x38], dil
je 0x140029434
cmp dword [rsi + 0x34], 5
jne 0x140029434
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002943d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b00c
jmp 0x1400294b0
jns 0x1400294b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c944
cmp rax, 0xffffffffffffffff
jne 0x140029468
cmp byte [rsi + 0x30], dil
je 0x1400294b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400294b0
mov ecx, r14d
call fcn.140018730
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400294b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400294b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400294a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400294ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c944
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1400018f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001942
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001942
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001942
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001942
cmp dword [rcx + 0x84], 0xe
jbe 0x140001942
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001944
xor al, al
add rsp, 0x28
ret
Function at 0x14002924c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001c844
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001c844
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002939c
cmp rax, 0xffffffffffffffff
je 0x14002939c
xor edi, edi
test rbp, rbp
jle 0x140029347
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f158
mov rbx, rax
test rax, rax
jne 0x1400292d4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002933d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a178
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d520
cmp eax, 0xffffffff
je 0x14002931d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400292e4
mov edx, r15d
mov ecx, r14d
call fcn.14001a178
jmp 0x14002933d
cmp byte [rsi + 0x38], dil
je 0x140029334
cmp dword [rsi + 0x34], 5
jne 0x140029334
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002933d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001af0c
jmp 0x1400293b0
jns 0x1400293b0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001c844
cmp rax, 0xffffffffffffffff
jne 0x140029368
cmp byte [rsi + 0x30], dil
je 0x1400293b0
mov edi, dword [rsi + 0x2c]
jmp 0x1400293b0
mov ecx, r14d
call fcn.140018630
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400293b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400293b0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400293a9
mov eax, dword [rsi + 0x2c]
jmp 0x1400293ae
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001c844
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x947590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
ja 0x9475a2
add bl, 0x20
bts rax, r11
bsr ax, r15w
lea eax, [rdi - 0x41]
stc
cmp al, 0x19
jmp fcn.0097982b
movzx edi, byte [r12]
movsx ecx, r9w
inc r13
bswap ax
inc r12
rol cx, cl
cwde
clc
mov eax, 0xc730ce15
stc
movzx cx, bpl
mov ecx, esi
rol eax, cl
add al, sil
jmp 0x964ccd
inc rsi
xor bl, al
cbw
neg al
lea eax, [rbx - 0x41]
clc
cmp al, 0x19
jmp 0x947590
movzx ebx, byte [r13]
jmp 0x9504c5

Function at 0x9594ae
Capabilities:
Encode data using base64

Disassembly:
jle 0x964784
cbw
movsx ax, r9b
mov qword [rsp + 0x10], rax
lea rsp, [rsp + 0x10]

Function at 0x9594b4
Capabilities:
Encode data using base64

Disassembly:
jle 0x964784
cbw
movsx ax, r9b
mov qword [rsp + 0x10], rax
lea rsp, [rsp + 0x10]
Function at 0x1411a04c4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1411a04ce
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1411a04f7
pop rbp
sub rbp, 0x33
sub rbp, 0x11a04c4
sub rsp, 0x20
jmp 0x1411a0516
mov rax, 0x11a04c4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x1ad2a966
xor byte [rax], dl
inc rax
dec rcx
jne 0x1411a0535
jmp 0x1411a054c
out dx, eax
invalid
Function at 0x180001010
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov rdx, rcx
mov rcx, qword [0x1800056c8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800010a4
mov rax, rbx
shr rax, 0x10
test ax, ax
jne 0x180001069
mov r8, rbx
lea rdx, [0x180003388]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rbx, [rsp + 0x20]
mov r8, rbx
lea rdx, [0x180003390]
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 0x10
lea r8, str.AheadLibEx
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180001960
add rsp, 0x280
pop rbx
ret
Function at 0x180002700
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r14, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1800027a7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800027a7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd430fbb5
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800027a2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002780
cmp r8d, 0x9c6eb627
je 0x1800027ac
test r9d, r9d
jne 0x180002760
mov rax, qword [rax]
jmp 0x180002730
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r10
add rcx, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov rcx, r14
add rdx, r10
call rdx
mov rcx, 0xffffffffffffffff
lea rbp, [rax + 1]
mov eax, 2
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.1800116d0
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002877
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002877
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x5149c562
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180002872
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x180002850
cmp r8d, 0xa9f87b56
je 0x18000287c
test r9d, r9d
jne 0x180002830
mov rcx, qword [rcx]
jmp 0x180002800
mov ecx, dword [r11 + 0x24]
mov r8, rbp
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rdx, r14
add rax, r10
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800028c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002967
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002967
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd41da12f
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002962
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002940
cmp r8d, 0x10447133
je 0x18000296c
test r9d, r9d
jne 0x180002920
mov rax, qword [rax]
jmp 0x1800028f0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002d80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002e57
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002e57
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x94687b49
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002e52
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002e30
cmp r8d, 0x476d3fbb
je 0x180002e5c
test r9d, r9d
jne 0x180002e10
mov rax, qword [rax]
jmp 0x180002de0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180014c70]
addsd xmm8, qword [0x180014c70]
movups xmm9, xmmword [0x180014ba8]
movups xmm10, xmmword [0x18001b300]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.180002700
cmp word [rax], 0
je 0x180002ed6
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002ec0
xor edx, edx
add ecx, 1
je 0x180002eda
mov rdx, rax
jmp 0x180002eda
xor edx, edx
mov ecx, edx
mov rax, qword [0x180017788]
movaps xmm0, xmmword [0x180014f00]
mov rbx, qword [0x180017810]
mov qword [rsp + 0x20], rax
mov rax, qword [0x18001b7a8]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002f88
mov rax, qword [0x180017930]
lea r8, str.Canvas.K2_DrawText
add rax, 0x18e7260
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001b7a8], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x260]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret