joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009da90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
movsxd rax, edx
mov rdi, rcx
dec rax
mov qword [r11 + 0x18], rbp
mov rbp, r9
xor r9d, r9d
lea rax, [rcx + rax*2]
mov qword [rsp + 8], rax
cmp rcx, rax
jae 0x18009dcb9
mov qword [r11 + 0x20], rsi
lea rsi, [0x180000000]
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov qword [rsp], r8
test rbp, rbp
je 0x18009daf2
cmp r8, rbp
jae 0x18009dc96
movzx edx, byte [r8]
test dl, dl
je 0x18009dc96
mov eax, edx
mov rcx, rbp
shr rax, 3
movsx r9, byte [rax + rsi + 0xfad30]
xor eax, eax
test r9d, r9d
mov ebx, eax
sete bl
add ebx, r9d
test rbp, rbp
jne 0x18009db28
movsxd rcx, ebx
add rcx, r8
cmp r8, rcx
mov r14d, edx
cmovae r14d, eax
lea rax, [r8 + 1]
cmp rax, rcx
jae 0x18009db41
movzx r13d, byte [rax]
jmp 0x18009db44
xor r13b, r13b
lea rax, [r8 + 2]
cmp rax, rcx
jae 0x18009db53
movzx r12d, byte [rax]
jmp 0x18009db56
xor r12b, r12b
lea rax, [r8 + 3]
cmp rax, rcx
jae 0x18009db65
movzx r15d, byte [rax]
jmp 0x18009db68
xor r15b, r15b
lea r11, [r9*4]
movzx eax, r14b
mov esi, dword [r11 + rsi + 0xfad50]
and esi, eax
movzx r9d, r13b
shl esi, 6
mov eax, r9d
and eax, 0x3f
movzx edx, r12b
or esi, eax
movzx r10d, r15b
shl esi, 6
and r9d, 0xc0
mov eax, edx
and edx, 0xc0
and eax, 0x3f
or esi, eax
mov eax, r10d
and eax, 0x3f
shr r10d, 2
or r10d, edx
shl esi, 6
or esi, eax
shr r10d, 2
or r10d, r9d
lea rax, [0x180000000]
mov ecx, dword [r11 + rax + 0xfad80]
shr r10d, 2
shr esi, cl
mov ecx, 0x100
cmp esi, dword [r11 + rax + 0xfad68]
sbb eax, eax
xor r9d, r9d
and eax, 0x40
mov edx, r9d
or r10d, eax
mov eax, esi
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, pe_nt_image_headers64
cmove edx, eax
mov eax, r9d
or r10d, edx
cmp esi, 0xffff
cmova eax, ecx
or r10d, eax
lea rax, [0x180000000]
mov ecx, dword [r11 + rax + 0xfad98]
xor r10d, 0x2a
sar r10d, cl
test r10d, r10d
je 0x18009dc73
test r14b, r14b
mov eax, r9d
mov ecx, r9d
mov esi, 0xfffd
setne cl
test r15b, r15b
setne al
add ecx, eax
mov eax, r9d
test r12b, r12b
setne al
add ecx, eax
mov eax, r9d
test r13b, r13b
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
movsxd r8, ecx
add r8, qword [rsp]
jmp 0x18009dc7d
movsxd rax, ebx
add r8, rax
test esi, esi
je 0x18009dc96
mov word [rdi], si
add rdi, 2
lea rsi, [0x180000000]
cmp rdi, qword [rsp + 8]
jb 0x18009dae0
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
mov word [rdi], r9w
test rax, rax
je 0x18009dccf
mov qword [rax], r8
sub rdi, rcx
sar rdi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1800c0470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180116800]
mov rcx, qword [rax + 0x4af8]
mov r10, qword [rax + 0x3eb0]
movsxd rax, dword [rcx + 0x7c]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x68
mov rax, qword [r10 + 0x290]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x230], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x290]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [r9 + 0x57]
mov rdx, qword [r10 + 0x290]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp 0x1800b7720

Function at 0x1800c0540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180116800]
mov rcx, qword [rax + 0x4af8]
mov r9, qword [rax + 0x3eb0]
movups xmm0, xmmword [r9 + 0x230]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x290]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x230], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x290]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [rcx + 0x20f]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x290]
add rsp, 0x38
jmp 0x1800b7720
Function at 0x1800c0bc0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm7
movaps xmm7, xmm3
movzx ebp, r8b
mov r8d, edx
xor edx, edx
call fcn.18009d580
mov edi, eax
mov dword [rsp + 0x20], edi
mov eax, dword [0x18011e330]
xor esi, esi
movss xmm6, dword [0x1800f9e94]
test al, 1
jne 0x1800c0ca0
or eax, 1
mov dword [0x18011e330], eax
xorps xmm0, xmm0
movss dword [0x18011e2f0], xmm0
mov qword [0x18011e2f8], rsi
mov qword [0x18011e300], rsi
lea ecx, [rsi + 0x18]
call fcn.1800e6830
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18011e2f8], rax
mov qword [0x18011e308], rsi
xorps xmm0, xmm0
movdqa xmmword [0x18011e310], xmm0
mov qword [0x18011e320], 7
mov qword [0x18011e328], 8
mov dword [0x18011e2f0], 0x3f800000
mov r8, rax
lea edx, [rsi + 0x10]
lea rcx, [0x18011e308]
call fcn.18005bcb0
nop
lea rcx, [0x1800f8d40]
call fcn.1800e9be0
nop
nop dword [rax]
movzx r14d, dil
movabs rax, 0xcbf29ce484222325
xor r14, rax
movabs rcx, 0x100000001b3
imul r14, rcx
movzx eax, byte [rsp + 0x21]
xor r14, rax
imul r14, rcx
movzx eax, byte [rsp + 0x22]
xor r14, rax
imul r14, rcx
movzx eax, byte [rsp + 0x23]
xor r14, rax
imul r14, rcx
mov rcx, qword [0x18011e320]
and rcx, r14
add rcx, rcx
mov r8, qword [0x18011e308]
mov rax, qword [r8 + rcx*8 + 8]
mov rdx, qword [0x18011e2f8]
cmp rax, rdx
je 0x1800c0d21
mov rcx, qword [r8 + rcx*8]
cmp edi, dword [rax + 0x10]
je 0x1800c0d24
cmp rax, rcx
je 0x1800c0d21
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x1800c0d11
jmp 0x1800c0d24
mov rax, rsi
mov rbx, rdx
test rax, rax
cmovne rbx, rax
cmp rbx, rdx
jne 0x1800c0d98
mov dword [rsp + 0x20], edi
movss dword [rsp + 0x24], xmm7
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
lea rcx, [0x18011e2f0]
call fcn.1800c06d0
and r14, qword [0x18011e320]
add r14, r14
mov rcx, qword [0x18011e308]
mov rax, qword [rcx + r14*8 + 8]
mov rbx, qword [0x18011e2f8]
cmp rax, rbx
je 0x1800c0d91
mov rcx, qword [rcx + r14*8]
cmp edi, dword [rax + 0x10]
je 0x1800c0d8e
nop
cmp rax, rcx
je 0x1800c0d91
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x1800c0d80
mov rsi, rax
test rsi, rsi
cmovne rbx, rsi
call fcn.18009ca10
subss xmm6, dword [rax + 0x10]
mulss xmm6, dword [rsp + 0x98]
movss xmm2, dword [rbx + 0x14]
movaps xmm1, xmm2
subss xmm1, xmm7
andps xmm1, xmmword [0x1800fa260]
movss xmm0, dword [0x1800f9e34]
comiss xmm0, xmm1
jbe 0x1800c0dd0
test bpl, bpl
je 0x1800c0df0
test bpl, bpl
je 0x1800c0dde
movss xmm7, dword [rsp + 0x90]
movaps xmm1, xmm2
movaps xmm2, xmm7
subss xmm2, xmm1
mulss xmm2, xmm6
addss xmm2, xmm1
movss dword [rbx + 0x14], xmm2
movaps xmm0, xmm2
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
mov rsp, r11
pop r14
ret
Function at 0x1800d44f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rsi
sub rsp, 0x40
mov esi, r8d
mov rbx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x1800d450f
mov rdx, qword [rdx]
mov r8d, 0x84222325
movzx eax, byte [rdx]
test al, al
je 0x1800d4538
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1b3
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x1800d4520
lea rdx, [rsp + 0x20]
call fcn.1800d6030
cmp qword [rsp + 0x30], 0
jne 0x1800d45fc
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800d458b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d4586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d465b
call fcn.1800e6850
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d45dc
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800d45d7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d4655
mov rcx, r8
call fcn.1800e6850
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov eax, esi
mov byte [rbx], 0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rsi
ret
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call fcn.1800e7f90
mov esi, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800d458b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d4586
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d465b
jmp 0x1800d4586
call fcn.18005beb0
nop
call fcn.18005beb0
int3
Function at 0x1800d4670
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
movaps xmm6, xmm2
mov rbx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x1800d468f
mov rdx, qword [rdx]
mov r8d, 0x84222325
movzx eax, byte [rdx]
test al, al
je 0x1800d46b8
nop dword [rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1b3
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x1800d46a0
lea rdx, [rsp + 0x20]
call fcn.1800d6030
cmp qword [rsp + 0x30], 0
jne 0x1800d477d
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800d470b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d4706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d47e1
call fcn.1800e6850
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d475c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800d4757
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d47db
mov rcx, r8
call fcn.1800e6850
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
movaps xmm0, xmm6
mov byte [rbx], 0
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
ret
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call fcn.1800e7e00
xorps xmm6, xmm6
cvtsd2ss xmm6, xmm0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1800d470b
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d4706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d47e1
jmp 0x1800d4706
call fcn.18005beb0
nop
call fcn.18005beb0
int3
Function at 0x1800d4c70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x60
movzx edi, r8b
mov rbx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x1800d4c98
mov rdx, qword [rdx]
mov r8d, 0x84222325
movzx eax, byte [rdx]
test al, al
je 0x1800d4cc8
nop word [rax + rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1b3
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x1800d4cb0
lea rdx, [rsp + 0x40]
call fcn.1800d6030
mov r8, qword [rsp + 0x50]
test r8, r8
jne 0x1800d4d61
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1800d4d1e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800d4d18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d4e85
call fcn.1800e6850
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d4d58
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800d4d53
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d4e8b
mov rcx, r8
call fcn.1800e6850
movzx eax, dil
jmp 0x1800d4e5d
movabs rax, 0x63c1d737b062b585
mov qword [rsp + 0x20], rax
movabs rcx, 0x1f2612ab48b276e
mov qword [rsp + 0x28], rcx
movabs rax, 0x63c1d737d517c7f1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1800d4db1
lea rcx, [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
cmp rbp, 0x10
setae r14b
mov rdi, qword [rsp + 0x40]
cmovae rcx, rdi
cmp r8, rax
jne 0x1800d4ded
lea rdx, [rsp + 0x20]
call fcn.1800e8c90
test eax, eax
jne 0x1800d4ded
mov sil, 1
jmp 0x1800d4df0
xor sil, sil
test r14b, r14b
je 0x1800d4e23
lea rdx, [rbp + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800d4e1a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800d4e85
mov rcx, rdi
call fcn.1800e6850
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d4e59
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800d4e54
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d4e8b
mov rcx, r8
call fcn.1800e6850
movzx eax, sil
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.18005beb0
nop
call fcn.18005beb0
int3
Function at 0x1800d4ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov r9, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x1800d4ec7
mov r9, qword [rdx]
mov edi, 0x84222325
movzx eax, byte [r9]
test al, al
je 0x1800d4ef7
nop dword [rax]
nop dword [rax + rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1b3
lea r9, [r9 + 1]
movzx eax, byte [r9]
test al, al
jne 0x1800d4ee0
mov edx, r8d
lea rcx, [rsp + 0x20]
call fcn.1800d7170
mov r8, rax
mov edx, edi
mov rcx, rsi
call fcn.1800d6670
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d4f48
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800d4f43
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d4f6b
mov rcx, r8
call fcn.1800e6850
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.18005beb0
int3

Function at 0x1800d4f80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov r8, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x1800d4fa7
mov r8, qword [rdx]
mov edi, 0x84222325
movzx eax, byte [r8]
test al, al
je 0x1800d4fd7
nop dword [rax]
nop dword [rax + rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1b3
lea r8, [r8 + 1]
movzx eax, byte [r8]
test al, al
jne 0x1800d4fc0
movaps xmm1, xmm2
lea rcx, [rsp + 0x20]
call fcn.1800d72d0
mov r8, rax
mov edx, edi
mov rcx, rsi
call fcn.1800d6670
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d5028
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800d5023
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d504b
mov rcx, r8
call fcn.1800e6850
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.18005beb0
int3
Function at 0x1800d5680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
mov r9, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x1800d56a7
mov r9, qword [rdx]
mov edi, 0x84222325
movzx eax, byte [r9]
test al, al
je 0x1800d56d7
nop dword [rax]
nop dword [rax + rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1b3
lea r9, [r9 + 1]
movzx eax, byte [r9]
test al, al
jne 0x1800d56c0
movabs rcx, 0x63c1d737d517c7f1
test r8b, r8b
je 0x1800d5727
movabs rax, 0x63c1d737b062b585
mov qword [rsp + 0x20], rax
movabs rax, 0x1f2612ab48b276e
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
jmp 0x1800d5766
movabs rax, 0x63c1d752a67ba697
mov qword [rsp + 0x30], rax
movabs rax, 0x1f2612ab48b276e
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1800d5790
lea rcx, [rsp + 0x40]
call fcn.18005d8e0
lea r8, [rsp + 0x40]
mov edx, edi
mov rcx, rsi
call fcn.1800d6670
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800d57ea
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800d57e5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d5810
mov rcx, r8
call fcn.1800e6850
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
call fcn.18005beb0
int3
Function at 0x1800d5b00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
xor r13d, r13d
mov qword [rcx], r13
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r13b
lea rdi, [rcx + 0x20]
mov qword [rdi], r13
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r13b
cmp rcx, rdx
je 0x1800d5b67
cmp qword [rdx + 0x18], 0x10
jb 0x1800d5b5e
mov rdx, qword [rdx]
mov r8, qword [r14 + 0x10]
call fcn.18005d8e0
movabs rax, 0x63c1d737d517c783
mov qword [rsp + 0x20], rax
movabs rcx, 0x1f2612ab48b276e
mov qword [rsp + 0x28], rcx
movabs rax, 0x63c1d737d517c7f1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x20], xmm0
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1800d5bb8
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call fcn.1800e8460
mov r15, rax
test rax, rax
je 0x1800d5c87
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.1800e8690
mov rcx, r15
call fcn.1800e88c0
movsxd rbx, eax
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.1800e8690
test ebx, ebx
jg 0x1800d5c05
mov rcx, r15
call fcn.1800e81a0
jmp 0x1800d5c87
mov rcx, rbx
call fcn.1800e6830
mov rbp, rax
mov qword [rsp + 0x90], rax
mov r9, r15
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.1800e8570
mov r12, rax
mov rcx, r15
call fcn.1800e81a0
cmp r12, rbx
jne 0x1800d5c79
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call fcn.18005d8e0
cmp qword [rdi + 0x18], 0x10
jb 0x1800d5c53
mov rdi, qword [rdi]
mov ecx, 0x84222325
movzx eax, byte [rdi]
test al, al
je 0x1800d5c76
nop
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1b3
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
test al, al
jne 0x1800d5c60
mov dword [rsi + 0x40], ecx
test rbp, rbp
je 0x1800d5c87
mov rcx, rbp
call fcn.1800e6850
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x1800d5cbd
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x1800d5cb8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800d5ce8
mov rcx, r8
call fcn.1800e6850
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rax, rsi
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18005beb0
int3

Function at 0x1800d5ff0
Capabilities:
Encode data using xor

Disassembly:
ret
cmp qword [rcx + 0x18], 0x10
jmp 0x180029b08
jb 0x180029b14
mov rcx, qword [rcx]
ror dh, 0x87
movzx eax, byte [rcx]
mov edx, 0x84222325
stc
test al, al
jmp 0x180062dbc
add rcx, 0x20
jmp 0x180029a6c
je 0x180062e01
nop word [rax + rax]
cmp bl, 0x90
movsx eax, al
cmp r10b, r13b
cmp esi, 0xb4a62a2e
test dil, spl
lea rcx, [rcx + 1]
cmp r12b, spl
xor eax, edx
movzx edx, r12w
imul edx, eax, 0x1b3
movzx eax, byte [rcx]
test esi, r12d
test r9w, 0x861d
test al, al
jne 0x180062dcb
mov eax, edx
jmp 0x1800299e2
jmp 0x180061970
Function at 0x1800e9170
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword gs:[0x30]
movzx ebp, dl
mov edi, ecx
mov r8, qword [rax + 0x60]
mov rsi, qword [r8 + 0x18]
add rsi, 0x20
mov r10, qword [rsi]
cmp r10, rsi
je 0x1800e925a
nop word [rax + rax]
movzx ebx, word [r10 + 0x48]
xorps xmm0, xmm0
xor eax, eax
shr rbx, 1
xor r9d, r9d
mov dword [rsp + 0x60], eax
movups xmmword [rsp], xmm0
movups xmmword [rsp + 0x10], xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
add rbx, 0xfffffffffffffffc
je 0x1800e921b
mov r11, qword [r10 + 0x50]
nop dword [rax + rax]
movzx edx, word [r11]
lea r11, [r11 + 2]
movzx r8d, dl
sub dx, 0x41
cmp dx, 0x19
lea eax, [r8 + 0x20]
movzx ecx, al
cmova ecx, r8d
mov byte [rsp + r9], cl
inc r9
cmp r9, rbx
jne 0x1800e91f0
test edi, edi
je 0x1800e9272
movzx eax, byte [rsp]
lea rdx, [rsp]
mov r8d, 0x84222325
test al, al
je 0x1800e9249
movsx ecx, al
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
xor ecx, r8d
imul r8d, ecx, 0x1b3
test al, al
jne 0x1800e9231
cmp edi, r8d
je 0x1800e9272
mov r10, qword [r10]
cmp r10, rsi
jne 0x1800e91b0
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
test bpl, bpl
je 0x1800e92a3
mov rcx, qword [r10 - 0x10]
mov rax, qword [r10 - 8]
mov qword [rcx + 8], rax
mov rcx, qword [r10 - 8]
mov rax, qword [r10 - 0x10]
mov qword [rcx], rax
mov rcx, qword [r10]
mov rax, qword [r10 + 8]
mov qword [rcx + 8], rax
mov rcx, qword [r10 + 8]
mov rax, qword [r10]
mov qword [rcx], rax
mov rax, qword [r10 + 0x20]
jmp 0x1800e925c

Function at 0x1800e92b0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
movzx ebp, r8b
mov rsi, rdx
mov r14d, ecx
mov r9, qword [rax + 0x60]
mov rdi, qword [r9 + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1800e9312
nop dword [rax]
mov rcx, qword [rbx + 0x20]
cmp rsi, rcx
je 0x1800e930a
movzx r8d, bpl
mov edx, r14d
call fcn.1800e9330
test rax, rax
jne 0x1800e9314
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1800e92f0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret