joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180012104
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xf0
mov rsi, r8
mov rdi, rdx
mov rdx, qword [0x18001a368]
test rdx, rdx
jne 0x1800121aa
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [str._e2__34_8]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800177f0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180017800]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180017810]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x180017820]
movaps xmmword [rdx + 0x3e], xmm0
mov dword [rdx + 0x4e], 0x30003c
mov word [rdx + 0x52], 0x5d
mov word [rdx + 0xa6], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x5d
inc rax
cmp rax, 0x54
jne 0x18001217b
mov word [rsp + 0xe8], 0
lea rcx, [rsp + 0x30]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a368], rax
cmp byte [0x18001a378], 1
jne 0x1800121fb
mov rcx, qword [0x18001a370]
lea rbx, [rsp + 0x40]
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
mov rax, qword [0x18001a1c0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rbx
xor r9d, r9d
call fcn.180014620
mov al, byte [rbx + 0x10]
add rsp, 0xf0
pop rbx
pop rdi
pop rsi
ret
mov byte [0x18001a378], 1
lea rdx, [0x180017ab0]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.18000e524
mov rcx, rax
mov qword [0x18001a370], rax
mov rdx, qword [0x18001a368]
jmp 0x1800121ba

Function at 0x18001222a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x118
mov rsi, rdx
mov rdx, qword [0x18001a380]
test rdx, rdx
jne 0x1800122db
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180017830]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017840]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180017850]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180017860]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [0x180017870]
movaps xmmword [rdx + 0x3e], xmm0
movaps xmm0, xmmword [str.:7_3_]
movaps xmmword [rdx + 0x4e], xmm0
mov dword [rdx + 0x5e], 0x250038
mov word [rdx + 0x62], 0x56
mov word [rdx + 0xc6], 0
mov eax, 1
movzx ecx, word [rdx - 2]
xor word [rsp + rax*2 + 0x40], cx
inc rax
cmp rax, 0x64
jne 0x1800122ac
mov word [rsp + 0x108], 0
lea rcx, [rsp + 0x30]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a380], rax
cmp byte [0x18001a390], 1
jne 0x18001233c
mov rcx, qword [0x18001a388]
xorps xmm0, xmm0
lea rdi, [rsp + 0x40]
movups xmmword [rdi + 8], xmm0
mov rax, qword [0x180019df8]
mov qword [rdi], rax
mov rax, qword [0x18001a1c0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rdi
xor r9d, r9d
call fcn.180014620
movups xmm0, xmmword [rdi + 8]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x118
pop rdi
pop rsi
ret
mov byte [0x18001a390], 1
lea rdx, [0x180017ab0]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.18000e524
mov rcx, rax
mov qword [0x18001a388], rax
mov rdx, qword [0x18001a380]
jmp 0x1800122eb
Function at 0x18001236a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x120
mov rdi, r8
mov rsi, rdx
mov rdx, qword [0x18001a398]
test rdx, rdx
jne 0x180012426
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180017890]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800178a0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800178b0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800178c0]
movaps xmmword [rdx + 0x2e], xmm0
movaps xmm0, xmmword [str.YHtIQ_RnY_X_PYW]
movaps xmmword [rdx + 0x3e], xmm0
movaps xmm0, xmmword [0x1800178e0]
movaps xmmword [rdx + 0x4e], xmm0
movabs rax, 0x590051005d0072
mov qword [rdx + 0x5e], rax
mov word [rdx + 0x66], 0x3c
mov word [rdx + 0xce], 0
mov eax, 1
movzx ecx, word [rdx - 2]
xor word [rsp + rax*2 + 0x40], cx
inc rax
cmp rax, 0x68
jne 0x1800123f7
mov word [rsp + 0x110], 0
lea rcx, [rsp + 0x30]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a398], rax
cmp byte [0x18001a3a8], 1
jne 0x180012481
mov rcx, qword [0x18001a3a0]
xorps xmm0, xmm0
lea rbx, [rsp + 0x40]
movups xmmword [rbx + 8], xmm0
mov qword [rbx], rdi
mov rax, qword [0x18001a1c0]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
mov r8, rbx
xor r9d, r9d
call fcn.180014620
movups xmm0, xmmword [rbx + 8]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x120
pop rbx
pop rdi
pop rsi
ret
mov byte [0x18001a3a8], 1
lea rdx, [0x180017ab0]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.18000e524
mov rcx, rax
mov qword [0x18001a3a0], rax
mov rdx, qword [0x18001a398]
jmp 0x180012436

Function at 0x1800124b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rdx, qword [0x18001a3b0]
test rdx, rdx
jne 0x18001251d
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x1800178f0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017900]
movaps xmmword [rdx + 0xe], xmm0
mov word [rdx + 0x1e], 0x57
mov word [rdx + 0x3e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x57
inc rax
cmp rax, 0x20
jne 0x1800124f1
mov word [rsp + 0x70], 0
lea rcx, [rsp + 0x2f]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a3b0], rax
mov rax, qword [0x18001a1c0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x2f]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.180014620
mov al, byte [rdi]
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x180012556
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rcx
mov rdx, qword [0x18001a3b8]
test rdx, rdx
jne 0x1800125c3
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180017910]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017920]
movaps xmmword [rdx + 0xe], xmm0
mov word [rdx + 0x1e], 0x32
mov word [rdx + 0x3e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x32
inc rax
cmp rax, 0x20
jne 0x180012597
mov word [rsp + 0x70], 0
lea rcx, [rsp + 0x2f]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a3b8], rax
mov rax, qword [0x18001a1c0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x2f]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.180014620
mov al, byte [rdi]
add rsp, 0x78
pop rdi
pop rsi
ret

Function at 0x1800125fc
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rsi, rcx
mov rdx, qword [0x18001a3c0]
test rdx, rdx
jne 0x180012681
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180017930]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017940]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180017950]
movaps xmmword [rdx + 0x1e], xmm0
mov dword [rdx + 0x2e], 0x740075
mov word [rdx + 0x32], 0x1a
mov word [rdx + 0x66], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x1a
inc rax
cmp rax, 0x34
jne 0x180012652
mov word [rsp + 0x98], 0
lea rcx, [rsp + 0x28]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a3c0], rax
mov rax, qword [0x18001a1c0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x28]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.180014620
mov rax, qword [rdi]
add rsp, 0xa8
pop rdi
pop rsi
ret

Function at 0x1800126be
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x98
mov rsi, rcx
mov rdx, qword [0x18001a3c8]
test rdx, rdx
jne 0x18001273d
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180017960]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017970]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180017980]
movaps xmmword [rdx + 0x1e], xmm0
mov dword [rdx + 0x2e], 0x1f007e
mov word [rdx + 0x62], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x1f
inc rax
cmp rax, 0x32
jne 0x18001270e
mov word [rsp + 0x94], 0
lea rcx, [rsp + 0x28]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a3c8], rax
mov rax, qword [0x18001a1c0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x28]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.180014620
mov rax, qword [rdi]
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x18001277a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov rsi, rcx
mov rdx, qword [0x18001a3d0]
test rdx, rdx
jne 0x180012803
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180017990]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800179a0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800179b0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800179c0]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x3e], 0x66
mov word [rdx + 0x7e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x66
inc rax
cmp rax, 0x40
jne 0x1800127d4
mov word [rsp + 0xb0], 0
lea rcx, [rsp + 0x2c]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a3d0], rax
mov rax, qword [0x18001a1c0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x2c]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.180014620
mov eax, dword [rdi]
add rsp, 0xb8
pop rdi
pop rsi
ret

Function at 0x18001283e
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rsi, rcx
mov rdx, qword [0x18001a3d8]
test rdx, rdx
jne 0x1800128cb
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [str._yPMKhZOPQ]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800179e0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800179f0]
movaps xmmword [rdx + 0x1e], xmm0
movabs rax, 0x560053007c004d
mov qword [rdx + 0x2e], rax
mov dword [rdx + 0x36], 0x3f004f
mov word [rdx + 0x72], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x3f
inc rax
cmp rax, 0x3a
jne 0x18001289c
mov word [rsp + 0xa4], 0
lea rcx, [rsp + 0x2c]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a3d8], rax
mov rax, qword [0x18001a1c0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x2c]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.180014620
mov eax, dword [rdi]
add rsp, 0xa8
pop rdi
pop rsi
ret

Function at 0x180012906
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rsi, rcx
mov rdx, qword [0x18001a3e0]
test rdx, rdx
jne 0x18001298c
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180017a00]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017a10]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180017a20]
movaps xmmword [rdx + 0x1e], xmm0
movabs rax, 0x5d002f00380034
mov qword [rdx + 0x2e], rax
mov word [rdx + 0x6a], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x5d
inc rax
cmp rax, 0x36
jne 0x18001295d
mov word [rsp + 0x9c], 0
lea rcx, [rsp + 0x2f]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a3e0], rax
mov rax, qword [0x18001a1c0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x2f]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.180014620
mov al, byte [rdi]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x1800129c8
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov rsi, rcx
mov rdx, qword [0x18001a3e8]
test rdx, rdx
jne 0x180012a4b
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180017a30]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017a40]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180017a50]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180017a60]
movaps xmmword [rdx + 0x2e], xmm0
mov word [rdx + 0x7a], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0xd
inc rax
cmp rax, 0x3e
jne 0x180012a1c
mov word [rsp + 0xac], 0
lea rcx, [rsp + 0x2f]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a3e8], rax
mov rax, qword [0x18001a1c0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x2f]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.180014620
mov al, byte [rdi]
add rsp, 0xb8
pop rdi
pop rsi
ret

Function at 0x180012a86
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc8
mov rsi, rcx
mov rdx, qword [0x18001a3f0]
test rdx, rdx
jne 0x180012b24
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180017a70]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180017a80]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180017a90]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180017aa0]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0xa000b000d0010
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], 0x64
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x64
inc rax
cmp rax, 0x48
jne 0x180012af5
mov word [rsp + 0xc0], 0
lea rcx, [rsp + 0x28]
xor r8d, r8d
call fcn.18000e524
mov rdx, rax
mov qword [0x18001a3f0], rax
mov rax, qword [0x18001a1c0]
lea rcx, [rsp + 0x30]
mov qword [rcx], rax
mov qword [rcx + 8], 0
mov qword [rsp + 0x20], rcx
lea rdi, [rsp + 0x28]
mov rcx, rsi
mov r8, rdi
xor r9d, r9d
call fcn.180014620
mov rax, qword [rdi]
add rsp, 0xc8
pop rdi
pop rsi
ret

Function at 0x180013310
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
xor esi, esi
mov r14, rbx
mov r14, qword [r14]
cmp r14, rbx
je 0x18001335a
test rdi, rdi
je 0x180013356
mov rdx, qword [r14 + 0x50]
mov rcx, rdi
xor r8d, r8d
call fcn.180013473
test al, al
je 0x180013336
mov rsi, qword [r14 + 0x20]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x180013367
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov r14d, dword [rcx + rax + 0x88]
cmp dword [rcx + r14 + 0x18], 0
je 0x1800133cd
mov rbx, rdx
mov rsi, rcx
xor edi, edi
xor r15d, r15d
mov eax, dword [rsi + r14 + 0x20]
mov ecx, dword [rsi + r14 + 0x24]
add rcx, rsi
movzx r12d, word [rcx + r15*2]
add rax, rsi
mov edx, dword [rax + r15*4]
add rdx, rsi
mov rcx, rbx
mov r8b, 1
call fcn.1800134d6
test al, al
jne 0x1800133d1
inc r15
mov eax, dword [rsi + r14 + 0x18]
cmp r15, rax
jb 0x180013393
jmp 0x1800133e0
xor edi, edi
jmp 0x1800133e0
mov eax, dword [rsi + r14 + 0x1c]
add rax, rsi
mov edi, dword [rax + r12*4]
add rdi, rsi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x1800133f1
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x180013458
movsxd rax, dword [rcx + 0x3c]
movzx r10d, word [rax + rcx + 6]
test r10, r10
je 0x180013458
add rax, rcx
movzx r9d, word [rax + 0x14]
add r9, rax
add r9, 0x18
xor eax, eax
xor r11d, r11d
mov bl, byte [r9]
test bl, bl
je 0x18001345c
mov esi, 1
movzx edi, byte [rdx + rsi - 1]
test edi, edi
je 0x18001345c
movzx ebx, bl
cmp edi, ebx
jne 0x18001344a
mov bl, byte [r9 + rsi]
inc rsi
test bl, bl
jne 0x18001342d
jmp 0x18001345c
inc r11
add r9, 0x28
cmp r11, r10
jne 0x180013421
jmp 0x18001346f
xor eax, eax
jmp 0x18001346f
test r8, r8
je 0x180013468
mov eax, dword [r9 + 8]
mov qword [r8], rax
mov eax, dword [r9 + 0xc]
add rax, rcx
pop rbx
pop rdi
pop rsi
ret
Function at 0x180014448
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x18001445f
mov r9d, dword [rax + r8 + 0x18]
lea r10, [rax + 1]
mov r11d, dword [rax + r8 + 0x20]
add r11, rax
sub r9, 1
jb 0x18001445f
mov esi, dword [r11 + r9*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x1800144cb
add rsi, r10
mov edi, 0x57b736d4
movsx ebx, bl
lea ebp, [rbx - 0x41]
mov r14d, ebx
or r14d, 0x20
cmp bpl, 0x1a
cmovae r14d, ebx
xor r14d, edi
imul edi, r14d, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x1800144a1
jmp 0x1800144d0
mov edi, 0x57b736d4
cmp edi, 0x12bc886a
jne 0x180014488
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + r9*2]
mov edx, dword [rdx + r8*4]
add rdx, rax
mov rcx, qword [rcx]
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp rdx

Function at 0x180014500
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
cmp rcx, qword [rdi + 8]
jne 0x1800145f4
lea rax, [rcx + rcx]
test rcx, rcx
mov edx, 1
cmovne rdx, rax
mov qword [rdi + 8], rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x180014546
mov r9d, dword [rax + r8 + 0x18]
lea r10, [rax + 1]
mov r11d, dword [rax + r8 + 0x20]
add r11, rax
sub r9, 1
jb 0x180014546
mov ebx, dword [r11 + r9*4]
mov r14b, byte [rax + rbx]
test r14b, r14b
je 0x1800145b8
add rbx, r10
mov ebp, 0xc09e4439
movsx r14d, r14b
lea r15d, [r14 - 0x41]
mov r12d, r14d
or r12d, 0x20
cmp r15b, 0x1a
cmovae r12d, r14d
xor r12d, ebp
imul ebp, r12d, 0x1000193
mov r14b, byte [rbx]
inc rbx
test r14b, r14b
jne 0x18001458a
jmp 0x1800145bd
mov ebp, 0xc09e4439
cmp ebp, 0x522519a1
jne 0x18001456f
shl rdx, 2
mov ecx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rcx, rax
add r8, rax
movzx r8d, word [r8 + r9*2]
mov r8d, dword [rcx + r8*4]
add r8, rax
mov rcx, qword [rdi]
call r8
mov qword [rdi], rax
mov rcx, qword [rdi + 0x10]
jmp 0x1800145f7
mov rax, qword [rdi]
lea rdx, [rcx + 1]
mov qword [rdi + 0x10], rdx
mov dword [rax + rcx*4], esi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180002da0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
xor r8, r8
push r8
push rax
pushfq
push r8
push rdx
sub rsp, 0xa8
push r8
push r15
push r14
push r13
push r12
push rbx
push r8
push rsi
push rdi
push rbp
push rax
push rdx
sub rsp, 0x290
movdqa xmmword [rsp + 0x2f0], xmm6
movdqa xmmword [rsp + 0x300], xmm7
movdqa xmmword [rsp + 0x310], xmm8
movdqa xmmword [rsp + 0x320], xmm9
movdqa xmmword [rsp + 0x330], xmm10
movdqa xmmword [rsp + 0x340], xmm11
movdqa xmmword [rsp + 0x350], xmm12
movdqa xmmword [rsp + 0x360], xmm13
movdqa xmmword [rsp + 0x370], xmm14
movdqa xmmword [rsp + 0x380], xmm15
mov eax, dword [0x18020f05c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
lea rdx, [rsp + 0x20]
xor r8, r8
mov qword [rdx + 0x10], r8
mov byte [rdx + 0x19], 1
mov dword [rdx + 0x1c], 0xffffffff
mov byte [rdx + 0x18], 2
mov r8, qword [rax + 0x80]
mov qword [rdx], r8
mov qword [rax + 0x80], rdx
lea r8, [rsp + 0x290]
mov qword [rdx + 8], r8
call fcn.1800a0590
int3
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xd8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rdx
mov qword [rsp + 0x130], r8
mov qword [rsp + 0x138], r9
mov eax, dword [0x18020f05c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
cmp rcx, qword [rax + 0x88]
sete byte [rsp + 0xd0]
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [r8 + 0x18]
mov rbx, qword [rax]
mov rax, qword [r8 + 0x20]
mov rbp, qword [rax]
mov rax, qword [r8 + 0x28]
mov rsi, qword [rax]
mov rax, qword [r8 + 0x30]
mov rdi, qword [rax]
mov rax, qword [r8 + 0x58]
mov r12, qword [rax]
mov rax, qword [r8 + 0x60]
mov r13, qword [rax]
mov rax, qword [r8 + 0x68]
mov r14, qword [rax]
mov rax, qword [r8 + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [r8 + 0x90]
movdqa xmm7, xmmword [r8 + 0xa0]
movdqa xmm8, xmmword [r8 + 0xb0]
movdqa xmm9, xmmword [r8 + 0xc0]
movdqa xmm10, xmmword [r8 + 0xd0]
movdqa xmm11, xmmword [r8 + 0xe0]
movdqa xmm12, xmmword [r8 + 0xf0]
movdqa xmm13, xmmword [r8 + 0x100]
movdqa xmm14, xmmword [r8 + 0x110]
movdqa xmm15, xmmword [r8 + 0x120]
mov rcx, qword [r8 + 0x78]
mov rdx, qword [rsp + 0x120]
call qword [rsp + 0x128]
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0xc0]
mov rcx, qword [rdx + 0x70]
cmp rcx, 0
je 0x180002f30
mov r9, qword [rdx + 0x68]
mov qword [r9], rcx
mov qword [rdx + 0x68], 0
mov qword [rdx + 0x70], 0
mov rcx, qword [rsp + 0x138]
mov r8, qword [r8 + 0x78]
xor r9d, r9d
mov rcx, qword [rcx]
cmp rcx, r9
je 0x180002f4c
cmp rcx, r8
jl 0x180002f3f
mov qword [rdx + 0x80], rcx
test dword [0x180208c40], 1
je 0x180002f7b
cmp byte [rsp + 0xd0], 0
je 0x180002f7b
mov rcx, 0x43
mov rdx, rax
mov rsp, r8
jmp 0x180002aa0
mov rsp, r8
jmp rax
Function at 0x180002f80
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbx
push rsi
push rdi
push rbp
sub rsp, 0xc8
movdqa xmmword [rsp + 0x20], xmm6
movdqa xmmword [rsp + 0x30], xmm7
movdqa xmmword [rsp + 0x40], xmm8
movdqa xmmword [rsp + 0x50], xmm9
movdqa xmmword [rsp + 0x60], xmm10
movdqa xmmword [rsp + 0x70], xmm11
movdqa xmmword [rsp + 0x80], xmm12
movdqa xmmword [rsp + 0x90], xmm13
movdqa xmmword [rsp + 0xa0], xmm14
movdqa xmmword [rsp + 0xb0], xmm15
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
mov eax, dword [0x18020f05c]
mov rbx, qword gs:[0x58]
mov rbx, qword [rbx + rax*8]
mov eax, 0x30
add rax, rbx
mov qword [rsp + 0xc0], rax
lock and dword [rax + 0x38], 0xffffffef
mov rax, qword [rdx + 0x18]
mov rbx, qword [rax]
mov rax, qword [rdx + 0x20]
mov rbp, qword [rax]
mov rax, qword [rdx + 0x28]
mov rsi, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdi, qword [rax]
mov rax, qword [rdx + 0x58]
mov r12, qword [rax]
mov rax, qword [rdx + 0x60]
mov r13, qword [rax]
mov rax, qword [rdx + 0x68]
mov r14, qword [rax]
mov rax, qword [rdx + 0x70]
mov r15, qword [rax]
movdqa xmm6, xmmword [rdx + 0x90]
movdqa xmm7, xmmword [rdx + 0xa0]
movdqa xmm8, xmmword [rdx + 0xb0]
movdqa xmm9, xmmword [rdx + 0xc0]
movdqa xmm10, xmmword [rdx + 0xd0]
movdqa xmm11, xmmword [rdx + 0xe0]
movdqa xmm12, xmmword [rdx + 0xf0]
movdqa xmm13, xmmword [rdx + 0x100]
movdqa xmm14, xmmword [rdx + 0x110]
movdqa xmm15, xmmword [rdx + 0x120]
mov rcx, qword [rdx + 0x78]
call qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx + 0x18]
mov qword [rax], rbx
mov rax, qword [rdx + 0x20]
mov qword [rax], rbp
mov rax, qword [rdx + 0x28]
mov qword [rax], rsi
mov rax, qword [rdx + 0x30]
mov qword [rax], rdi
mov rax, qword [rdx + 0x58]
mov qword [rax], r12
mov rax, qword [rdx + 0x60]
mov qword [rax], r13
mov rax, qword [rdx + 0x68]
mov qword [rax], r14
mov rax, qword [rdx + 0x70]
mov qword [rax], r15
movdqa xmmword [rdx + 0x90], xmm6
movdqa xmmword [rdx + 0xa0], xmm7
movdqa xmmword [rdx + 0xb0], xmm8
movdqa xmmword [rdx + 0xc0], xmm9
movdqa xmmword [rdx + 0xd0], xmm10
movdqa xmmword [rdx + 0xe0], xmm11
movdqa xmmword [rdx + 0xf0], xmm12
movdqa xmmword [rdx + 0x100], xmm13
movdqa xmmword [rdx + 0x110], xmm14
movdqa xmmword [rdx + 0x120], xmm15
mov rax, qword [rsp + 0xc0]
lock or dword [rax + 0x38], 0x10
movdqa xmm6, xmmword [rsp + 0x20]
movdqa xmm7, xmmword [rsp + 0x30]
movdqa xmm8, xmmword [rsp + 0x40]
movdqa xmm9, xmmword [rsp + 0x50]
movdqa xmm10, xmmword [rsp + 0x60]
movdqa xmm11, xmmword [rsp + 0x70]
movdqa xmm12, xmmword [rsp + 0x80]
movdqa xmm13, xmmword [rsp + 0x90]
movdqa xmm14, xmmword [rsp + 0xa0]
movdqa xmm15, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbp
pop rdi
pop rsi
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180003eb0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp 0x18000d0f0
mov rax, qword gs:[0x30]
mov r10, rcx
mov r8, qword [rax + 0x60]
mov r9, qword [r8 + 0x18]
add r9, 0x20
mov rax, qword [r9]
nop dword [rax + rax]
cmp qword [rax + 0x20], rdx
je 0x18000d12d
test rdx, rdx
je 0x18000d12d
mov rax, qword [rax]
cmp rax, r9
jne 0x18000d110
mov qword [rcx], 0
xor eax, eax
ret
mov rcx, qword [rax + 0x40]
mov qword [r10], rcx
movzx eax, word [rax + 0x38]
shr eax, 1
ret