joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403653d8
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14033d970
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x140365462
cmp byte [rbp - 0x21], r15b
je 0x14036545d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140365498
call fcn.140355f50
test eax, eax
jne 0x140365484
cmp byte [rbp - 0x21], r15b
je 0x14036547c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140365498
cmp byte [rbp - 0x21], r15b
je 0x140365495
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140340f98
test eax, eax
jne 0x140365538
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14033d970
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1403654d7
cmp byte [rbp - 0x21], r15b
je 0x14036550c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14036550c
call fcn.140355f50
test eax, eax
jne 0x1403654f8
cmp byte [rbp - 0x21], r15b
je 0x1403654f1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14036550c
cmp byte [rbp - 0x21], r15b
je 0x140365509
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140340f98
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140365538
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14036553b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140365549
mov rcx, rdi
call fcn.1403557c0
cmp byte [rbp + 0x3f], r15b
je 0x140365558
mov rcx, qword [rbp + 0x27]
call fcn.1403557c0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x1403685f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140368618
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140368618
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800c4010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x90]
mov rdi, rdx
test eax, eax
movd edx, xmm3
mov r11d, 6
mov rbp, r8
mov r10d, r11d
mov r14, rcx
cmovns r10d, eax
mov eax, edx
and eax, 0x7fffff
shr edx, 0x17
lea r9d, [rax + rax]
test edx, edx
jne 0x1800c4070
neg eax
sbb ecx, ecx
and ecx, 0xffffff82
jmp 0x1800c4073
lea ecx, [rdx - 0x7f]
mov eax, r9d
mov r15d, 0x2d
bts eax, 0x18
test edx, edx
cmovne r9d, eax
mov eax, ecx
cdq
mov esi, eax
mov eax, 0x2b
xor esi, edx
sub esi, edx
test ecx, ecx
cmovns r15d, eax
cmp esi, 0xa
jae 0x1800c40a4
lea edx, [rax - 0x27]
jmp 0x1800c40ad
cmp esi, 0x64
sbb rdx, rdx
add rdx, r11
mov rcx, rbp
movsxd r8, r10d
sub rcx, rdi
cmp rcx, r8
jge 0x1800c40cb
mov qword [r14], rbp
mov dword [r14 + 8], 0x84
jmp 0x1800c4217
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x1800c40bb
mov qword [rsp + 0x70], rbx
cmp r10d, r11d
jge 0x1800c410d
lea r8d, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea eax, [r8 - 1]
or eax, r9d
movzx ecx, r11b
mov edx, 1
shl edx, cl
and edx, eax
and edx, r8d
add r9d, edx
mov eax, r9d
and r9d, 0xffffff
shr eax, 0x18
add al, 0x30
mov byte [rdi], al
inc rdi
test r10d, r10d
jle 0x1800c4194
mov byte [rdi], 0x2e
lea r11, str.0123456789abcdefghijklmnopqrstuvwxyz
mov eax, r9d
lea r8d, [r10 - 1]
shr rax, 0x14
mov ecx, 0x14
movzx eax, byte [rax + r11]
mov byte [rdi + 1], al
add rdi, 2
test r8d, r8d
je 0x1800c4194
mov edx, 0x100000
test ecx, ecx
je 0x1800c417e
lea eax, [rdx - 1]
sub ecx, 4
and r9d, eax
ror edx, 4
mov eax, r9d
shr rax, cl
movzx eax, byte [rax + r11]
mov byte [rdi], al
inc rdi
sub r8d, 1
jne 0x1800c4156
jmp 0x1800c4194
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
add rdi, rbx
mov byte [rdi], 0x70
lea r9, [rsp + 0x40]
mov byte [rdi + 1], r15b
add rdi, 2
nop dword [rax]
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul esi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub sil, cl
add sil, 0x30
mov byte [r9], sil
mov esi, edx
test edx, edx
jne 0x1800c41b0
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rdi
cmp rax, rbx
jge 0x1800c41f5
mov dword [r14 + 8], 0x84
jmp 0x1800c420f
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + 8], 0
lea rbp, [rbx + rdi]
mov qword [r14], rbp
mov rbx, qword [rsp + 0x70]
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180269d00
lea r11, [rsp + 0x50]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800c4240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1803d9938]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x90]
mov rsi, rdx
test eax, eax
movq rdx, xmm3
mov r9, rdx
mov r11d, 0xd
mov r10d, r11d
movabs rbx, 0xfffffffffffff
cmovns r10d, eax
mov rbp, r8
and r9, rbx
shr rdx, 0x34
mov r14, rcx
test edx, edx
jne 0x1800c42b3
mov rax, r9
neg rax
sbb ecx, ecx
and ecx, 0xfffffc02
jmp 0x1800c42b9
lea ecx, [rdx - 0x3ff]
mov rax, r9
movabs r8, 0x10000000000000
or rax, r8
mov r15d, 0x2d
test edx, edx
cmovne r9, rax
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x2b
xor edi, edx
sub edi, edx
test ecx, ecx
cmovns r15d, eax
cmp edi, 0xa
jae 0x1800c42f3
lea edx, [rax - 0x27]
jmp 0x1800c430c
cmp edi, 0x64
jae 0x1800c42ff
mov edx, 5
jmp 0x1800c430c
cmp edi, 0x3e8
sbb rdx, rdx
add rdx, 7
mov rcx, rbp
movsxd r8, r10d
sub rcx, rsi
cmp rcx, r8
jl 0x1800c444b
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x1800c444b
cmp r10d, r11d
jge 0x1800c4361
lea r8, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea rax, [r8 - 1]
or rax, r9
movzx ecx, r11b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, r8
add r9, rdx
mov rax, r9
and r9, rbx
shr rax, 0x34
add al, 0x30
mov byte [rsi], al
inc rsi
test r10d, r10d
jle 0x1800c43f2
mov byte [rsi], 0x2e
lea r11, str.0123456789abcdefghijklmnopqrstuvwxyz
mov rax, r9
lea r8d, [r10 - 1]
shr rax, 0x30
mov ecx, 0x30
movzx eax, byte [rax + r11]
mov byte [rsi + 1], al
add rsi, 2
test r8d, r8d
je 0x1800c43f2
movabs rdx, 0x1000000000000
nop dword [rax]
test ecx, ecx
je 0x1800c43dc
lea rax, [rdx - 1]
sub ecx, 4
and r9, rax
ror rdx, 4
mov rax, r9
shr rax, cl
mov eax, eax
movzx eax, byte [rax + r11]
mov byte [rsi], al
inc rsi
sub r8d, 1
jne 0x1800c43b0
jmp 0x1800c43f2
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
add rsi, rbx
mov byte [rsi], 0x70
lea r9, [rsp + 0x40]
mov byte [rsi + 1], r15b
add rsi, 2
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x1800c4410
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rsi
cmp rax, rbx
jge 0x1800c4455
mov dword [r14 + 8], 0x84
jmp 0x1800c446f
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov dword [r14 + 8], 0
lea rbp, [rbx + rsi]
mov qword [r14], rbp
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180269d00
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800d2d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x20
lea r14, [rdx + 8]
mov ebx, dword [rdx]
mov rcx, qword [0x1803cd030]
call fcn.18025f340
mov r8, qword [0x1803cd030]
mov ecx, dword [r8 + 8]
mov rax, qword [r8 + 0x10]
mov dword [rax + rcx*8], ebx
inc dword [r8 + 8]
movabs r15, 0x43a66c31c68491c0
mov rdx, r15
mov rcx, qword [0x1803cd030]
call fcn.18025f4a0
mov rax, qword [0x1803cd030]
mov rcx, qword [rax]
mov r11d, dword [rcx]
mov rax, qword [r14]
cmp qword [rax + 0x10], 0
jne 0x1800d2dfa
lea r9, [rax + 0x20]
cmp qword [rax + 0x38], 0x10
jb 0x1800d2d94
mov r9, qword [rax + 0x20]
mov r10, qword [rax + 0x30]
xor edi, edi
add r10, r9
cmp r9, r10
je 0x1800d2dd4
movzx r8d, byte [r9]
lea edx, [r8 - 0x41]
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, edi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
inc r9
cmp r9, r10
jne 0x1800d2da2
lea eax, [rdi + rdi*8]
mov edx, eax
shr edx, 0xb
xor edx, eax
imul edx, edx, 0x8001
xor r9d, r9d
mov r8d, 0x270f
mov ecx, r11d
call fcn.1800cf7d0
jmp 0x1800d2f54
mov rax, qword [section..data]
mov rcx, qword [rax + 0x2b8]
mov rax, qword [rcx]
lea rsi, [rax + 0x188]
lea rbp, [rax + 0x288]
cmp rsi, rbp
je 0x1800d2f54
xor edi, edi
mov rbx, qword [rsi]
test rbx, rbx
je 0x1800d2f47
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x40]
test al, al
je 0x1800d2f47
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x48]
mov rcx, qword [r14]
mov rdx, 0xffffffffffffffff
inc rdx
cmp byte [rax + rdx], dil
jne 0x1800d2e54
mov r8, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x1800d2e6b
mov rcx, qword [rcx]
cmp r8, rdx
jne 0x1800d2f47
mov rdx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1800d2f47
movzx ebx, byte [rbx + 0x21]
mov rcx, qword [0x1803cd030]
call fcn.18025f340
mov rdx, qword [0x1803cd030]
mov ecx, dword [rdx + 8]
mov rax, qword [rdx + 0x10]
mov dword [rax + rcx*8], ebx
inc dword [rdx + 8]
mov rdx, r15
mov rcx, qword [0x1803cd030]
call fcn.18025f4a0
mov rax, qword [0x1803cd030]
mov rcx, qword [rax]
mov ebx, dword [rcx]
mov rax, qword [r14]
lea r9, [rax + 0x20]
cmp qword [rax + 0x38], 0x10
jb 0x1800d2ed5
mov r9, qword [rax + 0x20]
mov r11, qword [rax + 0x30]
mov r10d, edi
add r11, r9
cmp r9, r11
je 0x1800d2f26
nop dword [rax]
nop dword [rax + rax]
movzx r8d, byte [r9]
lea edx, [r8 - 0x41]
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
inc r9
cmp r9, r11
jne 0x1800d2ef0
lea eax, [r10 + r10*8]
mov edx, eax
shr edx, 0xb
xor edx, eax
imul edx, edx, 0x8001
xor r9d, r9d
mov r8d, 0x270f
mov ecx, ebx
call fcn.1800cf7d0
add rsi, 8
cmp rsi, rbp
jne 0x1800d2e24
mov rcx, r14
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.1800d00d0
Function at 0x1800d68e0
Capabilities:
Log keystrokes via polling

Disassembly:
lea rcx, [0x18041b2ee]
jmp 0x1800d8400
sub rsp, 0x28
cmp byte [rcx], 0
je 0x1800d8439
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800d8439
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800d8439
mov ecx, 0xb
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
add rsp, 0x28
ret

Function at 0x1800d8400
Capabilities:
Log keystrokes via polling

Disassembly:
lea rcx, [0x18041b2ee]
jmp 0x1800d8400
sub rsp, 0x28
cmp byte [rcx], 0
je 0x1800d8439
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800d8439
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1800d8439
mov ecx, 0xb
add rsp, 0x28
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_raise]
add rsp, 0x28
ret

Function at 0x1800de230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea rbx, str.fm_mission_controller
xor r9d, r9d
mov r10, rbx
lea rdi, [0x1802a1aad]
nop
movzx r8d, byte [r10]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r10
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp r10, rdi
jne 0x1800dd090
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.1800e4110
test al, al
je 0x1800dd1d5
xor r9d, r9d
nop word [rax + rax]
movzx r8d, byte [rbx]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc rbx
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp rbx, rdi
jne 0x1800dd0f0
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov rax, qword [section..data]
imul r8d, ecx, 0x8001
mov rcx, qword [rax + 0x320]
mov rdx, qword [rcx]
movzx eax, word [rcx + 8]
lea rcx, [rdx + rax*8]
cmp rdx, rcx
je 0x1800dd1d5
mov rbx, qword [rdx]
test rbx, rbx
je 0x1800dd177
cmp dword [rbx + 8], 0
je 0x1800dd177
cmp qword [rbx + 0x118], 0
je 0x1800dd177
cmp dword [rbx + 0x128], r8d
je 0x1800dd18b
add rdx, 8
cmp rdx, rcx
jne 0x1800dd156
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rbx + 0xb0]
lea rcx, [rsp + 0x20]
mov r8d, 0x7ba8
call fcn.180165440
mov rcx, rax
call fcn.180165490
mov r8d, 0x4cfe
lea rcx, [rsp + 0x20]
mov dword [rax], 0
mov rdx, qword [rbx + 0xb0]
call fcn.180165440
mov rcx, rax
call fcn.180165490
mov dword [rax], 0xc
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
add rcx, 8
jmp 0x1800dd070
Function at 0x1800de240
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
lea rbx, str.am_criminal_damage
xor r9d, r9d
mov r10, rbx
lea rdi, [0x1802a187a]
nop
movzx r8d, byte [r10]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r10
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp r10, rdi
jne 0x1800dd200
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.1800e4110
test al, al
je 0x1800dd407
xor r9d, r9d
nop word [rax + rax]
movzx r8d, byte [rbx]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc rbx
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp rbx, rdi
jne 0x1800dd260
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov rax, qword [section..data]
imul r8d, ecx, 0x8001
mov rcx, qword [rax + 0x320]
mov rdx, qword [rcx]
movzx eax, word [rcx + 8]
lea rcx, [rdx + rax*8]
cmp rdx, rcx
je 0x1800dd407
nop word [rax + rax]
mov rbx, qword [rdx]
test rbx, rbx
je 0x1800dd2f1
cmp dword [rbx + 8], 0
je 0x1800dd2f1
cmp qword [rbx + 0x118], 0
je 0x1800dd2f1
cmp dword [rbx + 0x128], r8d
je 0x1800dd305
add rdx, 8
cmp rdx, rcx
jne 0x1800dd2d0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rdx, qword [rbx + 0xb0]
lea rcx, [rsp + 0x20]
mov r8d, 0x6f
mov qword [rsp + 0x70], rsi
call fcn.180165440
mov r8d, 0x2b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180165450
mov rcx, rax
call fcn.180165490
mov r8d, 0x6a
lea rcx, [rsp + 0x30]
mov dword [rax], 0
mov rdx, qword [rbx + 0xb0]
call fcn.180165440
mov rcx, rax
call fcn.180165490
mov dword [rax], 0x3b9ac9ff
mov rax, qword gs:[0x20]
mov rdi, qword [rax]
call sub.MSVCP140.dll__Query_perf_frequency
mov rsi, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rsi, 0x989680
jne 0x1800dd38f
imul rax, rax, 0x64
jmp 0x1800dd3ad
cqo
idiv rsi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rsi
add rax, rcx
mov rsi, qword [rsp + 0x70]
add rax, 0x3b9aca00
cmp byte [rdi + 0x58], 0
jne 0x1800dd3c2
mov byte [rdi + 0x58], 1
mov qword [rdi + 0x50], rax
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov rdx, qword [rbx + 0xb0]
lea rcx, [rsp + 0x40]
mov r8d, 0x6f
call fcn.180165440
mov r8d, 0x27
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.180165450
mov rcx, rax
call fcn.180165490
mov dword [rax], 0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
add rcx, 8
jmp 0x1800dd1e0
Function at 0x1800de330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
lea rdi, str.freemode
mov r9d, ebx
lea rsi, [0x1802a14c8]
mov r10, rdi
nop word [rax + rax]
movzx r8d, byte [r10]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r10
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp r10, rsi
jne 0x1800dd450
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.1800e4110
mov r9d, ebx
nop
movzx r8d, byte [rdi]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc rdi
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp rdi, rsi
jne 0x1800dd4a0
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov rax, qword [section..data]
imul r8d, ecx, 0x8001
mov rcx, qword [rax + 0x320]
mov rdx, qword [rcx]
movzx eax, word [rcx + 8]
lea rcx, [rdx + rax*8]
cmp rdx, rcx
je 0x1800dd532
mov rax, qword [rdx]
test rax, rax
je 0x1800dd529
cmp dword [rax + 8], ebx
je 0x1800dd529
cmp qword [rax + 0x118], rbx
je 0x1800dd529
cmp dword [rax + 0x128], r8d
je 0x1800dd63f
add rdx, 8
cmp rdx, rcx
jne 0x1800dd506
lea rsi, [0x1802a1a6d]
mov r9d, ebx
lea rdi, str.fmmc_launcher
mov r11, rsi
mov r10, rdi
nop dword [rax]
movzx r8d, byte [r10]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r10
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp r10, r11
jne 0x1800dd550
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.1800e4110
nop dword [rax]
movzx r8d, byte [rdi]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc rdi
movsx eax, cl
add eax, ebx
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
cmp rdi, rsi
jne 0x1800dd5a0
lea eax, [rbx + rbx*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov rax, qword [section..data]
imul r8d, ecx, 0x8001
mov rcx, qword [rax + 0x320]
mov rdx, qword [rcx]
movzx eax, word [rcx + 8]
lea rcx, [rdx + rax*8]
cmp rdx, rcx
je 0x1800dd685
mov rax, qword [rdx]
test rax, rax
je 0x1800dd626
cmp dword [rax + 8], 0
je 0x1800dd626
cmp qword [rax + 0x118], 0
je 0x1800dd626
cmp dword [rax + 0x128], r8d
je 0x1800dd672
add rdx, 8
cmp rdx, rcx
jne 0x1800dd605
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rax + 0x120]
lea rsi, [0x1802a1a6d]
lea rdi, str.fmmc_launcher
mov r9d, ebx
mov r11, rsi
mov r10, rdi
test rcx, rcx
je 0x1800dd550
or byte [rcx + 0x192], 0x80
jmp 0x1800dd550
mov rcx, qword [rax + 0x120]
test rcx, rcx
je 0x1800dd685
or byte [rcx + 0x192], 0x80
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
add rcx, 8
jmp 0x1800dd420
Function at 0x1800de3e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rbx, str.am_criminal_damage
xor r9d, r9d
mov r10, rbx
lea rdi, [0x1802a187a]
nop
movzx r8d, byte [r10]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r10
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp r10, rdi
jne 0x1800de400
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.1800e4110
test al, al
je 0x1800de533
xor r9d, r9d
nop word [rax + rax]
movzx r8d, byte [rbx]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc rbx
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp rbx, rdi
jne 0x1800de460
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov rax, qword [section..data]
imul r9d, ecx, 0x8001
mov rcx, qword [rax + 0x320]
mov r8, qword [rcx]
movzx eax, word [rcx + 8]
lea rcx, [r8 + rax*8]
cmp r8, rcx
je 0x1800de533
mov rdx, qword [r8]
test rdx, rdx
je 0x1800de4e7
cmp dword [rdx + 8], 0
je 0x1800de4e7
cmp qword [rdx + 0x118], 0
je 0x1800de4e7
cmp dword [rdx + 0x128], r9d
je 0x1800de4fb
add r8, 8
cmp r8, rcx
jne 0x1800de4c6
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rdx, qword [rdx + 0xb0]
lea rcx, [rsp + 0x20]
mov r8d, 0x6f
call fcn.180165440
mov r8d, 0x2b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.180165450
mov rcx, rax
call fcn.180165490
mov dword [rax], 0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800de580
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
xor r9d, r9d
lea r11, str.am_launcher
mov r10d, r9d
lea rdi, [0x1802a15bb]
mov rbx, r11
mov rsi, rcx
movzx r8d, byte [rbx]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc rbx
movsx eax, cl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
cmp rbx, rdi
jne 0x1800dd6c2
lea eax, [r10 + r10*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
mov rax, qword [section..data]
imul r8d, ecx, 0x8001
mov rcx, qword [rax + 0x320]
mov rdx, qword [rcx]
movzx eax, word [rcx + 8]
lea rcx, [rdx + rax*8]
cmp rdx, rcx
je 0x1800dd90d
nop dword [rax]
mov rax, qword [rdx]
test rax, rax
je 0x1800dd750
cmp dword [rax + 8], r9d
je 0x1800dd750
cmp qword [rax + 0x118], r9
je 0x1800dd750
cmp dword [rax + 0x128], r8d
je 0x1800dd761
add rdx, 8
cmp rdx, rcx
jne 0x1800dd730
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x80], rax
nop dword [rax]
movzx r8d, byte [r11]
movzx eax, r8b
or al, 0x20
movzx ecx, al
lea edx, [r8 - 0x41]
cmp dl, 0x19
cmova ecx, r8d
inc r11
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
cmp r11, rdi
jne 0x1800dd770
lea eax, [r9 + r9*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
call fcn.1800e4110
test al, al
je 0x1800dd90d
mov rax, qword [rsp + 0x80]
lea rcx, [rsp + 0x20]
mov edx, 5
mov dword [rax + 0x10], 3
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r8d, [rdx + 1]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
call fcn.1800dd920
mov edx, 6
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 1]
call fcn.1800dd920
xor r8d, r8d
lea rcx, [rsp + 0x20]
lea edx, [r8 + 7]
call fcn.1800dd920
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], 0x2a0ef1
call fcn.180165410
lea rcx, [rsp + 0x88]
or dword [rax], 2
mov qword [rsp + 0x88], 0x2a0ef2
call fcn.180165410
mov r8d, 0xe9
lea rcx, [rsp + 0x20]
mov dword [rax], 6
mov rdx, qword [rsp + 0x80]
mov rdx, qword [rdx + 0xb0]
call fcn.180165440
mov rcx, qword [0x1803cd030]
mov rbx, rax
call fcn.18025f340
mov rcx, qword [0x1803cd030]
movabs rdx, 0x4f8644af03d0e0d6
call fcn.18025f4a0
mov rcx, qword [0x1803cd030]
mov r9d, 3
mov rdx, qword [rcx]
mov rcx, rbx
movsxd r8, dword [rdx]
lea rdx, [rsp + 0x30]
call fcn.180165470
mov r8d, 2
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180165450
mov rcx, rax
call fcn.180165490
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], 0x2a0ef4
mov dword [rax], 6
mov ebx, dword [rsi]
call fcn.180165410
mov dword [rax], ebx
mov rax, qword [rsp + 0x80]
mov dword [rax + 0x10], 1
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
add rcx, 8
jmp 0x1800dd6a0