joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008bbc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
xor r11d, r11d
mov r9, rdx
mov r10, rcx
mov ebx, r11d
mov r8d, edx
cmp rdx, 0x20
jb 0x18008bc48
add rdx, 0xffffffffffffffec
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff4
add r9, rax
nop word [rax + rax]
add r8d, dword [r10 + 8]
movsd xmm0, qword [r10]
mov ecx, r8d
ror ecx, 0xe
add r10, 0xc
movsd qword [rsp], xmm0
add r11d, dword [rsp]
mov rax, qword [rsp]
xor r11d, r8d
sub r11d, ecx
shr rax, 0x20
add ebx, eax
mov ecx, r11d
ror ecx, 0xb
xor ebx, r11d
sub ebx, ecx
xor r8d, ebx
mov eax, ebx
ror eax, 0x19
sub r8d, eax
sub rdx, 1
jne 0x18008bc00
test r9, r9
je 0x18008bc6f
nop dword [rax]
movzx ecx, byte [r10 + r9 - 1]
mov eax, r8d
shl eax, 5
add ecx, eax
mov eax, r8d
shr eax, 2
add ecx, eax
xor r8d, ecx
sub r9, 1
jne 0x18008bc50
mov eax, r8d
add rsp, 0x10
pop rbx
ret

Function at 0x180090ba0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov r8d, dword [rdx + 0xc]
mov r9, rdx
mov r11, rcx
sub r8d, 1
je 0x180090d69
sub r8d, 1
je 0x180090cee
sub r8d, 1
je 0x180090ca0
sub r8d, 1
je 0x180090c0f
cmp r8d, 1
jne 0x180090ca0
mov rdx, qword [rdx]
lea r8, [rcx + 0x20]
movzx ecx, byte [rcx + 6]
add rdx, 0x10
mov eax, 1
shl eax, cl
dec eax
mov ecx, dword [rdx]
cdqe
add ecx, edx
movsxd rcx, ecx
and rax, rcx
shl rax, 5
sub rax, r8
add rax, qword [r8]
add rsp, 0x18
ret
mov ecx, dword [rdx + 8]
lea r10, [r11 + 0x20]
movsd xmm0, qword [rdx]
xor eax, eax
movsd qword [rsp], xmm0
mov r8d, dword [rsp]
cmp r8d, 0x80000000
mov edx, dword [rsp + 4]
cmove r8d, eax
cmp edx, 0x80000000
cmove edx, eax
cmp ecx, 0x80000000
cmove ecx, eax
mov eax, ecx
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x4f9ffb7
movsxd r9, eax
mov eax, r8d
shr eax, 0x11
xor eax, r8d
imul eax, eax, 0x466f45d
movsxd rcx, eax
mov eax, edx
shr eax, 0x11
xor r9, rcx
xor eax, edx
imul eax, eax, 0x127409f
movsxd rcx, eax
mov eax, 1
xor r9, rcx
movzx ecx, byte [r11 + 6]
shl eax, cl
dec eax
cdqe
and rax, r9
shl rax, 5
sub rax, r10
add rax, qword [r10]
add rsp, 0x18
ret
mov ecx, dword [rdx]
lea r9, [r11 + 0x20]
shr ecx, 0x10
xor ecx, dword [rdx]
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
mov eax, 1
imul r8d, ecx, 0xc2b2ae35
movzx ecx, byte [r11 + 6]
shl eax, cl
dec eax
cdqe
mov edx, r8d
shr rdx, 0x10
movsxd rcx, r8d
xor rdx, rcx
and rax, rdx
shl rax, 5
sub rax, r9
add rax, qword [r9]
add rsp, 0x18
ret
movsd xmm0, qword [rdx]
lea r10, [r11 + 0x20]
movsd qword [rsp + 0x28], xmm0
mov rax, qword [rsp + 0x28]
mov rdx, rax
shr rdx, 0x20
btr edx, 0x1f
mov ecx, edx
shr ecx, 0x12
xor ecx, eax
imul r9d, ecx, 0x5bd1e995
movzx ecx, byte [r11 + 6]
mov eax, r9d
shr eax, 0x16
xor eax, edx
imul r8d, eax, 0x5bd1e995
mov eax, 1
shl eax, cl
dec eax
cdqe
mov ecx, r8d
shr ecx, 0x11
xor ecx, r9d
imul edx, ecx, 0x5bd1e995
shr edx, 0x13
xor edx, r8d
imul ecx, edx, 0x5bd1e995
movsxd rdx, ecx
and rax, rdx
shl rax, 5
sub rax, r10
add rax, qword [r10]
add rsp, 0x18
ret
lea rdx, [rcx + 0x20]
mov eax, 1
movzx ecx, byte [rcx + 6]
shl eax, cl
movsxd rcx, dword [r9]
dec eax
cdqe
and rax, rcx
shl rax, 5
sub rax, rdx
add rax, qword [rdx]
add rsp, 0x18
ret
Function at 0x1800a07f0
Capabilities:
Hash data using sha1

Disassembly:
mov rcx, qword [rcx + 0xc8]
jmp 0x1800a07f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1802a7e0c], 0
mov rbx, rdx
mov rdi, rcx
jne 0x1800a080e
call fcn.1800b8510
cmp byte [0x1802a7e16], 0
mov rdx, rbx
mov rcx, rdi
je 0x1800a0833
xor r9d, r9d
lea r8d, [r9 + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800b88a0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18009d360

Function at 0x1800a4a30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea eax, [rdx - 1]
xor r10b, r10b
movsxd r11, eax
mov r8d, edx
cmp r11, 1
jl 0x1800a4ac9
lea r9, [r11 + rcx]
inc r11
shr r11, 1
movzx edx, byte [r9]
lea r9, [r9 - 2]
movzx eax, dl
shr dl, 7
add al, al
add al, r10b
mov byte [r9 + 2], al
movzx eax, byte [r9 + 1]
movzx r10d, al
add al, al
add dl, al
shr r10b, 7
mov byte [r9 + 1], dl
sub r11, 1
jne 0x1800a4a50
test r10b, r10b
je 0x1800a4ac9
sub r8d, 8
je 0x1800a4ac5
sub r8d, 8
je 0x1800a4ac0
sub r8d, 0x10
je 0x1800a4ab7
sub r8d, 0x20
je 0x1800a4aae
cmp r8d, 0x40
jne 0x1800a4ac9
xor byte [rcx + 0x7d], 8
xor byte [rcx + 0x7f], 0x43
ret
xor byte [rcx + 0x3e], 1
xor byte [rcx + 0x3f], 0x25
ret
xor byte [rcx + 0x1e], 4
xor byte [rcx + 0x1f], 0x25
ret
xor byte [rcx + 0xf], 0x87
ret
xor byte [rcx + 7], 0x1b
ret

Function at 0x1800a55b0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180248b00]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x1802a8774]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1802a69e0], ecx
jg 0x1800a5692
mov eax, ebx
cmp rbx, rax
jne 0x1800a5654
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x1800a5654
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x1802a69d8]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1800a56d5
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18017a790
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.180006730
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800a51c0
lea rdx, [0x180243120]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x1802a69e0]
call fcn.18017ad2c
cmp dword [0x1802a69e0], 0xffffffff
jne 0x1800a55fc
lea rcx, [0x1802a69d8]
call fcn.1800a50b0
lea rcx, [0x180182310]
call fcn.18017ab08
nop
lea rcx, [0x1802a69e0]
call fcn.18017acc0
jmp 0x1800a55fc
mov ecx, eax
call fcn.1800a5720
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x180188c98]
lea rcx, [rsp + 0x20]
call fcn.180006730
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1800a51c0
lea rdx, [0x180243120]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1800a8e90
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x1800a8ec7
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x1800a8eb0
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x1800a8fb8
sub rcx, r10
cmp r9, 8
jb 0x1800a8f99
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp r11, rax
jb 0x1800a8f20
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x1800a8fb8
add r10, r11
sub r9, r11
nop
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x1800a8fa0
test r8d, r8d
sete al
ret

Function at 0x1800a9160
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
test r8, r8
je 0x1800a92c2
cmp r8, 4
jb 0x1800a91a2
mov r9, r8
shr r9, 2
imul rax, r9, 0xfffffffffffffffc
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rdx]
add rdx, 4
xor dword [rcx], eax
add rcx, 4
sub r9, 1
jne 0x1800a9190
xor r10d, r10d
test r8, r8
je 0x1800a92c2
cmp r8, 8
jb 0x1800a92a4
lea r9, [rcx - 1]
lea rax, [rdx - 1]
add r9, r8
add rax, r8
cmp rcx, rax
ja 0x1800a91d4
cmp r9, rdx
jae 0x1800a92a4
cmp r8, 0x40
jb 0x1800a9263
mov r9, r8
mov qword [rsp], rbx
and r9d, 0x3f
mov r11, r8
sub r11, r9
mov rbx, rdx
lea rax, [rcx + 0x10]
sub rbx, rcx
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rax + rbx - 0x10]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax + rbx - 0x40]
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm2, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rax + rbx - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rax + rbx - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp r10, r11
jb 0x1800a9200
mov rbx, qword [rsp]
cmp r9, 8
jb 0x1800a929f
mov r9, r8
and r9, 0xfffffffffffffff8
mov r11, rdx
lea rax, [r10 + rcx]
sub r11, rcx
nop dword [rax]
nop dword [rax + rax]
movq xmm0, qword [rax]
add r10, 8
movq xmm1, qword [r11 + rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp r10, r9
jb 0x1800a9280
cmp r10, r8
jae 0x1800a92c2
sub rdx, rcx
lea r9, [r10 + rcx]
sub r8, r10
nop
movzx eax, byte [rdx + r9]
xor byte [r9], al
lea r9, [r9 + 1]
sub r8, 1
jne 0x1800a92b0
add rsp, 8
ret
Function at 0x1800b6320
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x180248b00]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14d, r8d
mov r12, rdx
mov qword [rsp + 0x28], rdx
mov rbx, rcx
add rcx, 8
mov rax, qword [rcx]
call qword [rax + gethostname]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x78]
mov rcx, rax
mov qword [rsp + 0x30], rax
mov rax, qword [rax]
call qword [rax + 0x48]
mov r15d, eax
test eax, eax
je 0x1800b650a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x78]
mov rdi, rax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x78]
mov rsi, rax
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x48]
mov edi, eax
add edi, edi
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x40]
add eax, edi
mov r13d, eax
mov rsi, qword [rbx + 0x28]
mov rdi, qword [rbx + 0x20]
mov qword [rsp + 0x20], rdi
xor ebp, ebp
cmp rdi, r13
je 0x1800b641e
test eax, eax
jne 0x1800b63d3
mov r12d, ebp
jmp 0x1800b63de
mov rcx, r13
call fcn.1800a7ff0
mov r12, rax
mov r8, rdi
cmp r13, rdi
cmovb r8, r13
test rsi, rsi
je 0x1800b6416
test r12, r12
je 0x1800b6402
test r8, r8
je 0x1800b6402
mov rdx, rsi
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov rdi, rsi
xor eax, eax
mov rcx, qword [rsp + 0x20]
rep stosb byte [rdi], al
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rsi, r12
mov r12, qword [rsp + 0x28]
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x20], r13
mov qword [rbx + 0x18], 0xffffffffffffffff
cmp r14d, r15d
ja 0x1800b6452
test rsi, rsi
je 0x1800b647c
test r12, r12
je 0x1800b647c
test r14d, r14d
je 0x1800b647c
mov r8, r14
mov rdx, r12
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1800b647c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x78]
mov rdi, qword [rax]
mov r9, r14
mov r8, r12
mov rdx, qword [rbx + 0x28]
mov rcx, rax
call qword [rdi + 0x60]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r14d, eax
mov r8d, r15d
sub r8d, r14d
mov ecx, r14d
add rcx, qword [rbx + 0x28]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
test r15d, r15d
je 0x1800b64df
mov rsi, rbp
mov r14, r15
nop dword [rax + rax]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x78]
mov rdi, qword [rbx + 0x28]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x48]
mov edx, eax
add rdx, rdi
mov rax, qword [rbx + 0x28]
movzx ecx, byte [rsi + rax]
xor cl, 0x5c
mov byte [rdx + rbp], cl
mov rax, qword [rbx + 0x28]
xor byte [rsi + rax], 0x36
lea rsi, [rsi + 1]
lea rbp, [rbp + 1]
sub r14, 1
jne 0x1800b64a0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18017a790
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.HMAC:_can_only_be_used_with_a_block_based_hash_function
lea rcx, [rsp + 0x38]
call fcn.180006730
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.1800071e0
lea rdx, [0x1802435a0]
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1800b6610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx]
mov rbp, r8
mov r14, rdx
mov rsi, rcx
call qword [rax + 0xf8]
lea rdi, [rax + 8]
mov rax, qword [rax + 8]
mov rcx, rdi
call qword [rax + 0x40]
mov r9, qword [rdi]
mov r8, rbp
mov rdx, qword [rsi + 0x30]
mov rcx, rdi
mov ebx, eax
call qword [r9 + 0x78]
mov rdx, qword [rsi + 0x30]
mov r9, rbp
mov rcx, r14
lea r8, [rdx + rbx]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.1800a8fc0
Function at 0x1800bd460
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqu xmm5, xmmword [rcx]
xor ecx, ecx
movaps xmmword [rsp], xmm6
movdqa xmm6, xmmword [0x18018a630]
pshufb xmm5, xmmword [0x18018a620]
movdqa xmm4, xmm5
add r8d, 0xffffffe0
je 0x1800bd59d
nop dword [rax]
movq qword [rcx + rdx], xmm4
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm5, 0
movdqa xmm1, xmm2
movdqa xmm3, xmm4
movdqa xmm0, xmm4
pslldq xmm1, 8
pclmulqdq xmm0, xmm5, 1
pclmulqdq xmm3, xmm5, 0x10
xorps xmm3, xmm0
movdqa xmm0, xmm2
psrldq xmm2, 8
xorps xmm3, xmm1
pclmulqdq xmm0, xmm6, 0x10
xorps xmm3, xmm0
movdqa xmm0, xmm4
xorps xmm2, xmm3
movdqa xmm1, xmm3
psllq xmm2, 1
pclmulqdq xmm2, xmm6, 0
pclmulqdq xmm0, xmm5, 0x11
xorps xmm2, xmm0
psrldq xmm1, 8
xorps xmm2, xmm1
punpcklqdq xmm3, xmm2
psllq xmm2, 1
psrlq xmm3, 0x3f
xorps xmm3, xmm2
movdqu xmmword [rcx + rdx + 0x10], xmm3
movdqu xmmword [rcx + rdx + 8], xmm4
movdqa xmm2, xmm3
movq qword [rcx + rdx + 8], xmm3
pclmulqdq xmm2, xmm5, 0
movdqa xmm1, xmm2
movdqa xmm4, xmm3
pclmulqdq xmm4, xmm5, 0x10
movdqa xmm0, xmm3
pslldq xmm1, 8
pclmulqdq xmm0, xmm5, 1
xorps xmm4, xmm0
add ecx, 0x20
movdqa xmm0, xmm2
psrldq xmm2, 8
xorps xmm4, xmm1
pclmulqdq xmm0, xmm6, 0x10
xorps xmm4, xmm0
xorps xmm2, xmm4
movdqa xmm0, xmm4
psllq xmm2, 1
psrldq xmm0, 8
pclmulqdq xmm2, xmm6, 0
pclmulqdq xmm3, xmm5, 0x11
xorps xmm2, xmm3
xorps xmm2, xmm0
punpcklqdq xmm4, xmm2
psrlq xmm4, 0x3f
psllq xmm2, 1
xorps xmm4, xmm2
cmp ecx, r8d
jb 0x1800bd490
movq qword [rcx + rdx], xmm4
movdqa xmm2, xmm4
pclmulqdq xmm2, xmm5, 0
movdqa xmm1, xmm2
movdqa xmm3, xmm4
pclmulqdq xmm3, xmm5, 0x10
pslldq xmm1, 8
movdqa xmm0, xmm4
pclmulqdq xmm0, xmm5, 1
xorps xmm3, xmm0
movdqa xmm0, xmm2
xorps xmm3, xmm1
psrldq xmm2, 8
pclmulqdq xmm0, xmm6, 0x10
xorps xmm3, xmm0
movdqa xmm0, xmm4
xorps xmm2, xmm3
movdqa xmm1, xmm3
psllq xmm2, 1
pclmulqdq xmm2, xmm6, 0
movaps xmm6, xmmword [rsp]
pclmulqdq xmm0, xmm5, 0x11
xorps xmm2, xmm0
psrldq xmm1, 8
xorps xmm2, xmm1
punpcklqdq xmm3, xmm2
psrlq xmm3, 0x3f
psllq xmm2, 1
xorps xmm3, xmm2
movdqu xmmword [rcx + rdx + 0x10], xmm3
movdqu xmmword [rcx + rdx + 8], xmm4
movq qword [rcx + rdx + 8], xmm3
add rsp, 0x18
ret
Function at 0x1800c7940
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret

Function at 0x1800caf30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xa4e], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x1800caff9
cmp qword [rcx + 0x278], 0
je 0x1800cafae
mov qword [rsp + 0x40], rbx
call fcn.1800c0ca0
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.1800c12d0
mov rcx, qword [rdi + 0x1f0]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x278]
movzx edx, bl
mov rcx, rdi
call fcn.1800c12d0
mov rbx, qword [rsp + 0x40]
jmp 0x1800caff9
mov ecx, esi
test edx, edx
je 0x1800cafbe
sub ecx, 1
je 0x1800cafbe
cmp ecx, 1
jne 0x1800caff9
mov r9, qword [rdi + 0x1e8]
lea rax, [0x18018eb40]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1e8]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1800cb640
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x2b
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x1800cb71b
xor r14d, r14d
nop dword [rax]
mov edi, 4
lea rdx, [rsp + 0x50]
cmp rsi, rdi
mov r8d, 4
mov rcx, rbp
cmovb rdi, rsi
call fcn.1800d2d70
cmp eax, 4
je 0x1800cb698
mov edx, eax
jmp 0x1800cb6c5
cmp byte [0x1802a8044], r14b
jne 0x1800cb6cf
mov r9d, 2
mov dword [rsp + 0x50], r14d
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 2]
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb edx, edx
and edx, 2
mov eax, edx
test eax, eax
jne 0x1800cb71d
mov eax, dword [rsp + 0x50]
jmp 0x1800cb6ee
imul eax, dword [0x1802a8040], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x1802a8040], eax
ror eax, 0x10
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x1800cb712
sub rsi, rdi
nop word [rax + rax]
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x1800cb700
mov dword [rsp + 0x50], eax
test rsi, rsi
jne 0x1800cb670
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1800cb730
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
sub rdi, 1
je 0x1800cb7d3
xor ebp, ebp
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
nop
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1800d2d70
cmp eax, 4
jne 0x1800cb79f
cmp byte [0x1802a8044], bpl
jne 0x1800cb7eb
lea r9d, [rax - 2]
mov dword [rsp + 0x50], ebp
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x1800cb7d8
mov ecx, dword [rsp + 0x50]
cmp ecx, 0xfffffffc
jae 0x1800cb760
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx eax, byte [rcx + r14]
mov byte [rsi], al
inc rsi
sub rdi, 1
jne 0x1800cb760
mov byte [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
imul ecx, dword [0x1802a8040], 0x41c64e6d
add ecx, 0x3039
mov dword [0x1802a8040], ecx
ror ecx, 0x10
mov dword [rsp + 0x50], ecx
jmp 0x1800cb7a7

Function at 0x1800cda10
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1800cdaf2
call fcn.1800dfc50
test al, al
jne 0x1800cdaf2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1800cda42
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1800f4300
test rax, rax
je 0x1800cda87
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.1800f4300
mov rsi, rax
test rax, rax
je 0x1800cda87
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1800cdabb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1800c96b0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1800cdaa0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800db870
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x1800db89a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExW
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1801902c0]
mov rcx, rbx
mov r14, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcspbrk
test rax, rax
je 0x1800db8f9
mov rcx, rbx
test r14, r14
je 0x1800db8e6
xor edx, edx
lea r8d, [rdx + 8]
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test r14, r14
je 0x1800db930
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800db930
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
je 0x1800db9fa
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x1800db960
lea ecx, [rax + 1]
add rcx, rdx
add rcx, rcx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1800db9ec
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800db9ec
mov rax, rdi
cmp word [rsi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x1800db993
mov dword [rsi + rax*2], 0x5c
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x1800db9a5
add rdi, rdi
sub rdi, rbx
add rdi, rsi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rbx + rdi], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1800db9c0
mov rcx, rsi
test r14, r14
je 0x1800db9e3
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1800db9e9
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov rcx, rsi
call qword [fcn.18017ba2e]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret