joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ce410
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x40
mov rax, qword [0x180428208]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [rsp + 0x98]
mov esi, r9d
movzx r15d, r8b
mov ebx, edx
mov rbp, rcx
cmp dword [rdi], 0
je 0x1800ce44d
mov eax, 0xffffffff
jmp 0x1800ce57d
mov qword [rsp + 0x80], r14
movzx r14d, byte [rsp + 0x90]
nop
mov rcx, qword [rbp + 0x110]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1800ce47e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
movsx eax, word [rsp + 0x2c]
mov r8d, ebx
movsx edx, word [rsp + 0x30]
movsx r11d, word [rsp + 0x20]
sub edx, eax
mov eax, dword [0x1804284f0]
inc edx
movsx r9d, word [rsp + 0x26]
mov dword [0x1804284f8], r11d
mov dword [0x1804284f4], edx
cmp eax, 0xffffffff
jne 0x1800ce4be
mov eax, r9d
mov dword [0x1804284f0], eax
jmp 0x1800ce4d1
mov ecx, r9d
sub ecx, edx
inc ecx
cmp eax, ecx
jge 0x1800ce4d1
mov eax, ecx
mov dword [0x1804284f0], ecx
movsx r10d, word [rsp + 0x22]
lea ecx, [rdx + rax]
cmp ecx, r10d
jle 0x1800ce4ea
mov eax, r10d
sub eax, edx
mov dword [0x1804284f0], eax
test eax, eax
jns 0x1800ce4f6
xor eax, eax
mov dword [0x1804284f0], eax
test r14b, r14b
je 0x1800ce503
movsx ecx, r9w
add ecx, esi
jmp 0x1800ce506
lea ecx, [rax + rsi]
cmp ecx, eax
jge 0x1800ce50e
mov ecx, eax
jmp 0x1800ce517
add edx, eax
cmp ecx, edx
jl 0x1800ce517
lea ecx, [rdx - 1]
test r15b, r15b
je 0x1800ce525
movsx r8d, word [rsp + 0x24]
add r8d, ebx
test r8d, r8d
jns 0x1800ce52f
xor r8d, r8d
jmp 0x1800ce538
cmp r8d, r11d
jl 0x1800ce538
lea r8d, [r11 - 1]
movzx edx, cx
mov rcx, qword [rbp + 0x110]
shl edx, 0x10
movzx eax, r8w
or edx, eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x1800ce573
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1800ce460
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x1800ce575
xor eax, eax
mov r14, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800a5910
add rsp, 0x40
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800ce5a0
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x180428208]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx ebp, word [reloc.WS2_32.dll_getsockopt]
xor r14d, r14d
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x30], r14d
cmp dword [rdx], r14d
jne 0x1800ce5f2
mov rcx, qword [rcx + 0x110]
movzx edx, bp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
jne 0x1800ce5fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov eax, 0xffffffff
jmp 0x1800ce6ae
mov rcx, qword [rdi + 0x110]
mov qword [rsp + 0x90], rbx
mov ebx, dword [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x1800ce699
nop
mov rcx, qword [rdi + 0x110]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x1800ce699
movsx eax, word [rsp + 0x38]
mov edx, 0x20
movsx r8d, word [rsp + 0x3a]
mov r9d, ebx
mov rcx, qword [rdi + 0x110]
imul r8d, eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x1800ce68e
mov r8d, dword [rsp + 0x34]
lea rax, [rsp + 0x34]
mov rcx, qword [rdi + 0x110]
mov r9d, ebx
movzx edx, bp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x1800ce6cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x1800ce620
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800a5910
mov rbp, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
movsx eax, word [rsp + 0x38]
mov ecx, r14d
movsx edx, word [rsp + 0x48]
mov dword [0x1804284f8], eax
movsx eax, word [rsp + 0x44]
sub edx, eax
mov dword [0x1804284f0], r14d
movsx eax, word [rsp + 0x3e]
inc edx
sub eax, edx
mov dword [0x1804284f4], edx
inc eax
test eax, eax
jle 0x1800ce70a
mov dword [0x1804284f0], eax
mov ecx, eax
movsx r8d, word [rsp + 0x3a]
lea eax, [rdx + rcx]
cmp eax, r8d
jle 0x1800ce723
mov ecx, r8d
sub ecx, edx
mov dword [0x1804284f0], ecx
test ecx, ecx
jns 0x1800ce72e
mov dword [0x1804284f0], r14d
mov rcx, qword [rdi + 0x110]
lea rdx, [0x18043b5b8]
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
test eax, eax
je 0x1800ce699
xor eax, eax
jmp 0x1800ce6a6
Function at 0x1800d8d30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r9, qword [r8 + 8]
mov rsi, rcx
sub r9, qword [r8]
mov rdi, r8
mov rcx, qword [rcx]
sar r9, 3
mov rax, qword [rsi + 8]
sub rax, rcx
movzx ebp, dl
sar rax, 3
cmp rax, r9
mov rbx, rax
cmovb rbx, r9
cmp rbx, rax
jbe 0x1800d8d98
mov rax, qword [rsi + 0x10]
mov rdx, rbx
sub rax, rcx
mov rcx, rsi
sar rax, 3
cmp rbx, rax
jbe 0x1800d8d93
and rdx, 0xfffffffffffffff8
add rdx, 8
call fcn.1800d5ea0
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
sub rax, rcx
sar rax, 3
cmp rbx, rax
jbe 0x1800d8dce
mov rax, qword [rdi + 0x10]
mov rdx, rbx
sub rax, rcx
mov rcx, rdi
sar rax, 3
cmp rbx, rax
jbe 0x1800d8dc9
and rdx, 0xfffffffffffffff8
add rdx, 8
call fcn.1800d5ea0
mov r8, qword [rdi]
lea rax, [rbp - 1]
shr rax, 0x3f
xor edx, edx
dec rax
mov qword [rdi + 0x18], 0xffffffffffffffff
mov r11, qword [rsi]
mov qword [rsi + 0x18], 0xffffffffffffffff
movq xmm4, rax
punpcklqdq xmm4, xmm4
test rbx, rbx
je 0x1800d8ee4
cmp rbx, 4
jb 0x1800d8eae
lea rcx, [r11 - 8]
lea rcx, [rcx + rbx*8]
lea r9, [r8 - 8]
lea r9, [r9 + rbx*8]
cmp r8, rcx
ja 0x1800d8e2b
cmp r9, r11
jae 0x1800d8eae
mov r10, rbx
and r10, 0xfffffffffffffffc
mov rcx, r11
lea r9, [r8 + 0x10]
sub rcx, r8
nop dword [rax]
movdqu xmm2, xmmword [r9 - 0x10]
add rdx, 4
movdqu xmm1, xmmword [r9 + rcx - 0x10]
lea r9, [r9 + 0x20]
movdqa xmm3, xmm2
xorps xmm3, xmm1
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r9 + rcx - 0x30], xmm0
movdqu xmm1, xmmword [r9 + rcx - 0x20]
movdqu xmmword [r9 - 0x30], xmm3
movdqu xmm3, xmmword [r9 - 0x20]
movdqa xmm2, xmm3
xorps xmm2, xmm1
andps xmm2, xmm4
movdqa xmm0, xmm2
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r9 + rcx - 0x20], xmm0
movdqu xmmword [r9 - 0x20], xmm3
cmp rdx, r10
jne 0x1800d8e40
cmp rdx, rbx
je 0x1800d8ee4
sub r11, r8
lea r10, [r8 + rdx*8]
sub rbx, rdx
nop dword [rax + rax]
mov r8, qword [r10]
lea r10, [r10 + 8]
mov r9, r8
xor r9, qword [r10 + r11 - 8]
and r9, rax
xor qword [r10 + r11 - 8], r9
xor r9, r8
mov qword [r10 - 8], r9
sub rbx, 1
jne 0x1800d8ec0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800d9210
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r10, qword [rsp + 0x30]
mov rbx, rcx
xor ecx, ecx
mov r11, rdx
test r10, r10
je 0x1800d936e
cmp r10, 8
jb 0x1800d933c
movq xmm3, qword [rbx]
lea rax, [r10 - 1]
lea rax, [r8 + rax*8]
punpcklqdq xmm3, xmm3
lea rdx, [r10 - 1]
lea rdx, [r11 + rdx*8]
cmp r11, rax
ja 0x1800d9258
cmp rdx, r8
jae 0x1800d933c
lea rax, [r10 - 1]
lea rax, [r9 + rax*8]
cmp r11, rax
ja 0x1800d926e
cmp rdx, r9
jae 0x1800d933c
cmp r11, rbx
ja 0x1800d927c
cmp rdx, rbx
jae 0x1800d933c
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rsi, r10
and rsi, 0xfffffffffffffff8
mov qword [rsp + 0x20], rdi
mov rax, r9
lea rdi, [r8 + 0x10]
sub rax, r8
mov rdx, r11
sub rdx, r8
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rdi - 0x10]
add rcx, 8
movdqu xmm2, xmmword [rdi + rax]
movdqu xmm1, xmmword [rdi - 0x10]
lea rdi, [rdi + 0x40]
xorps xmm1, xmm0
andps xmm1, xmm3
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdi - 0x40]
movdqu xmmword [rdx + rdi - 0x50], xmm1
movdqa xmm1, xmm2
xorps xmm1, xmm0
andps xmm1, xmm3
xorps xmm1, xmm2
movdqu xmm0, xmmword [rax + rdi - 0x30]
movdqu xmmword [rdi + rdx - 0x40], xmm1
movdqu xmm1, xmmword [rdi - 0x30]
xorps xmm1, xmm0
andps xmm1, xmm3
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax + rdi - 0x20]
movdqu xmmword [rdx + rdi - 0x30], xmm1
movdqu xmm1, xmmword [rdi - 0x20]
xorps xmm1, xmm0
andps xmm1, xmm3
xorps xmm1, xmm0
movdqu xmmword [rdx + rdi - 0x20], xmm1
cmp rcx, rsi
jne 0x1800d92b0
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
cmp rcx, r10
je 0x1800d936e
sub r9, r8
lea rax, [r8 + rcx*8]
sub r11, r8
sub r10, rcx
nop dword [rax]
mov rdx, qword [r9 + rax]
xor rdx, qword [rax]
lea rax, [rax + 8]
and rdx, qword [rbx]
xor rdx, qword [r9 + rax - 8]
mov qword [r11 + rax - 8], rdx
sub r10, 1
jne 0x1800d9350
pop rbx
ret
Function at 0x1800d99d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
mov qword [rsp + 0x20], rbp
cmp r9, rdx
mov rbp, rdx
mov rdi, r8
cmovb rbp, r9
mov r10, rdx
xor r11d, r11d
mov rsi, rcx
mov ebx, r11d
test rbp, rbp
je 0x1800d9a76
mov qword [rsp + 0x30], r14
mov r14, rcx
mov qword [rsp + 0x38], r15
sub r14, r8
mov r15, r8
nop word [rax + rax]
mov rcx, qword [r14 + r15]
lea r15, [r15 + 8]
mov r8, rcx
mov rdx, rcx
sub r8, qword [r15 - 8]
xor rdx, qword [r15 - 8]
xor r8, rcx
or r8, rdx
xor r8, rcx
shr r8, 0x3f
lea rcx, [rdx - 1]
neg r8
and r8, 0xfffffffffffffffe
shr rcx, 0x3f
not rdx
mov rax, r8
xor rax, rbx
shr rdx, 0x3f
and rcx, rdx
xor rax, 1
neg rcx
mov rbx, rcx
and rbx, rax
xor rbx, r8
xor rbx, 1
sub rbp, 1
jne 0x1800d9a10
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x20]
cmp r10, r9
jae 0x1800d9b08
mov rax, r9
sub rax, r10
cmp rax, 4
jb 0x1800d9ae0
and eax, 3
mov rcx, r9
sub rcx, rax
xorps xmm2, xmm2
xorps xmm1, xmm1
nop
movdqu xmm0, xmmword [rdi + r10*8]
orps xmm2, xmm0
movdqu xmm0, xmmword [rdi + r10*8 + 0x10]
add r10, 4
orps xmm1, xmm0
cmp r10, rcx
jne 0x1800d9aa0
orps xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
orps xmm1, xmm0
movq r11, xmm1
cmp r10, r9
je 0x1800d9aec
nop word [rax + rax]
or r11, qword [rdi + r10*8]
inc r10
cmp r10, r9
jne 0x1800d9ae0
lea rax, [r11 - 1]
not r11
shr rax, 0x3f
shr r11, 0x3f
and rax, r11
dec rax
or rax, rbx
pop rdi
pop rsi
pop rbx
ret
jbe 0x1800d9ba0
mov rax, r10
sub rax, r9
cmp rax, 4
jb 0x1800d9b70
and eax, 3
mov rcx, r10
sub rcx, rax
xorps xmm2, xmm2
xorps xmm1, xmm1
nop dword [rax]
movdqu xmm0, xmmword [rsi + r9*8]
orps xmm2, xmm0
movdqu xmm0, xmmword [rsi + r9*8 + 0x10]
add r9, 4
orps xmm1, xmm0
cmp r9, rcx
jne 0x1800d9b30
orps xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
orps xmm1, xmm0
movq r11, xmm1
cmp r9, r10
je 0x1800d9b7c
nop word [rax + rax]
or r11, qword [rsi + r9*8]
inc r9
cmp r9, r10
jne 0x1800d9b70
lea rax, [r11 - 1]
xor rbx, 1
shr rax, 0x3f
not r11
shr r11, 0x3f
and rax, r11
neg rax
and rax, rbx
xor rax, 1
pop rdi
pop rsi
pop rbx
ret
mov eax, ebx
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800d9bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
mov rax, qword [rsp + 0x38]
mov rbx, r9
movzx r10d, byte [rsp + 0x40]
cmp rax, r8
mov qword [rsp + 0x18], rbp
mov r11, r8
mov rbp, r8
mov rdi, rdx
cmovb rbp, rax
mov rsi, rcx
dec r10
shr r10, 0x3f
dec r10
mov qword [rcx], r10
test rbp, rbp
je 0x1800d9c5f
mov qword [rsp + 0x20], r14
mov r14, rbx
mov qword [rsp + 0x28], r15
mov r15, rdx
sub r15, rbx
mov rdx, qword [r15 + r14]
lea r14, [r14 + 8]
mov r9, rdx
mov r8, rdx
sub r9, qword [r14 - 8]
mov rcx, r10
xor r8, qword [r14 - 8]
xor r9, rdx
or r9, r8
xor r9, rdx
shr r9, 0x3f
lea rdx, [r8 - 1]
neg r9
shr rdx, 0x3f
xor rcx, r9
not r8
shr r8, 0x3f
and rdx, r8
neg rdx
mov r10, rdx
and r10, rcx
xor r10, r9
mov qword [rsi], r10
sub rbp, 1
jne 0x1800d9c02
mov r15, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
cmp r11, rax
jae 0x1800d9cff
mov rdx, rax
xor ecx, ecx
sub rdx, r11
cmp rdx, 4
jb 0x1800d9cd0
and edx, 3
mov rcx, rax
sub rcx, rdx
xorps xmm2, xmm2
xorps xmm1, xmm1
nop word [rax + rax]
movdqu xmm0, xmmword [rbx + r11*8]
orps xmm2, xmm0
movdqu xmm0, xmmword [rbx + r11*8 + 0x10]
add r11, 4
orps xmm1, xmm0
cmp r11, rcx
jne 0x1800d9c90
orps xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
orps xmm1, xmm0
movq rcx, xmm1
cmp r11, rax
je 0x1800d9cdc
nop word [rax + rax]
or rcx, qword [rbx + r11*8]
inc r11
cmp r11, rax
jne 0x1800d9cd0
lea rax, [rcx - 1]
not rcx
shr rax, 0x3f
shr rcx, 0x3f
and rax, rcx
dec rax
or qword [rsi], rax
mov rax, rsi
mov rbx, qword [rsp + 0x30]
pop rdi
pop rsi
ret
jbe 0x1800d9d77
mov rdx, r11
xor ecx, ecx
sub rdx, rax
cmp rdx, 4
jb 0x1800d9d53
and edx, 3
mov rcx, r11
sub rcx, rdx
xorps xmm2, xmm2
xorps xmm1, xmm1
nop
movdqu xmm0, xmmword [rdi + rax*8]
orps xmm2, xmm0
movdqu xmm0, xmmword [rdi + rax*8 + 0x10]
add rax, 4
orps xmm1, xmm0
cmp rax, rcx
jne 0x1800d9d20
orps xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
orps xmm1, xmm0
movq rcx, xmm1
cmp rax, r11
je 0x1800d9d5f
or rcx, qword [rdi + rax*8]
inc rax
cmp rax, r11
jne 0x1800d9d53
lea rax, [rcx - 1]
not rcx
shr rax, 0x3f
shr rcx, 0x3f
and rax, rcx
neg rax
and qword [rsi], rax
mov rbx, qword [rsp + 0x30]
mov rax, rsi
pop rdi
pop rsi
ret
Function at 0x1800d9d90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
mov rax, qword [rsp + 0x30]
mov r11, r8
cmp rax, r8
mov qword [rsp + 0x10], rsi
mov rbx, rdx
mov r14, rcx
cmovb r11, rax
xor r10d, r10d
mov esi, r10d
test r11, r11
je 0x1800d9e59
mov qword [rsp + 0x18], rdi
mov rdi, rdx
sub rdi, r9
cmp r11, 4
jb 0x1800d9e38
mov rdx, r11
lea rcx, [r9 + 0x10]
and rdx, 0xfffffffffffffffc
xorps xmm3, xmm3
xorps xmm2, xmm2
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx - 0x10]
add rsi, 4
movdqu xmm1, xmmword [rdi + rcx - 0x10]
lea rcx, [rcx + 0x20]
xorps xmm1, xmm0
orps xmm3, xmm1
movdqu xmm1, xmmword [rcx + rdi - 0x20]
movdqu xmm0, xmmword [rcx - 0x20]
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rsi, rdx
jne 0x1800d9df0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movq r10, xmm2
cmp rsi, r11
je 0x1800d9e54
lea rdx, [r9 + rsi*8]
sub r11, rsi
nop
mov rcx, qword [rdx + rdi]
xor rcx, qword [rdx]
lea rdx, [rdx + 8]
or r10, rcx
sub r11, 1
jne 0x1800d9e40
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
cmp r8, rax
jae 0x1800d9ece
mov rcx, rax
sub rcx, r8
cmp rcx, 4
jb 0x1800d9ec0
and ecx, 3
mov rdx, rax
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm1, xmm1
nop
movdqu xmm0, xmmword [r9 + r8*8]
orps xmm2, xmm0
movdqu xmm0, xmmword [r9 + r8*8 + 0x10]
add r8, 4
orps xmm1, xmm0
cmp r8, rdx
jne 0x1800d9e80
orps xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
orps xmm1, xmm0
movq rcx, xmm1
or r10, rcx
cmp r8, rax
je 0x1800d9f3c
nop dword [rax]
or r10, qword [r9 + r8*8]
inc r8
cmp r8, rax
jne 0x1800d9ec0
jmp 0x1800d9f3c
jbe 0x1800d9f3c
mov rcx, r8
sub rcx, rax
cmp rcx, 4
jb 0x1800d9f30
and ecx, 3
mov rdx, r8
sub rdx, rcx
xorps xmm2, xmm2
xorps xmm1, xmm1
nop dword [rax + rax]
movdqu xmm0, xmmword [rbx + rax*8]
orps xmm2, xmm0
movdqu xmm0, xmmword [rbx + rax*8 + 0x10]
add rax, 4
mov rcx, rax
orps xmm1, xmm0
cmp rax, rdx
jne 0x1800d9ef0
orps xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
orps xmm1, xmm0
movq rax, xmm1
or r10, rax
mov rax, rcx
cmp rcx, r8
je 0x1800d9f3c
nop dword [rax]
or r10, qword [rbx + rax*8]
inc rax
cmp rax, r8
jne 0x1800d9f30
mov rbx, qword [rsp + 0x20]
lea rax, [r10 - 1]
shr rax, 0x3f
not r10
shr r10, 0x3f
and rax, r10
neg rax
mov qword [r14], rax
mov rax, r14
pop r14
ret
Function at 0x1800dd7d0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], reloc.WS2_32.dll_setsockopt
lea rax, str.BOTAN_MLOCK_POOL_SIZE
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
mov edi, 0x200
mov edx, edi
movdqa xmmword [rsp + 0x20], xmm0
call fcn.1800ddb10
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
test eax, eax
je 0x1800dd877
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x34]
imul rcx, rax, 0xb
mov rax, qword [rsp + 0x70]
cmp rax, rcx
jbe 0x1800dd877
sub rax, rcx
cmp rbx, rdi
cmova rbx, rdi
shl rbx, 0xa
cmp rbx, rax
cmovb rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov rbx, qword [rsp + 0x80]
xor eax, eax
add rsp, 0x60
pop rdi
ret

Function at 0x1800ddca0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov dword [rsp + 0x20], 1
test rdx, rdx
je 0x1800ddcf1
movabs rax, 0x1fffffffffffffff
cmp rdx, rax
ja 0x1800dde0c
call fcn.180003514
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14d, dword [rsp + 0x2c]
test rsi, rsi
je 0x1800dddfa
lea r15, [r14 + r14*2]
nop
mov r9d, 4
mov r8d, 0x3000
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1800dddf0
lea rbp, [rax + r14]
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rcx, rbx
test eax, eax
jne 0x1800ddd5d
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1800dddf0
mov r8, r15
xor edx, edx
call fcn.180283390
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0xa8], r12d
mov edx, dword [rsp + 0x2c]
lea r9, [rsp + 0xa8]
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0xb0], r12d
mov edx, dword [rsp + 0x2c]
lea rcx, [rbx + r14*2]
lea r9, [rsp + 0xb0]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0xb8], rbp
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x1800ddde0
mov qword [rdx], rbp
add qword [rdi + 8], 8
jmp 0x1800dddf0
lea r8, [rsp + 0xb8]
mov rcx, rdi
call fcn.1800ddfe0
sub rsi, 1
jne 0x1800ddd10
mov rax, rdi
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1800030ee
int3
Function at 0x1800dde20
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x58
mov rsi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsi]
xor r15d, r15d
mov rax, qword [rsi + 8]
mov r14d, r15d
mov ebp, dword [rsp + 0x24]
sub rax, rcx
cmp rax, 8
jb 0x1800ddf25
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x50], rdi
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rcx + r14*8]
xor eax, eax
mov rdi, rbx
mov rcx, rbp
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
lea r9, [rsp + 0x80]
mov rdi, rbx
mov dword [rsp + 0x80], r15d
sub rdi, rbp
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
lea rcx, [rbx + rbp]
lea r9, [rsp + 0x88]
mov dword [rsp + 0x88], r15d
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsi]
inc r14
mov rax, qword [rsi + 8]
sub rax, rcx
sar rax, 3
cmp r14, rax
jne 0x1800dde70
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x90]
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x1800e2ca0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
call qword [rax + 0x20]
test al, al
jne 0x1800e2cd2
mov rcx, rbx
call fcn.1800a53c0
lea r9, [rbx + 0x20]
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp 0x1800e3190
Function at 0x1800e4e30
Capabilities:
Encrypt data using blowfish

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov edx, reloc.WS2_32.dll_select
add rcx, 0x20
call fcn.1800dfff0
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x1800e4ec2
mov r8d, 0x48
lea rdx, [0x180347500]
call fcn.180282cf0
mov edx, 0x400
lea rcx, [rdi + 8]
call fcn.1800dfff0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x1800e4ec2
mov r8d, 0x1000
lea rdx, [0x180347550]
call fcn.180282cf0
mov r8, qword [rsi + 8]
xor r9d, r9d
mov rdx, qword [rsi]
mov rcx, rdi
mov qword [rsp + 0x20], 0
call fcn.1800e4ef0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea r9, [0x1803e49b0]
mov dword [rsp + 0x20], 0x7b
lea r8, str.copy_mem
lea rdx, str.If_n___0_then_args_are_not_null
lea rcx, str.n___0_implies_in___nullptr__out___nullptr
call fcn.1800d1f70
int3
Function at 0x1800ed230
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r10d, dword [rcx]
lea rsi, [r8 + 0x78]
mov r11d, dword [rdx]
lea r14, [0x18034ab00]
mov rbx, rdx
mov rdi, rcx
mov ebp, 8
nop dword [rax]
nop word [rax + rax]
mov edx, r11d
mov r9d, r11d
xor edx, dword [rsi + 4]
mov eax, edx
ror r9d, 4
xor r9d, dword [rsi]
shr eax, 8
and eax, 0x3f
add eax, 0x140
movzx eax, byte [rax + r14]
imul r8d, eax, 0x841018
mov eax, r9d
shr eax, 8
and eax, 0x3f
add eax, 0x100
and r8d, 0x20404010
movzx eax, byte [rax + r14]
imul ecx, eax, 0x912140
mov eax, edx
shr eax, 0x10
and eax, 0x3f
add eax, 0xc0
and ecx, 0x42080100
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x60221
mov eax, edx
shr eax, 0x18
and edx, 0x3f
and eax, 0x3f
add edx, 0x1c0
add eax, 0x40
and ecx, 0x802081
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x2012020
mov eax, r9d
shr eax, 0x10
and eax, 0x3f
sub eax, 0xffffff80
and ecx, 0x80108020
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x901048
mov eax, r9d
shr rax, 0x18
and r9d, 0x3f
and eax, 0x3f
add r9d, 0x180
and ecx, 0x8020208
movzx eax, byte [rax + r14]
xor r8d, ecx
imul ecx, eax, 0x41106
movzx eax, byte [rdx + r14]
and ecx, 0x1010404
xor r8d, ecx
imul ecx, eax, 0x212240
movzx eax, byte [r9 + r14]
and ecx, 0x10041040
xor r8d, ecx
imul ecx, eax, 0x120202
and ecx, 0x4200802
xor r8d, ecx
xor r10d, r8d
mov edx, r10d
mov r9d, r10d
xor edx, dword [rsi - 4]
mov eax, edx
ror r9d, 4
xor r9d, dword [rsi - 8]
shr eax, 8
and eax, 0x3f
add eax, 0x140
movzx eax, byte [rax + r14]
imul r8d, eax, 0x841018
mov eax, r9d
shr eax, 8
and eax, 0x3f
and r8d, 0x20404010
add eax, 0x100
movzx eax, byte [rax + r14]
imul ecx, eax, 0x912140
lea rsi, [rsi - 0x10]
mov eax, edx
shr eax, 0x10
and eax, 0x3f
add eax, 0xc0
and ecx, 0x42080100
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x60221
mov eax, edx
shr eax, 0x18
and edx, 0x3f
and eax, 0x3f
add edx, 0x1c0
add eax, 0x40
and ecx, 0x802081
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x2012020
mov eax, r9d
shr eax, 0x10
and eax, 0x3f
sub eax, 0xffffff80
and ecx, 0x80108020
xor r8d, ecx
movzx eax, byte [rax + r14]
imul ecx, eax, 0x901048
mov eax, r9d
shr rax, 0x18
and r9d, 0x3f
and eax, 0x3f
add r9d, 0x180
and ecx, 0x8020208
movzx eax, byte [rax + r14]
xor r8d, ecx
imul ecx, eax, 0x41106
movzx eax, byte [rdx + r14]
and ecx, 0x1010404
xor r8d, ecx
imul ecx, eax, 0x212240
movzx eax, byte [r9 + r14]
and ecx, 0x10041040
xor r8d, ecx
imul ecx, eax, 0x120202
and ecx, 0x4200802
xor r8d, ecx
xor r11d, r8d
sub rbp, 1
jne 0x1800ed270
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov dword [rdi], r10d
mov rdi, qword [rsp + 0x28]
mov dword [rbx], r11d
mov rbx, qword [rsp + 0x10]
pop r14
ret