joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180009be0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov al, byte [rdx]
mov byte [rcx], al
mov al, byte [rdx + 1]
mov byte [rcx + 1], al
mov al, byte [rdx + 2]
mov byte [rcx + 2], al
mov al, byte [rdx + 3]
mov byte [rcx + 3], al
mov al, byte [rdx + 4]
mov byte [rcx + 4], al
mov al, byte [rdx + 5]
mov byte [rcx + 5], al
mov al, byte [rdx + 6]
mov byte [rcx + 6], al
mov al, byte [rdx + 7]
mov byte [rcx + 7], al
mov al, byte [rdx + 8]
mov byte [rcx + 8], al
mov al, byte [rdx + 9]
mov byte [rcx + 9], al
mov al, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
mov al, byte [rdx + 0xb]
mov byte [rcx + 0xb], al
mov al, byte [rdx + 0xc]
mov byte [rcx + 0xc], al
mov al, byte [rdx + 0xd]
mov byte [rcx + 0xd], al
mov al, byte [rdx + 0xe]
mov byte [rcx + 0xe], al
mov al, byte [rdx + 0xf]
mov byte [rcx + 0xf], al
mov al, byte [rdx + 0x10]
mov byte [rcx + 0x10], al
mov al, byte [rdx + 0x11]
mov byte [rcx + 0x11], al
mov al, byte [rdx + 0x12]
mov byte [rcx + 0x12], al
mov al, byte [rdx + 0x13]
mov byte [rcx + 0x13], al
mov al, byte [rdx + 0x14]
mov byte [rcx + 0x14], al
mov al, byte [rdx + 0x15]
mov byte [rcx + 0x15], al
mov al, byte [rdx + 0x16]
mov byte [rcx + 0x16], al
mov al, byte [rdx + 0x17]
mov byte [rcx + 0x17], al
mov al, byte [rdx + 0x18]
mov byte [rcx + 0x18], al
mov al, byte [rdx + 0x19]
mov byte [rcx + 0x19], al
mov al, byte [rdx + 0x1a]
mov byte [rcx + 0x1a], al
mov al, byte [rdx + 0x1b]
mov byte [rcx + 0x1b], al
mov al, byte [rdx + 0x1c]
mov byte [rcx + 0x1c], al
mov al, byte [rdx + 0x1d]
mov byte [rcx + 0x1d], al
mov al, byte [rdx + 0x1e]
mov byte [rcx + 0x1e], al
mov al, byte [rdx + 0x1f]
mov byte [rcx + 0x1f], al
mov eax, 8
lea r9, str.cw
lea r8, [0x1800a4fe0]
jmp 0x180009d01
movzx ebx, byte [r15 + r9]
movzx r10d, byte [r14 + r9]
movzx r11d, byte [rsi + r9]
movzx edx, byte [rdi + r9]
xor bl, byte [rcx + rax*4 - 0x20]
mov byte [rcx + rax*4], bl
xor r10b, byte [rcx + rax*4 - 0x1f]
mov byte [rcx + rax*4 + 1], r10b
xor r11b, byte [rcx + rax*4 - 0x1e]
mov byte [rcx + rax*4 + 2], r11b
xor dl, byte [rcx + rax*4 - 0x1d]
mov byte [rcx + rax*4 + 3], dl
add rax, 1
cmp rax, 0x3c
je 0x180009d53
movzx ebx, byte [rcx + rax*4 - 4]
movzx r10d, byte [rcx + rax*4 - 3]
movzx r15d, bl
movzx r14d, r10b
movzx r11d, byte [rcx + rax*4 - 2]
movzx esi, r11b
movzx edx, byte [rcx + rax*4 - 1]
movzx edi, dl
mov ebp, eax
and ebp, 7
cmp ebp, 4
je 0x180009cc0
test ebp, ebp
jne 0x180009cd4
movzx r10d, byte [rsi + r9]
movzx r11d, byte [rdi + r9]
movzx edx, byte [r15 + r9]
mov esi, eax
shr esi, 3
movzx ebx, byte [rsi + r8]
xor bl, byte [r14 + r9]
jmp 0x180009cd4
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x18000a300
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx edx, byte [rcx]
lea rax, str.cw
mov dl, byte [rdx + rax]
mov byte [rcx], dl
movzx edx, byte [rcx + 4]
mov dl, byte [rdx + rax]
mov byte [rcx + 4], dl
movzx edx, byte [rcx + 8]
mov dl, byte [rdx + rax]
mov byte [rcx + 8], dl
movzx edx, byte [rcx + 0xc]
mov dl, byte [rdx + rax]
mov byte [rcx + 0xc], dl
movzx edx, byte [rcx + 1]
mov dl, byte [rdx + rax]
mov byte [rcx + 1], dl
movzx edx, byte [rcx + 5]
mov dl, byte [rdx + rax]
mov byte [rcx + 5], dl
movzx edx, byte [rcx + 9]
mov dl, byte [rdx + rax]
mov byte [rcx + 9], dl
movzx edx, byte [rcx + 0xd]
mov dl, byte [rdx + rax]
mov byte [rcx + 0xd], dl
movzx edx, byte [rcx + 2]
mov dl, byte [rdx + rax]
mov byte [rcx + 2], dl
movzx edx, byte [rcx + 6]
mov dl, byte [rdx + rax]
mov byte [rcx + 6], dl
movzx edx, byte [rcx + 0xa]
mov dl, byte [rdx + rax]
mov byte [rcx + 0xa], dl
movzx edx, byte [rcx + 0xe]
mov dl, byte [rdx + rax]
mov byte [rcx + 0xe], dl
movzx edx, byte [rcx + 3]
mov dl, byte [rdx + rax]
mov byte [rcx + 3], dl
movzx edx, byte [rcx + 7]
mov dl, byte [rdx + rax]
mov byte [rcx + 7], dl
movzx edx, byte [rcx + 0xb]
mov dl, byte [rdx + rax]
mov byte [rcx + 0xb], dl
movzx edx, byte [rcx + 0xf]
mov al, byte [rdx + rax]
mov byte [rcx + 0xf], al
ret

Function at 0x18000a700
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not ecx
cmp r8, 4
jb 0x18000a765
lea r9, [0x1800a50f0]
nop
movzx r10d, cl
shr ecx, 8
movzx eax, byte [rdx]
xor r10d, eax
xor ecx, dword [r9 + r10*4]
movzx r10d, cl
shr ecx, 8
movzx eax, byte [rdx + 1]
xor r10d, eax
xor ecx, dword [r9 + r10*4]
movzx r10d, cl
shr ecx, 8
movzx eax, byte [rdx + 2]
xor r10d, eax
xor ecx, dword [r9 + r10*4]
movzx r10d, cl
shr ecx, 8
movzx eax, byte [rdx + 3]
xor r10d, eax
xor ecx, dword [r9 + r10*4]
add rdx, 4
add r8, 0xfffffffffffffffc
cmp r8, 3
ja 0x18000a710
test r8, r8
je 0x18000a77b
test r8b, 1
jne 0x18000a780
mov r9, r8
cmp r8, 1
jne 0x18000a7ab
jmp 0x18000a7f0
mov eax, ecx
not eax
ret
mov eax, ecx
shr eax, 8
movzx r9d, byte [rdx]
movzx r10d, cl
xor r10d, r9d
lea rcx, [0x1800a50f0]
xor eax, dword [rcx + r10*4]
add rdx, 1
lea r9, [r8 - 1]
mov ecx, eax
cmp r8, 1
je 0x18000a7f0
xor r8d, r8d
lea r10, [0x1800a50f0]
mov eax, ecx
nop word [rax + rax]
movzx r11d, al
shr eax, 8
movzx ecx, byte [rdx + r8]
xor r11d, ecx
xor eax, dword [r10 + r11*4]
movzx r11d, al
shr eax, 8
movzx ecx, byte [rdx + r8 + 1]
xor r11d, ecx
xor eax, dword [r10 + r11*4]
add r8, 2
cmp r9, r8
jne 0x18000a7c0
not eax
ret
Function at 0x18000d700
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r12, r9
mov rsi, r8
mov r15d, edx
mov r14, rcx
mov r13, qword [rsp + 0x90]
test r13, r13
je 0x18000d731
mov dword [r13], 0
test rsi, rsi
je 0x18000d8ce
test r12, r12
je 0x18000d8ce
mov dword [r12], r15d
mov rax, qword [r14 + 0x68]
mov rax, qword [rax + 0x20]
mov ecx, r15d
mov eax, dword [rax + rcx*4]
mov qword [r12 + 8], rax
movzx eax, word [rsi + 4]
mov word [r12 + 0x10], ax
movzx eax, word [rsi + 6]
mov word [r12 + 0x12], ax
movzx eax, word [rsi + 8]
mov word [r12 + 0x14], ax
movzx eax, word [rsi + 0xa]
mov word [r12 + 0x16], ax
movzx edx, word [rsi + 0xe]
movzx ecx, word [rsi + 0xc]
call fcn.1800110c0
mov qword [r12 + 0x18], rax
mov eax, dword [rsi + 0x10]
mov dword [r12 + 0x20], eax
mov eax, dword [rsi + 0x14]
mov qword [r12 + 0x28], rax
mov eax, dword [rsi + 0x18]
mov qword [r12 + 0x30], rax
movzx eax, word [rsi + 0x24]
mov word [r12 + 0x38], ax
mov eax, dword [rsi + 0x26]
mov dword [r12 + 0x3c], eax
mov eax, dword [rsi + 0x2a]
mov qword [r12 + 0x40], rax
movzx edi, word [rsi + 0x1c]
cmp edi, 0x1ff
mov ebp, 0x1ff
cmovae edi, ebp
lea rcx, [r12 + 0x58]
lea rbx, [rsi + 0x2e]
mov rdx, rbx
mov r8, rdi
call fcn.180072cc0
mov byte [r12 + rdi + 0x58], 0
movzx eax, word [rsi + 0x20]
cmp eax, 0x1ff
cmovb ebp, eax
mov dword [r12 + 0x48], ebp
lea rcx, [r12 + 0x258]
movzx eax, word [rsi + 0x1c]
add rax, rsi
add rax, 0x2e
movzx edx, word [rsi + 0x1e]
add rdx, rax
mov r8, rbp
call fcn.180072cc0
mov byte [r12 + rbp + 0x258], 0
mov rcx, r14
mov edx, r15d
call fcn.18000d110
mov dword [r12 + 0x4c], eax
mov rcx, r14
mov edx, r15d
call fcn.18000d060
mov dword [r12 + 0x50], eax
mov rcx, r14
mov edx, r15d
call fcn.18000d0a0
mov dword [r12 + 0x54], eax
mov rcx, qword [r12 + 0x28]
mov rdx, qword [r12 + 0x30]
cmp rcx, rdx
cmovbe rcx, rdx
mov rax, qword [r12 + 0x40]
cmp rcx, rax
cmovbe rcx, rax
mov eax, 1
mov ebp, 0xffffffff
cmp rcx, rbp
jne 0x18000d8dd
movzx ebp, word [rsi + 0x1e]
test ebp, ebp
je 0x18000d8dd
movzx ecx, word [rsi + 0x1c]
add rbx, rcx
nop dword [rax]
cmp ebp, 3
jbe 0x18000d952
mov ebp, ebp
movzx ecx, word [rbx + 2]
lea rdi, [rcx + 4]
cmp rdi, rbp
ja 0x18000d952
cmp word [rbx], 1
je 0x18000d8ee
add rbx, rdi
sub ebp, ecx
add ebp, 0xfffffffc
jne 0x18000d8a0
jmp 0x18000d8dd
xor eax, eax
test r14, r14
je 0x18000d8dd
mov dword [r14 + 0x1c], 0x18
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test r13, r13
je 0x18000d900
mov dword [r13], 1
mov rdx, qword [r12 + 0x30]
mov ebp, 0xffffffff
cmp rdx, rbp
jne 0x18000d922
cmp cx, 7
jbe 0x18000d952
mov rdx, qword [rbx + 4]
mov qword [r12 + 0x30], rdx
add rbx, 0xc
add ecx, 0xfffffff8
jmp 0x18000d926
add rbx, 4
cmp qword [r12 + 0x28], rbp
jne 0x18000d941
cmp ecx, 7
jbe 0x18000d952
mov rdx, qword [rbx]
mov qword [r12 + 0x28], rdx
add rbx, 8
add ecx, 0xfffffff8
mov edx, 0xffffffff
cmp qword [r12 + 0x40], rdx
jne 0x18000d8dd
cmp ecx, 7
ja 0x18000d966
xor eax, eax
test r14, r14
je 0x18000d8dd
mov dword [r14 + 0x1c], 9
jmp 0x18000d8dd
mov rcx, qword [rbx]
mov qword [r12 + 0x40], rcx
jmp 0x18000d8dd
Function at 0x1800126b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
ret

Function at 0x1800268e0
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov r12, rdx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x28], 5
mov rbx, qword [0x1801d4e10]
test rbx, rbx
jne 0x1800269aa
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebp, dword [rax + rcx + 0x88]
test rbp, rbp
je 0x18002691f
mov edx, dword [rax + rbp + 0x18]
lea rsi, [rax + 1]
jmp 0x18002694d
mov ecx, 0x812b7bc7
cmp ecx, 0x9ad235bd
je 0x180026988
sub rdx, 1
jb 0x18002691f
mov ecx, dword [rax + rbp + 0x20]
add rcx, rax
mov edi, dword [rcx + rdx*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x180026940
add rdi, rsi
mov ecx, 0x812b7bc7
nop dword [rax]
movsx ebx, bl
xor ebx, ecx
imul ecx, ebx, 0x1035edd
movzx ebx, byte [rdi]
add rdi, 1
test bl, bl
jne 0x180026970
jmp 0x180026945
mov ecx, dword [rax + rbp + 0x1c]
mov ebp, dword [rax + rbp + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov ebx, dword [rcx + rdx*4]
add rbx, rax
mov qword [0x1801d4e10], rbx
lea rcx, [rsp + 0x28]
call fcn.1800012e0
mov edi, dword [rax]
lea rcx, [rsp + 0x38]
call fcn.1800012e0
mov rcx, qword [rax]
mov edx, edi
call rbx
mov qword [rsp + 0x28], rax
test rax, rax
je 0x180026af8
lea r14, [rsp + 0x34]
lea r15, [rsp + 0x28]
jmp 0x180026a39
mov ecx, dword [rax + rbp + 0x1c]
mov ebp, dword [rax + rbp + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov edi, dword [rcx + rdx*4]
add rdi, rax
mov qword [0x1801d4e10], rdi
mov rcx, r14
call fcn.1800012e0
mov ebp, dword [rax]
mov rcx, r15
call fcn.1800012e0
mov rcx, qword [rax]
mov edx, ebp
call rdi
mov qword [rsp + 0x28], rax
test rax, rax
je 0x180026af8
mov rcx, rax
call r12
mov rcx, qword [rsp + 0x28]
mov rdx, r12
call fcn.1800268e0
mov eax, dword [0x1801d4e80]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
and byte [rax + 0xb9], 0xfd
mov dword [rsp + 0x34], 2
mov rdi, qword [0x1801d4e10]
test rdi, rdi
jne 0x180026a12
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebp, dword [rax + rcx + 0x88]
test rbp, rbp
je 0x180026a8b
mov edx, dword [rax + rbp + 0x18]
lea rdi, [rax + 1]
jmp 0x180026ac1
mov esi, 0x812b7bc7
cmp esi, 0x9ad235bd
je 0x1800269f0
sub rdx, 1
jb 0x180026a8b
mov ecx, dword [rax + rbp + 0x20]
add rcx, rax
mov ebx, dword [rcx + rdx*4]
mov cl, byte [rax + rbx]
test cl, cl
je 0x180026ab0
add rbx, rdi
mov esi, 0x812b7bc7
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1035edd
movzx ecx, byte [rbx]
add rbx, 1
test cl, cl
jne 0x180026ae0
jmp 0x180026ab5
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180038fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
add rcx, 2
mov edx, 0x811c9dc5
nop dword [rax]
mov eax, edx
movsx r8d, byte [rcx]
add rcx, 1
xor edx, r8d
imul edx, edx, 0x1000193
test r8d, r8d
jne 0x180038ff0
ret

Function at 0x18003f390
Capabilities:
Execute syscall

Disassembly:
mov r11, r9
mov r9d, dword [rsp + 0x28]
mov eax, dword [rcx]
mov r10, rdx
mov edx, r8d
mov r8, r11
sub rsp, 0x28
syscall
add rsp, 0x28
ret

Function at 0x18003f3c0
Capabilities:
Execute syscall

Disassembly:
push rsi
push rdi
push rbx
mov r11, r9
mov esi, dword [rsp + 0x50]
mov r9d, dword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x58]
mov eax, dword [rcx]
mov r10, rdx
mov edx, r8d
mov r8, r11
sub rsp, 0x40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbx
syscall
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x18003f410
Capabilities:
Execute syscall

Disassembly:
push rsi
push rdi
mov r11d, r9d
mov esi, dword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov eax, dword [rcx]
mov r10, rdx
mov rdx, r8
mov r8d, r11d
sub rsp, 0x40
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rdi
syscall
add rsp, 0x40
pop rdi
pop rsi
ret

Function at 0x1800419c0
Capabilities:
Execute syscall

Disassembly:
push rsi
push rdi
mov r11d, r9d
mov esi, dword [rsp + 0x48]
mov r9d, dword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov eax, dword [rcx]
mov r10, rdx
mov rdx, r8
mov r8d, r11d
sub rsp, 0x40
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
syscall
add rsp, 0x40
pop rdi
pop rsi
ret
Function at 0x180043c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
push rax
mov r15, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x78]
mov r10, qword [rsp + 0x70]
mov qword [r10], r8
mov qword [r15], rsi
mov rcx, qword [r10]
cmp rcx, r9
mov qword [rsp], r8
je 0x180043e9c
cmp rsi, qword [rsp + 0x80]
je 0x180043e9c
movzx ebp, word [rdx]
nop word cs:[rax + rax]
movzx r13d, word [rcx]
mov eax, r13d
and eax, 0xfc00
cmp bp, 2
jb 0x180043cf0
cmp eax, 0xdc00
jne 0x180043eb6
movzx eax, bp
shl eax, 0xa
add r13d, 0xffff2400
or r13d, eax
jmp 0x180043d30
cmp eax, 0xd800
jne 0x180043d30
shl r13d, 0xa
add r13d, 0xfca10000
mov r12b, 1
cmp r13d, 0x7f
jbe 0x180043d39
mov edi, r13d
cmp r13d, 0x7ff
ja 0x180043e60
shr edi, 6
or dil, 0xc0
mov eax, 1
jmp 0x180043d3e
xor r12d, r12d
cmp r13d, 0x7f
ja 0x180043d0b
xor eax, eax
mov edi, r13d
lea ebx, [rax + 1]
mov r14b, 1
mov r11, qword [rsp + 0x80]
sub r11, rsi
mov r8d, ebx
cmp r11, r8
jl 0x180043e9c
test bp, bp
jne 0x180043d93
lea ebp, [rbx + 3]
cmp r11, rbp
jl 0x180043e9c
lea rcx, [rsi + 1]
mov qword [r15], rcx
mov byte [rsi], 0xef
mov rcx, qword [r15]
lea rbp, [rcx + 1]
mov qword [r15], rbp
mov byte [rcx], 0xbb
mov rcx, qword [r15]
lea rbp, [rcx + 1]
mov qword [r15], rbp
mov byte [rcx], 0xbf
mov rcx, qword [r10]
add rcx, 2
mov qword [r10], rcx
or r14b, r12b
cmp r14b, 1
jne 0x180043db8
mov rcx, qword [r15]
lea rbp, [rcx + 1]
mov qword [r15], rbp
mov byte [rcx], dil
cmp ebx, 2
jl 0x180043e20
add ebx, 0xffffffff
add eax, eax
lea ecx, [rax + rax*2]
add cl, 0xfa
mov edi, r13d
shr edi, cl
and dil, 0x3f
or dil, 0x80
mov rcx, qword [r15]
lea rbp, [rcx + 1]
mov qword [r15], rbp
mov byte [rcx], dil
cmp ebx, 1
jle 0x180043e20
lea ecx, [rax + rax*2]
add cl, 0xf4
mov ebp, r13d
shr ebp, cl
and bpl, 0x3f
or bpl, 0x80
mov rcx, qword [r15]
lea rdi, [rcx + 1]
mov qword [r15], rdi
mov byte [rcx], bpl
cmp ebx, 2
je 0x180043e20
lea ecx, [rax + rax*2]
add cl, 0xee
mov eax, r13d
shr eax, cl
and al, 0x3f
or al, 0x80
mov rcx, qword [r15]
lea rbp, [rcx + 1]
mov qword [r15], rbp
mov byte [rcx], al
nop
shr r13d, 0xa
test r12b, r12b
mov eax, 1
cmove r13d, eax
mov word [rdx], r13w
mov rcx, qword [r10]
cmp rcx, r9
je 0x180043e9c
mov ebp, r13d
mov rsi, qword [r15]
cmp rsi, qword [rsp + 0x80]
jne 0x180043cc0
jmp 0x180043e9c
cmp r13d, 0xffff
ja 0x180043e7a
shr edi, 0xc
or dil, 0xe0
mov eax, 2
jmp 0x180043d3e
shr edi, 0x12
or dil, 0xf0
mov eax, r12d
xor al, 1
movzx eax, al
lea ebx, [rax + rax]
add ebx, 1
mov eax, 3
xor r14d, r14d
jmp 0x180043d44
xor eax, eax
cmp rcx, qword [rsp]
sete al
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 2
jmp 0x180043ea5

Function at 0x1800441a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, 0xffffffff
mov r9d, 0x6c078965
jmp 0x180044290
push rsi
sub rsp, 0x20
mov rsi, rcx
mov dword [rcx + 0x1384], r8d
mov r8d, r9d
call fcn.1800442b0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x180044530
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [rcx]
cmp eax, 0x270
jne 0x18004454b
mov rcx, rsi
call fcn.1800445a0
jmp 0x18004455a
cmp eax, 0x4e0
jb 0x18004455a
mov rcx, rsi
call fcn.180044630
mov eax, dword [rsi]
lea ecx, [rax + 1]
mov dword [rsi], ecx
mov eax, dword [rsi + rax*4 + 4]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [rsi + 0x1384]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
add rsp, 0x20
pop rsi
ret

Function at 0x1800445a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movd xmm0, dword [rcx + 4]
pshufd xmm3, xmm0, 0
mov rax, 0xfffffffffffffd90
movaps xmm0, xmmword [0x1800a6320]
movaps xmm1, xmmword [0x1800a6330]
movdqa xmm2, xmmword [0x1800a6340]
movups xmm4, xmmword [rcx + rax*4 + 0x9c8]
shufps xmm3, xmm4, 3
shufps xmm3, xmm4, 0x98
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrld xmm5, 1
movaps xmm3, xmm4
pslld xmm4, 0x1f
psrad xmm4, 0x1f
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*4 + 0xff8]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*4 + 0x1384], xmm6
add rax, 4
jne 0x1800445d0
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x180044630
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movd xmm0, dword [rcx + 0x9c4]
pshufd xmm3, xmm0, 0
xor eax, eax
movaps xmm0, xmmword [0x1800a6320]
movaps xmm1, xmmword [0x1800a6330]
movdqa xmm2, xmmword [0x1800a6340]
nop
movdqa xmm4, xmm3
movups xmm3, xmmword [rcx + rax*4 + 0x9c8]
shufps xmm4, xmm3, 3
shufps xmm4, xmm3, 0x98
andps xmm4, xmm0
movaps xmm5, xmm3
andps xmm5, xmm1
orps xmm5, xmm4
psrld xmm5, 1
movaps xmm4, xmm3
pslld xmm4, 0x1f
psrad xmm4, 0x1f
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*4 + 0xff8]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*4 + 4], xmm6
add rax, 4
cmp rax, 0xe0
jne 0x180044660
pshufd xmm3, xmm3, 0xff
movd r9d, xmm3
and r9d, 0x80000000
mov r10d, dword [rcx + 0xd48]
mov r8d, dword [rcx + 0xd4c]
mov eax, r10d
and eax, 0x7ffffffe
or eax, r9d
shr eax, 1
mov edx, r10d
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [rcx + 0x1378]
xor edx, eax
mov dword [rcx + 0x384], edx
and r10d, 0x80000000
mov eax, r8d
and eax, 0x7ffffffe
or eax, r10d
shr eax, 1
mov edx, r8d
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [rcx + 0x137c]
xor edx, eax
mov dword [rcx + 0x388], edx
and r8d, 0x80000000
mov eax, dword [rcx + 0xd50]
mov edx, eax
and edx, 0x7ffffffe
or edx, r8d
shr edx, 1
movd xmm3, eax
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [rcx + 0x1380]
xor eax, edx
mov dword [rcx + 0x38c], eax
pshufd xmm3, xmm3, 0
xor eax, eax
nop
movups xmm4, xmmword [rcx + rax*4 + 0xd54]
shufps xmm3, xmm4, 3
shufps xmm3, xmm4, 0x98
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrld xmm5, 1
movaps xmm3, xmm4
pslld xmm4, 0x1f
psrad xmm4, 0x1f
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*4 + 4]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*4 + 0x390], xmm6
add rax, 4
cmp rax, 0x18c
jne 0x180044770
mov r8d, 0x80000000
and r8d, dword [rcx + 0x1380]
mov edx, dword [rcx + 4]
mov eax, edx
and eax, 0x7ffffffe
or eax, r8d
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [rcx + 0x634]
shr eax, 1
xor edx, eax
mov dword [rcx + 0x9c0], edx
mov dword [rcx], 0
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret

Function at 0x180057afc
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rcx
lea r8, [rdx + rdx]
movabs rcx, 0xcbf29ce484222325
mov rdx, rax
jmp 0x1800028e0
test r8, r8
je 0x180002905
movabs r9, 0x100000001b3
lea rax, [r8 - 1]
mov r10d, r8d
and r10d, 3
cmp rax, 3
jae 0x180002909
xor r11d, r11d
jmp 0x18000294c
mov rax, rcx
ret
and r8, 0xfffffffffffffffc
xor r11d, r11d
movzx eax, byte [rdx + r11]
xor rax, rcx
imul rax, r9
movzx ecx, byte [rdx + r11 + 1]
xor rcx, rax
imul rcx, r9
movzx eax, byte [rdx + r11 + 2]
xor rax, rcx
imul rax, r9
movzx ecx, byte [rdx + r11 + 3]
xor rcx, rax
imul rcx, r9
add r11, 4
cmp r8, r11
jne 0x180002910
mov rax, rcx
test r10, r10
je 0x180002978
add rdx, r11
xor r8d, r8d
nop word [rax + rax]
movzx eax, byte [rdx + r8]
xor rax, rcx
imul rax, r9
add r8, 1
mov rcx, rax
cmp r10, r8
jne 0x180002960
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1800028b0
Function at 0x180062b68
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x180068768
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x18006879a
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x18006877d
mov rax, r8
ret

Function at 0x18006a35c
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x1800028e0
sub r8, rdx
mov rcx, rdx
mov rdx, r8
jmp 0x1800081a0

Function at 0x18007cb0c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x18007cc10
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18007cc7f
xor ecx, ecx
call qword [0x1800b87d0]
test rax, rax
je 0x18007cc7f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18007cc7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18007cc7f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18007cc7f
cmp dword [rcx + 0x84], 0xe
jbe 0x18007cc7f
cmp dword [rcx + 0xf8], 0
je 0x18007cc7f
mov ecx, ebx
call fcn.18007cb3c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18007cda4
nop
cmp dword [rbp + 0x20], 0
je 0x18007cccd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18007cbdc
int3

Function at 0x180085750
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x18008576d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1800857c8
test al, 7
jne 0x180085760
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x180085781
mov rdx, qword [rax - 8]
test dl, dl
je 0x1800857f2
test dh, dh
je 0x1800857ec
shr rdx, 0x10
test dl, dl
je 0x1800857e6
test dh, dh
je 0x1800857e0
shr rdx, 0x10
test dl, dl
je 0x1800857da
test dh, dh
je 0x1800857d4
shr edx, 0x10
test dl, dl
je 0x1800857ce
test dh, dh
jne 0x180085781
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x180089970
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180089998
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180089998
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret