joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a1d90
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x1800a1db4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x1800a1e42
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800a1e10
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x1800a1e10
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.180210c20
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1800a1e2d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x1800a1e35
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x1800a1dd1
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x1800a1f20
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x1800a1e59
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800a1e5b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800a1e8d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.180210c20
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1800a1f1d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800a1ec8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x1800a1efe
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1801e6530
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x1800a1f1d
cmp rsi, rax
ja 0x1800a1ed1
test rsi, rsi
je 0x1800a1f1d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1801e6530
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret

Function at 0x1800b8e10
Capabilities:
Hash data using sha1

Disassembly:
mov rcx, qword [rcx + 0xc8]
jmp 0x1801b10f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x1802f8230], 0
mov rbx, rdx
mov rdi, rcx
jne 0x1801b110e
call fcn.1801c7180
cmp byte [0x1802f823a], 0
mov rdx, rbx
mov rcx, rdi
je 0x1801b1135
xor r9d, r9d
mov r8d, 0x40
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1801c7510
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1801add30
Function at 0x1800d6e30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx r15d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
movzx eax, byte [r8 + 1]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 2]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 3]
xor r15, rax
imul r15, rcx
mov rcx, qword [0x1802fa630]
and rcx, r15
add rcx, rcx
mov rax, qword [0x1802fa618]
mov rbx, qword [rax + rcx*8 + 8]
mov r14, qword [0x1802fa608]
cmp rbx, r14
jne 0x1800d6eba
mov rbx, r14
mov rbp, r14
jmp 0x1800d6ef9
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x1800d6ed4
cmp rbx, rcx
je 0x1800d6ef3
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1800d6ec6
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0x492492492492492
cmp qword [0x1802fa610], rax
je 0x1800d7086
lea rax, [0x1802fa608]
mov qword [rsp + 0x20], rax
xor r13d, r13d
mov qword [rsp + 0x28], r13
mov ecx, gethostname
call fcn.1801cf0a8
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r12]
mov dword [rdi + 0x10], eax
xorps xmm0, xmm0
movups xmmword [rdi + 0x18], xmm0
mov qword [rdi + 0x28], r13
mov qword [rdi + 0x30], reloc.WS2_32.dll_ntohs
mov byte [rdi + 0x18], r13b
mov rdx, qword [0x1802fa610]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1800d6f6e
cvtsi2ss xmm0, rcx
jmp 0x1800d6f83
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x1802fa638]
xorps xmm1, xmm1
test rcx, rcx
js 0x1800d6f99
cvtsi2ss xmm1, rcx
jmp 0x1800d6fae
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x1802fa600]
jbe 0x1800d7019
call fcn.1800d7810
mov rcx, qword [0x1802fa630]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x1802fa618]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x1802fa608]
cmp rax, rbx
je 0x1800d7005
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x1800d7002
mov rbx, rax
cmp rax, rdx
je 0x1800d705c
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1800d6ff1
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov rdx, qword [0x1802fa610]
mov r8, qword [rbx + 8]
inc rdx
mov qword [0x1802fa610], rdx
mov qword [rdi], r14
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x1802fa618]
mov rax, qword [0x1802fa630]
and rax, r15
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x1802fa608]
jne 0x1800d7063
mov qword [rcx + rax*8], rdi
jmp 0x1800d7075
mov qword [rsp + 0x20], rax
jmp 0x1800d700a
cmp rdx, rbp
jne 0x1800d706e
mov qword [rcx + rax*8], rdi
jmp 0x1800d707a
cmp qword [rcx + rax*8 + 8], r8
jne 0x1800d707a
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x1800d6edb
lea rcx, str.unordered_map_set_too_long
call fcn.1801cc6e8
int3
Function at 0x1800d7810
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1802fa610]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x1802fa638]
js 0x1800d7834
cvtsi2ss xmm0, rcx
jmp 0x1800d7849
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x1802fa600]
call fcn.18020c5d0
movss xmm1, dword [0x1802ba65c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800d787b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800d787b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800d78ad
cmp rbx, 0x200
jae 0x1800d78aa
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800d78ad
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800d7930
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800d7ade
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1802fa608]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1802fa618]
lea rdx, [rdi + rdi]
call fcn.18007ad70
mov rax, qword [0x1802fa608]
lea r9, [rdi - 1]
mov qword [0x1802fa630], r9
mov qword [0x1802fa638], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800d7ad3
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1802fa618]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800d7a1f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800d7a94
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800d7a5c
mov r10, qword [rdx]
cmp r10, rax
je 0x1800d7a56
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800d7a94
cmp r9, rdx
je 0x1800d7a70
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800d7aa8
cmp r9, rdx
jne 0x1800d7a61
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800d7ace
mov r9, qword [0x1802fa630]
jmp 0x1800d79d0
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800d7a94
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1801cc6e8
int3
Function at 0x1800d7930
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1802fa610]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x1802fa638]
js 0x1800d7834
cvtsi2ss xmm0, rcx
jmp 0x1800d7849
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x1802fa600]
call fcn.18020c5d0
movss xmm1, dword [0x1802ba65c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800d787b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800d787b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800d78ad
cmp rbx, 0x200
jae 0x1800d78aa
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800d78ad
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800d7930
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800d7ade
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1802fa608]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1802fa618]
lea rdx, [rdi + rdi]
call fcn.18007ad70
mov rax, qword [0x1802fa608]
lea r9, [rdi - 1]
mov qword [0x1802fa630], r9
mov qword [0x1802fa638], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800d7ad3
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1802fa618]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800d7a1f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800d7a94
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800d7a5c
mov r10, qword [rdx]
cmp r10, rax
je 0x1800d7a56
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800d7a94
cmp r9, rdx
je 0x1800d7a70
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800d7aa8
cmp r9, rdx
jne 0x1800d7a61
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800d7ace
mov r9, qword [0x1802fa630]
jmp 0x1800d79d0
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800d7a94
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1801cc6e8
int3
Function at 0x1800d7bb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx r15d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
movzx eax, byte [r8 + 1]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 2]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 3]
xor r15, rax
imul r15, rcx
mov rcx, qword [0x1802fa630]
and rcx, r15
add rcx, rcx
mov rax, qword [0x1802fa618]
mov rbx, qword [rax + rcx*8 + 8]
mov r14, qword [0x1802fa608]
cmp rbx, r14
jne 0x1800d7c3c
mov rbx, r14
mov rbp, r14
jmp 0x1800d7c7d
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x1800d7c56
cmp rbx, rcx
je 0x1800d7c77
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1800d7c48
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0x492492492492492
cmp qword [0x1802fa610], rax
je 0x1800d7e1e
lea rax, [0x1802fa608]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov ecx, gethostname
call fcn.1801cf0a8
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r12]
mov dword [rdi + 0x10], eax
lea rcx, [rdi + 0x18]
lea rdx, [r12 + 8]
call fcn.18000c440
nop
mov rdx, qword [0x1802fa610]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1800d7ceb
cvtsi2ss xmm0, rcx
jmp 0x1800d7d00
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x1802fa638]
xorps xmm1, xmm1
test rcx, rcx
js 0x1800d7d16
cvtsi2ss xmm1, rcx
jmp 0x1800d7d2b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x1802fa600]
jbe 0x1800d7da8
call fcn.1800d7810
mov rcx, qword [0x1802fa630]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x1802fa618]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x1802fa608]
cmp rax, rbx
jne 0x1800d7d6d
mov qword [rsp + 0x28], 0
jmp 0x1800d7d94
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x1800d7d91
nop dword [rax]
mov rbx, rax
cmp rax, rdx
je 0x1800d7deb
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1800d7d80
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov rdx, qword [0x1802fa610]
mov r8, qword [rbx + 8]
inc rdx
mov qword [0x1802fa610], rdx
mov qword [rdi], r14
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x1802fa618]
mov rax, qword [0x1802fa630]
and rax, r15
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x1802fa608]
jne 0x1800d7dfb
mov qword [rcx + rax*8], rdi
jmp 0x1800d7e0d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x1800d7d99
cmp rdx, rbp
jne 0x1800d7e06
mov qword [rcx + rax*8], rdi
jmp 0x1800d7e12
cmp qword [rcx + rax*8 + 8], r8
jne 0x1800d7e12
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x1800d7c5d
lea rcx, str.unordered_map_set_too_long
call fcn.1801cc6e8
int3
Function at 0x1800dd560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1802edb40]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x68], rcx
mov rbp, qword [rdx + 8]
mov rcx, rbp
call fcn.1801434b0
mov r15, rax
xorps xmm0, xmm0
lea rdi, [rax + 8]
movdqu xmmword [rsp + 0x50], xmm0
xor edx, edx
mov qword [rsp + 0x60], rdx
test rdi, rdi
je 0x1800dd62a
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x1800dd791
cmp rdi, 0x1000
jb 0x1800dd5fd
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x1800dd797
call fcn.1801cf0a8
mov rcx, rax
test rax, rax
je 0x1800dd78b
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1800dd605
mov rcx, rdi
call fcn.1801cf0a8
mov qword [rsp + 0x50], rax
lea rbx, [rax + rdi]
mov qword [rsp + 0x60], rbx
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.1802112c0
mov qword [rsp + 0x58], rbx
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
sub rdx, rcx
lea r8, str.RSB1
call fcn.1801f037c
mov r8, qword [rsp + 0x60]
mov rax, qword [rsp + 0x50]
sub r8, rax
lea rcx, [rax + 4]
test rcx, rcx
jne 0x1800dd661
call fcn.1801ec6bc
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x1800dd67e
cmp r8, 8
jb 0x1800dd66c
mov qword [rcx], rbp
jmp 0x1800dd683
xor edx, edx
call fcn.1802112c0
call fcn.1801ec6bc
mov dword [rax], Ordinal_35
call fcn.1801dde58
call fcn.180145f80
mov rcx, qword [rsp + 0x50]
add rcx, 8
mov dword [rsp + 0x20], eax
mov r9, rbp
mov r8, qword [r14]
mov rdx, r15
call fcn.180142b40
mov rbx, rax
mov rcx, rax
call fcn.180140160
test eax, eax
jne 0x1800dd79d
add rbx, 8
mov r8d, Ordinal_46
mov rdx, rbx
mov rcx, qword [rsp + 0x50]
call fcn.18013f9a0
mov dword [rsp + 0x68], eax
xor r9d, r9d
test rbx, rbx
je 0x1800dd705
xor r8d, r8d
nop dword [rax]
mov rdx, qword [rsp + 0x50]
add rdx, r8
and r8d, 3
movsx eax, r9b
imul ecx, eax, 0x29
add cl, byte [rsp + r8 + 0x68]
xor byte [rdx], cl
inc r9d
mov r8d, r9d
cmp r8, rbx
jb 0x1800dd6e0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0
mov r8, rbx
mov rdx, qword [rsp + 0x50]
mov rcx, rsi
call fcn.18000d1f0
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800dd764
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800dd75f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800dd78b
call fcn.1801cf0a0
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1801cf080
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1801dde78
int3
call fcn.180014140
int3
call fcn.18000a7c0
nop
lea rdx, str.Failed_to_compress_the_bytecode.
lea rcx, [rsp + 0x38]
call fcn.18000f770
lea rdx, [0x1802eaa98]
lea rcx, [rsp + 0x38]
call fcn.1801d17a0
int3
Function at 0x1800dd7c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1800dd821
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800dd7e0
mov ecx, dword [r9]
jmp 0x1800dd90b
cmp ecx, 0x4e0
jb 0x1800dd90b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1800dd840
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1800dd890
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800e0080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1802edb40]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, r8
mov rdi, rdx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], r8
xor r15d, r15d
mov qword [rbp - 0x48], r15
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1800e00c6
mov rdx, qword [r8]
lea r8, [0x180245db4]
lea rcx, [rbp - 0x48]
call fcn.1801e6278
test eax, eax
jne 0x1800e0203
mov rbx, qword [rbp - 0x48]
test rbx, rbx
je 0x1800e0203
mov qword [rbp - 0x18], rbx
xor edx, edx
mov r8d, 2
mov rcx, rbx
call fcn.1801e568c
test eax, eax
js 0x1800e0125
mov rcx, qword [rbp - 0x48]
call fcn.1801e4b50
movsxd rsi, eax
test eax, eax
js 0x1800e0125
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x48]
call fcn.1801e568c
test eax, eax
jns 0x1800e015c
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
xor r8d, r8d
lea rdx, [0x180244c70]
mov rcx, rdi
call fcn.18000d1f0
nop
test rbx, rbx
je 0x1800e0224
mov rcx, rbx
call fcn.1801e52ec
jmp 0x1800e0224
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
test rsi, rsi
jne 0x1800e0183
mov qword [rbp - 0x28], rsi
mov byte [rbp + rsi - 0x38], sil
jmp 0x1800e01b7
lea rcx, [rbp - 0x38]
cmp rsi, 0xf
ja 0x1800e01a2
mov qword [rbp - 0x28], rsi
mov r8, rsi
xor edx, edx
call fcn.1802112c0
mov byte [rbp + rsi - 0x38], 0
jmp 0x1800e01b7
mov byte [rsp + 0x20], 0
mov r9, rsi
movzx r8d, byte [rbp - 0x50]
mov rdx, rsi
call fcn.1800133b0
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rcx, qword [rbp - 0x38]
mov r9, qword [rbp - 0x48]
mov r8, rsi
mov edx, 1
call fcn.1801e6530
movups xmm0, xmmword [rbp - 0x38]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x28]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
lea rcx, [rbp - 0x38]
call fcn.18000c8e0
jmp 0x1800e0146
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], r15
xor r8d, r8d
lea rdx, [0x180244c70]
mov rcx, rdi
call fcn.18000d1f0
nop
mov rcx, r14
call fcn.18000c8e0
mov rax, rdi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1801cf080
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret