joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001eac0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx]
movzx eax, byte [rax]
cmp eax, 1
je 0x180004c31
cmp eax, 2
jne 0x180004c3e
mov rdx, qword [rsi + 0x20]
cmp rdx, qword [rsi + 0x28]
je 0x180004c2b
lea rcx, [rsi + 0x30]
call fcn.18001ea63
mov rax, qword [rsi + 0x20]
mov qword [rsi + 0x28], rax
add rsi, 0x30
jmp 0x180004c42
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x18001eac0
add rsi, 0x50
mov rax, rsi
add rsp, 0x20
pop rsi
ret
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [rcx]
cmp byte [rax], 1
jne 0x18001eaf3
mov rax, qword [rcx + 8]
add rax, 0x20
add rsp, 0x88
pop rsi
pop rbp
ret
cmp byte [0x1800aa296], 0
jne 0x18001eb5c
mov rax, qword [0x1800a4c60]
movabs r8, 0x7f29fa00af1d5ba9
add r8, rax
movabs r9, 0x7f29fa00af1d5b8b
add r9, rax
xor ecx, ecx
movabs r10, 0x8888888888888889
lea r11, [0x1800aa26c]
mov rax, rcx
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
add rax, r9
mov al, byte [rcx + rax]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x2a
jne 0x18001eb30
mov byte [0x1800aa296], 1
lea rdx, [0x1800aa26c]
lea rsi, [rbp - 0x20]
mov rcx, rsi
call fcn.18000243e
lea rcx, [rbp - 0x58]
mov edx, 0xcf
mov r8, rsi
call fcn.180018810
movabs rdx, 0x7f29fa00af1d2af9
add rdx, qword [0x1800a4c70]
lea rcx, [rbp - 0x58]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x18001ed7c
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
movzx eax, byte [rcx]
add eax, 0xfffffffc
cmp eax, 3
ja case.default.0x18001edae
lea r8, [0x180087e9c]
movsxd rax, dword [r8 + rax*4]
add rax, r8
jmp rax
mov eax, dword [rcx + 8]
jmp 0x18001edc0
movzx eax, byte [rcx + 8]
jmp 0x18001edc0
cvttsd2si eax, qword [rcx + 8]
mov dword [rdx], eax
add rsp, 0xa8
pop rsi
pop rbp
ret
call fcn.180009128
lea rcx, [rbp - 0x20]
mov rdx, rax
call fcn.18000243e
cmp byte [0x1800aa268], 0
jne 0x18001ee2c
mov rdx, qword [0x1800a4c90]
movabs rax, 0xe5bde8b8aece4d8e
add rax, rdx
movabs rcx, 0xe5bde8b8aece4dab
add rcx, rdx
xor edx, edx
lea r8, [0x1800aa24b]
mov r9b, byte [rax + rdx]
xor r9b, byte [rcx + rdx]
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 0x1d
jne 0x18001ee10
mov byte [0x1800aa268], 1
movabs rsi, 0xe5bde8b8aece1d8e
mov rdx, qword [0x1800a4c98]
add rdx, rsi
mov rcx, rbp
lea r8, [rbp - 0x20]
call fcn.1800090d4
lea rcx, [rbp - 0x58]
mov r8, rbp
mov edx, 0x12e
call fcn.180008d68
add rsi, qword [0x1800a4ca0]
lea rcx, [rbp - 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x18001f390
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [0x1800a9f69], 0
jne 0x18001f3e7
xor r8d, r8d
movabs r9, 0xf0f0f0f0f0f0f0f1
lea r10, [0x1800a9f53]
nop dword [rax]
mov rax, r8
mul r9
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
lea rax, [rcx + r8]
sub rax, rdx
movzx eax, byte [rax]
xor al, byte [rcx + r8 + 0x11]
mov byte [r8 + r10], al
inc r8
cmp r8, 0x16
jne 0x18001f3b0
mov byte [0x1800a9f69], 1
ret
Function at 0x180020a94
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, r9d
mov rsi, r8
test r8, r8
je 0x180020ab2
mov qword [rsi], 0
call fcn.180020884
test rax, rax
je 0x180020baa
mov rbx, rax
mov rcx, rax
call fcn.180020a2b
cmp rax, 0xffffffffffffffff
je 0x180020b5d
mov r14, rax
movsxd r15, ebp
lea rcx, [rax + r15]
mov rdx, qword [0x1800a54d0]
movabs rax, 0xd2e16e41d0081289
mov rdx, qword [rdx + rax]
test rdx, rdx
je 0x180020aff
inc dword [rdx + 0x3b0]
mov r8, qword [0x1800a54d8]
mov rdx, qword [0x1800a54e0]
mov rdx, qword [rdx + rax]
call qword [r8 + rax]
test rax, rax
je 0x180020b5d
mov rdi, rax
mov edx, 1
mov rcx, rax
mov r8, r14
mov r9, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, r14
jne 0x180020b68
test ebp, ebp
jle 0x180020b4a
mov rcx, rdi
add rcx, r14
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x180020bac
mov qword [rsi], r14
jmp 0x180020bac
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x180020baa
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [0x1800a54f0]
movabs rax, 0xcc317ee44ea41665
mov rcx, qword [rcx + rax]
test rcx, rcx
je 0x180020b91
dec dword [rcx + 0x3b0]
mov r8, qword [0x1800a54f8]
mov rcx, qword [0x1800a5500]
mov rdx, qword [rcx + rax]
mov rcx, rdi
call qword [r8 + rax]
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x18002417a
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x1800a8ea8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x24], edx
mov rax, qword [rcx + 0xd0]
movsxd rcx, dword [rcx + 0xc8]
mov esi, dword [rax + rcx*4 - 4]
movabs rax, 0xe49374459fa026d3
add rax, qword [0x1800a5508]
not esi
xor ecx, ecx
movzx edx, sil
shr esi, 8
movzx r8d, byte [rsp + rcx + 0x24]
xor r8d, edx
xor esi, dword [rax + r8*4]
inc rcx
cmp rcx, 4
jne 0x1800241b9
not esi
mov rax, qword [0x1800a57e0]
movabs rcx, 0xcac4fe1f5c3bd7f2
mov rax, qword [rax + rcx]
cmp dword [rax + 0x1c50], esi
jne 0x1800241fb
mov dword [rax + 0x1c54], esi
cmp dword [rax + 0x1c90], esi
jne 0x18002420a
mov byte [rax + 0x1c94], 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180080ac0
mov eax, esi
add rsp, 0x30
pop rsi
ret

Function at 0x18002424c
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x30
mov rax, qword [0x1800a8ea8]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov rax, qword [rcx + 0xd0]
movsxd rcx, dword [rcx + 0xc8]
mov esi, dword [rax + rcx*4 - 4]
movabs rax, 0xe49374459fa026d3
add rax, qword [0x1800a5508]
not esi
xor ecx, ecx
movzx edx, sil
shr esi, 8
movzx r8d, byte [rsp + rcx + 0x20]
xor r8d, edx
xor esi, dword [rax + r8*4]
inc rcx
cmp rcx, 8
jne 0x18002428c
not esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180080ac0
mov eax, esi
add rsp, 0x30
pop rsi
ret
Function at 0x18002f987
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1800a8ea8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [0x1800a5ae0]
movabs rcx, 0x264f80d8ad3df180
mov rax, qword [rax + rcx]
mov dword [rax + 0x3094], 0
test rsi, rsi
je 0x18002fa88
lea rcx, [rsp + 0x28]
mov qword [rcx], 0
call fcn.18003698d
mov rdi, rax
cmp byte [0x1800abcbb], 0
jne 0x18002fa52
mov rax, qword [0x1800a5ae8]
movabs rcx, 0x264f80d8ad3e0808
mov cl, byte [rax + rcx]
movabs rdx, 0x264f80d8ad3e0825
xor cl, byte [rax + rdx]
mov byte [0x1800abcb8], cl
movabs rcx, 0x264f80d8ad3e0809
mov cl, byte [rax + rcx]
movabs rdx, 0x264f80d8ad3e0826
xor cl, byte [rax + rdx]
mov byte [0x1800abcb9], cl
movabs rcx, 0x264f80d8ad3e080a
mov cl, byte [rax + rcx]
movabs rdx, 0x264f80d8ad3e0827
xor cl, byte [rax + rdx]
mov byte [0x1800abcba], cl
mov byte [0x1800abcbb], 1
lea rdx, [0x1800abcb8]
mov rcx, rsi
call fcn.180020884
test rax, rax
je 0x18002fa88
mov rsi, rax
mov r8, qword [rsp + 0x28]
mov edx, 1
mov rcx, rdi
mov r9, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180080ac0
nop
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1800360e4
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, r8
mov rbx, rdx
lea r14, [rcx + 0x3100]
cmp qword [rcx + 0x30f8], 0
je 0x180036227
mov rsi, rcx
cmp dword [rcx + 0x3104], 0
jns 0x1800361c4
mov rcx, qword [0x1800a54d0]
movabs rax, 0xd2e16e41d0081289
mov rcx, qword [rcx + rax]
test rcx, rcx
je 0x18003613b
inc dword [rcx + 0x3b0]
mov r8, qword [0x1800a54d8]
mov rcx, qword [0x1800a54e0]
mov rdx, qword [rcx + rax]
xor ecx, ecx
call qword [r8 + rax]
mov r15, rax
mov rdx, qword [rsi + 0x3108]
test rdx, rdx
je 0x1800361b3
movsxd r8, dword [rsi + 0x3100]
mov rcx, r15
call fcn.1800820e0
mov rcx, qword [rsi + 0x3108]
movabs rax, 0xcc317ee44ea41665
test rcx, rcx
je 0x18003619d
mov rdx, qword [0x1800a54f0]
mov rdx, qword [rdx + rax]
test rdx, rdx
je 0x18003619d
dec dword [rdx + 0x3b0]
mov r8, qword [0x1800a54f8]
mov rdx, qword [0x1800a5500]
mov rdx, qword [rdx + rax]
call qword [r8 + rax]
mov qword [rsi + 0x3108], r15
mov dword [rsi + 0x3104], 0
xor ebp, ebp
mov dword [rsi + 0x3100], ebp
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.18002199c
mov r9, qword [rsi + 0x30f8]
mov eax, dword [rsi + 0x3100]
sub eax, 1
cmovb eax, ebp
movsxd r8, eax
movabs rcx, 0x45a463c4afe67d66
add rcx, qword [0x1800a6330]
mov rax, qword [rsi + 0x3108]
test rax, rax
cmovne rcx, rax
mov edx, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.18002199c
Function at 0x18003c464
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov rsi, rcx
mov rax, qword [0x1800a8ea8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rdi, [rsp + 0x28]
mov r8d, 0x88
mov rcx, rdi
test rdx, rdx
je 0x18003c4a9
call fcn.1800820e0
movss xmm2, dword [rdi + 0x14]
xorps xmm0, xmm0
ucomiss xmm0, xmm2
jae 0x18003c4da
jmp 0x18003c4ea
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov al, 1
mov byte [rdi + 0xc], al
mov dword [rdi + 0x44], 0x7f7fffff
mov dword [rdi + 0x50], 0x3f800000
mov word [rdi + 0x54], 0xffff
movabs rcx, 0x100000001
mov qword [rdi + 0x18], rcx
mov byte [rdi + 0x20], al
mov dword [rsp + 0x3c], 0x41500000
movss xmm2, dword [0x180091250]
cmp byte [rsp + 0x7e], 0
jne 0x18003c569
lea rcx, [rsp + 0x7e]
cvttss2si r9d, xmm2
cmp byte [0x1800b143e], 0
jne 0x18003c552
mov r8, qword [0x1800a6450]
movabs rax, 0xea4795509b3ce2ca
add rax, r8
movabs rdx, 0xea4795509b3ce2da
add rdx, r8
xor r8d, r8d
lea r10, [0x1800b1428]
mov r11d, r8d
and r11d, 0xf
mov r11b, byte [rax + r11]
xor r11b, byte [rdx + r8]
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x16
jne 0x18003c52f
mov byte [0x1800b143e], 1
lea r8, [0x1800b1428]
mov edx, 0x28
call fcn.1800206d8
movss xmm2, dword [rsp + 0x3c]
mov word [rsp + 0x7c], 0x85
movaps xmm0, xmm2
divss xmm0, dword [0x180091250]
cvttps2dq xmm0, xmm0
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x58], xmm0
cmp byte [0x1800b4eed], 0
jne 0x18003c600
mov rax, qword [0x1800a6460]
movabs r8, 0x9b5d09ba50c867bc
add r8, rax
movabs r9, 0x9b5d09ba50c8679f
add r9, rax
xor ecx, ecx
movabs r10, 0x1a7b9611a7b9611b
lea r11, [0x1800b2020]
mov rax, rcx
mul r10
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe3
add rax, r9
mov al, byte [rcx + rax]
xor al, byte [r8 + rcx]
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x2ecd
jne 0x18003c5c5
mov byte [0x1800b4eed], 1
movabs rdx, 0x9b5d09ba50c8587a
add rdx, qword [0x1800a6468]
lea r9, [rsp + 0x28]
movabs rax, 0xe13fe867ccf6bc5e
add rax, qword [0x1800a6470]
mov rcx, qword [r9 + 0x38]
test rcx, rcx
cmovne rax, rcx
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.18003c660
mov rsi, rax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180080ac0
mov rax, rsi
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x18003c660
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
movaps xmm6, xmm2
mov rbx, rdx
mov rdi, rcx
mov r15, qword [rsp + 0x90]
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, 4
cdqe
imul rax, rax, 0x66666667
mov rcx, rax
shr rcx, 0x3f
shr rax, 0x21
add eax, ecx
shl eax, 2
movsxd rcx, eax
call fcn.1800204e6
mov r14, rax
mov cl, byte [rbx]
test cl, cl
je 0x18003c75c
add rbx, 5
mov rax, r14
movsx edx, cl
xor ecx, ecx
cmp dl, 0x5c
setge cl
xor ecx, 0xffffffdd
add ecx, edx
movsx r8d, byte [rbx - 4]
xor edx, edx
cmp r8d, 0x5c
setge dl
xor edx, 0xffffffdd
add edx, r8d
movsx r9d, byte [rbx - 3]
xor r8d, r8d
cmp r9d, 0x5c
setge r8b
xor r8d, 0xffffffdd
add r8d, r9d
movsx r9d, byte [rbx - 2]
xor r10d, r10d
cmp r9d, 0x5c
setge r10b
xor r10d, 0xffffffdd
add r10d, r9d
movsx r9d, byte [rbx - 1]
xor r11d, r11d
cmp r9d, 0x5c
setge r11b
xor r11d, 0xffffffdd
add r11d, r9d
imul r9d, r11d, 0x55
add r9d, r10d
imul r9d, r9d, 0x55
add r9d, r8d
imul r8d, r9d, 0x55
add r8d, edx
imul edx, r8d, 0x55
add edx, ecx
mov dword [rax], edx
add rax, 4
mov cl, byte [rbx]
add rbx, 5
test cl, cl
jne 0x18003c6c4
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, r14
movaps xmm3, xmm6
call fcn.18003cb30
mov rsi, rax
mov rcx, r14
call fcn.1800205fd
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800640c6
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
cmp edi, 1
jne 0x180064207
mov rcx, rsi
call fcn.180063d3c
cmp byte [0x1800b5a8e], 0
jne 0x1800641c5
mov rax, qword [0x1800a7ae8]
movabs rcx, 0x326fa4516c5e9bd5
mov cl, byte [rax + rcx]
movabs rdx, 0x326fa4516c5e9bf1
xor cl, byte [rax + rdx]
mov byte [0x1800b5a88], cl
movabs rcx, 0x326fa4516c5e9bd6
mov cl, byte [rax + rcx]
movabs rdx, 0x326fa4516c5e9bf2
xor cl, byte [rax + rdx]
mov byte [0x1800b5a89], cl
movabs rcx, 0x326fa4516c5e9bd7
mov cl, byte [rax + rcx]
movabs rdx, 0x326fa4516c5e9bf3
xor cl, byte [rax + rdx]
mov byte [0x1800b5a8a], cl
movabs rcx, 0x326fa4516c5e9bd8
mov cl, byte [rax + rcx]
movabs rdx, 0x326fa4516c5e9bf4
xor cl, byte [rax + rdx]
mov byte [0x1800b5a8b], cl
movabs rcx, 0x326fa4516c5e9bd9
mov cl, byte [rax + rcx]
movabs rdx, 0x326fa4516c5e9bf5
xor cl, byte [rax + rdx]
mov byte [0x1800b5a8c], cl
movabs rcx, 0x326fa4516c5e9bda
mov cl, byte [rax + rcx]
movabs rdx, 0x326fa4516c5e9bf6
xor cl, byte [rax + rdx]
mov byte [0x1800b5a8d], cl
mov byte [0x1800b5a8e], 1
lea rdx, [0x1800b5a88]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x18006420e]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x180074c9a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov eax, dword [rcx]
cmp eax, 0x270
jne 0x180074cb5
mov rcx, rsi
call fcn.180074d02
jmp 0x180074cc4
cmp eax, 0x4e0
jb 0x180074cc4
mov rcx, rsi
call fcn.180074d8e
mov eax, dword [rsi]
lea ecx, [rax + 1]
mov dword [rsi], ecx
mov eax, dword [rsi + rax*4 + 4]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [rsi + 0x1384]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
add rsp, 0x20
pop rsi
ret

Function at 0x180074d02
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movd xmm0, dword [rcx + 4]
pshufd xmm3, xmm0, 0
mov rax, 0xfffffffffffffd90
movaps xmm0, xmmword [0x18008a140]
movaps xmm1, xmmword [0x180097020]
movdqa xmm2, xmmword [0x180097030]
movups xmm4, xmmword [rcx + rax*4 + 0x9c8]
shufps xmm3, xmm4, 3
shufps xmm3, xmm4, 0x98
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrld xmm5, 1
movaps xmm3, xmm4
pslld xmm4, 0x1f
psrad xmm4, 0x1f
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*4 + 0xff8]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*4 + 0x1384], xmm6
add rax, 4
jne 0x180074d32
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret

Function at 0x180074d8e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
mov edx, dword [rcx + 0x9c4]
mov eax, 0x3fe
and edx, 0x80000000
mov r8d, dword [rcx + rax*4 - 0x630]
mov r9d, r8d
and r9d, 0x7ffffffe
or r9d, edx
shr r9d, 1
mov edx, r8d
and r8d, 1
neg r8d
and r8d, 0x9908b0df
xor r8d, dword [rcx + rax*4]
xor r8d, r9d
mov dword [rcx + rax*4 - 0xff4], r8d
inc rax
cmp rax, 0x4e1
jne 0x180074da2
movd xmm0, dword [rcx + 0xd50]
pshufd xmm3, xmm0, 0
xor eax, eax
movaps xmm0, xmmword [0x18008a140]
movaps xmm1, xmmword [0x180097020]
movdqa xmm2, xmmword [0x180097030]
movups xmm4, xmmword [rcx + rax*4 + 0xd54]
shufps xmm3, xmm4, 3
shufps xmm3, xmm4, 0x98
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrld xmm5, 1
movaps xmm3, xmm4
pslld xmm4, 0x1f
psrad xmm4, 0x1f
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*4 + 4]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*4 + 0x390], xmm6
add rax, 4
cmp rax, 0x18c
jne 0x180074e10
mov eax, 0x80000000
and eax, dword [rcx + 0x1380]
mov edx, dword [rcx + 4]
mov r8d, edx
and r8d, 0x7ffffffe
or r8d, eax
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [rcx + 0x634]
shr r8d, 1
xor edx, r8d
mov dword [rcx + 0x9c0], edx
mov dword [rcx], 0
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret

Function at 0x180074f30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x1800b6902], 0
jne 0x180074f7f
xor r8d, r8d
movabs r9, 0x2e8ba2e8ba2e8ba3
lea r10, [0x1800b68e9]
nop dword [rax]
mov rax, r8
mul r9
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
lea rdx, [rcx + r8]
movzx eax, byte [rax + rdx]
xor al, byte [rcx + r8 + 0x16]
mov byte [r8 + r10], al
inc r8
cmp r8, 0x19
jne 0x180074f50
mov byte [0x1800b6902], 1
ret
Function at 0x180074f80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, rcx
mov rcx, qword [0x1800a8540]
movabs r9, 0xdddf07b435902707
mov r9, qword [rcx + r9]
lea rcx, [r9 + rax]
mov rax, qword [r9 + rax + 0x18]
movabs r9, 0xcbf29ce484222325
movabs r10, 0x100000001b3
movsx r11, byte [rax]
inc rax
xor r9, r11
imul r9, r10
test r11, r11
jne 0x180074fbb
lea eax, [r8 - 0x1d]
cmp eax, 7
ja 0x180074fe6
movabs rax, 0x2374c594f5e76f06
cmp r9, rax
je 0x180075013
lea eax, [r8 - 0x1a]
cmp eax, 6
ja 0x180074ffe
movabs rax, 0xf9bdf861cccd5fd1
cmp r9, rax
je 0x180075013
cmp r8d, 0x10
jne 0x180075023
movabs rax, 0xb4d052affec8dc8e
cmp r9, rax
jne 0x180075023
mov byte [rcx + 0x9c], 0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
movabs rax, 0x2f2959b508f215d2
movabs r10, 0xecc3c7c77aebb7ea
cmp r9, rax
je 0x180075041
cmp r9, r10
jne 0x18007507a
cmp r9, r10
sete r10b
cmp r9, rax
sete bl
cmp r8d, 7
sete sil
cmp r8d, 6
sete r11b
mov rax, qword [rcx]
mov r9, qword [rcx + 8]
test sil, bl
jne 0x1800750a0
and r11b, r10b
jne 0x1800750a0
cmp rax, r9
je 0x18007501a
mov qword [rcx + 8], rax
jmp 0x18007501a
xor eax, eax
movabs rdx, 0xeb5bc0df5355fba6
cmp r9, rdx
je 0x18007501c
cmp byte [rcx + 0x9c], 0xff
je 0x18007501c
mov byte [rcx + 0x9c], 0xff
jmp 0x18007501a
cmp rax, r9
je 0x1800750a9
mov qword [rcx + 8], rax
call fcn.18007536c
mov al, 1
jmp 0x18007501c
Function at 0x180075134
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
sub rsp, 0x38
mov r8d, edx
mov rax, qword [0x1800a8ea8]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx], 0
jne 0x18007519d
mov word [rcx + 1], 1
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [rsp + 0x28], rdx
xor eax, eax
mov r9d, 4
movsxd rdx, eax
inc eax
mov dl, byte [rsp + rdx + 0x28]
mov byte [rcx + r9], dl
cmp eax, 8
jne 0x18007518d
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [rsp + 0x28], rdx
xor eax, eax
inc r9
cmp r9, 8
jne 0x18007516b
mov byte [rcx + 8], 0
mov byte [rcx], 1
mov edx, dword [rcx + 4]
mov dword [rsp + 0x24], edx
movzx r9d, byte [rcx + 1]
test r9d, r9d
je 0x18007524a
lea eax, [r9 + 3]
and eax, 0xfffffffc
dec r9d
movd xmm0, r9d
pshufd xmm1, xmm0, 0
movd xmm0, r8d
movd xmm2, edx
pshufd xmm3, xmm2, 0
mov edx, 4
pcmpeqd xmm4, xmm4
movdqa xmm2, xmm0
movdqa xmm0, xmm3
pxor xmm0, xmm2
pxor xmm0, xmm4
mov r8d, edx
add edx, 0xfffffffc
add r8d, eax
add r8d, 0xfffffffc
cmp r8d, 4
jne 0x1800751dd
neg edx
movd xmm3, edx
pshufd xmm3, xmm3, 0
por xmm3, xmmword [0x1800912b0]
movdqa xmm4, xmmword [0x18008a140]
pxor xmm1, xmm4
pxor xmm3, xmm4
pcmpgtd xmm3, xmm1
pand xmm2, xmm3
pandn xmm3, xmm0
por xmm3, xmm2
pshufd xmm0, xmm3, 0xee
pxor xmm0, xmm3
pshufd xmm1, xmm0, 0x55
pxor xmm1, xmm0
movd r8d, xmm1
mov dword [rsp + 0x28], r8d
movzx eax, byte [rcx + 2]
mov edx, 4
sub rdx, rax
cmp rdx, 3
ja 0x18007527c
neg rax
mov dl, byte [rsp + rax + 0x28]
xor dl, byte [rsp + rax + 0x2c]
not dl
mov byte [rsp + rax + 0x2c], dl
inc rax
jne 0x180075264
mov r8d, dword [rsp + 0x28]
mov al, byte [rcx + 8]
inc al
and al, 3
movzx eax, al
mov dword [rcx + rax*4 + 0xc], r8d
mov byte [rcx + 8], al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180080ac0
nop
add rsp, 0x38
ret
Function at 0x180081440
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800814c4
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180099110]
cmp byte [rcx + rax], 0
je 0x1800814c4
dec r8
sub rdx, 1
jne 0x1800814aa
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140016260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400163eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x140125d28]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400338e0
xorps xmm15, xmm15
mov r14, qword [0x14025c620]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x1400162c5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x1400162d4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x1400162f3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140016303
cmp rbx, 0x1000
jae 0x1400162cb
jmp 0x14001636d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x140016315
xor edx, edx
jmp 0x140016364
mov rcx, qword [0x140125d28]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.1400338e0
xorps xmm15, xmm15
mov r14, qword [0x14025c620]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x1400162f9
jmp 0x1400162e8
call fcn.140065d60
xorps xmm15, xmm15
mov r14, qword [0x14025c620]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.140037ce0
lea rax, [0x140159bb4]
mov ebx, 0x18
nop dword [rax]
call fcn.140038560
mov rax, qword [rsp + 0x38]
call fcn.1400382a0
lea rax, [0x14015a068]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.140038560
mov rax, qword [rsp + 0x30]
call fcn.1400382a0
call fcn.140037f20
call fcn.140037d40
lea rax, [0x14015c0ea]
mov ebx, 0x21
call fcn.140036340
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140062000
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.140016260