joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007f8b0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18007f8d9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x18007f940
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x18007f99f

Function at 0x18007f990
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.18007f990
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x18007fa20
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x18007fa7f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18007fa70
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
ret
Function at 0x18007fb00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x18007fb5a

Function at 0x18007fb7a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18007fb50
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret

Function at 0x18007fc10
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x18007fc6a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18007fc60
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
ret
Function at 0x1800968c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1800969e0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x180096920
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x180096920
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x180096920
Function at 0x1800c0360
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rdi, [rsp + 0x28]
mov qword [rdi], rdx
mov rdx, rdi
call fcn.1800df780
lea rdx, [rsi + 0xa0]
mov r8d, dword [rdi]
mov rcx, qword [rsi + 0x90]
mov qword [rsp + 0x20], rdx
mov rdx, rax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800c03db
mov byte [rsi + 0xc0], 1
mov eax, 1
lock xadd dword [rsi + 8], eax
cmp eax, 0x7fffffff
je 0x1800c03f4
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e6610
nop
add rsp, 0x38
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1800c03ae
mov rcx, rsi
xor edx, edx
call fcn.18014f800
jmp 0x1800c03c6
int3

Function at 0x1800c0400
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x50], rax
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x30]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [0x1803467d0]
movaps xmmword [r14], xmm0
mov rax, qword [rdx]
mov rax, qword [rax + 0x38]
mov rcx, rdx
mov rdx, r14
call qword [0x1803f5008]
mov rbx, qword [r14]
mov r14, qword [r14 + 8]
jmp 0x1800c0475
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1800c04b3
xor esi, esi
jmp 0x1800c04ce
mov rcx, rbx
call fcn.1801dfc90
add rbx, 0x28
cmp rbx, r14
jne 0x1800c0469
lea r14, [rsi + 0xd0]
mov ebx, dword [rdi + 8]
mov rax, qword [rdi]
mov rax, qword [rax + 0x10]
mov rcx, rdi
call qword [0x1803f5008]
mov rcx, qword [rsi + 0x90]
mov qword [rsp + 0x20], r14
mov rdx, rax
mov r8d, ebx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1800c0458
mov byte [rsi + 0x112], 1
mov eax, 1
lock xadd dword [rsi + 8], eax
mov sil, 1
cmp eax, 0x7fffffff
je 0x1800c054c
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1800c0507
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
cmp rdi, rbx
je 0x1800c04fd
add rdi, 0xffffffffffffffd8
je 0x1800c0520
mov rcx, rdi
call fcn.1801da2a0
cmp rdi, rbx
jne 0x1800c04e5
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rbx
call fcn.1801e4f44
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1801e6610
mov eax, esi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rax, str.null_pointer_given_to_destroy_at
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s_n
lea rdx, str....._third_partylibc_srcinclude__memoryconstruct_at.h
lea r9, str.__loc___nullptr
mov r8d, 0x44
call fcn.18027be54
int3
Function at 0x1800d3644
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x1800d368c
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1800d3695
lea rax, [rsi + 1]
cmp rax, 2
jb 0x1800d367c
mov qword [rdi], rsi
call fcn.18010a990
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.18010a990
mov rcx, qword [rdi]
call fcn.1800fd300
mov qword [rdi], 0
jmp 0x1800d366a
Function at 0x1800deb38
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp rdx, 1
je 0x1800deb86
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
jne 0x1800deb67
mov rbx, qword [rsi + 8]
cmp rdi, rbx
ja 0x1800deb74
jb 0x1800deba3
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rdi
call fcn.1800f5d5b
mov rdi, rax
jmp 0x1800deb54
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.18014d5ac
mov edi, 2
jmp 0x1800deb54
mov rcx, rdx
call fcn.1800f5d5b
cmp rdi, rax
cmovbe rdi, rax
cmp rdi, rbx
jae 0x1800deb5f
jmp 0x1800deb74
mov rax, qword [rsi + 0x18]
test rax, rax
jns 0x1800debc3
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
jmp 0x1800debc8
cvtsi2ss xmm0, rax
divss xmm0, dword [rsi + 0x20]
call fcn.180203dd8
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x1803507c0]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rbx, 3
jb 0x1800deb8d
mov rax, rbx
shr rax, 1
movabs rcx, 0x5555555555555555
and rcx, rax
mov rax, rbx
sub rax, rcx
movabs rcx, 0x3333333333333333
mov r8, rax
shr r8, 2
and rax, rcx
and r8, rcx
add r8, rax
mov rax, r8
shr rax, 4
add rax, r8
movabs rcx, 0xf0f0f0f0f0f0f0f
and rcx, rax
movabs rax, 0x101010101010101
imul rax, rcx
shr rax, 0x38
cmp eax, 1
ja 0x1800deb8d
lea rax, [rdx - 1]
bsr rcx, rax
xor ecx, 0x3f
neg cl
mov eax, 1
shl rax, cl
cmp rdx, 2
cmovb rax, rdx
jmp 0x1800deb95
Function at 0x1800fcbf0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp rdx, 1
jne 0x1800fcc5f
mov rbx, qword [rsi + 8]
mov edi, 2
cmp rbx, 2
jae 0x1800fcd8d
lea rbx, [rsi + 8]
lea rcx, [rdi*8]
call fcn.1801e4f08
mov rcx, qword [rsi]
mov qword [rsi], rax
test rcx, rcx
jne 0x1800fcc58
mov qword [rbx], rdi
xor eax, eax
mov rcx, qword [rsi]
mov qword [rcx + rax*8], 0
inc rax
cmp rdi, rax
jne 0x1800fcc34
mov r8, qword [rsi + 0x10]
test r8, r8
jne 0x1800fcc91
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.1801e4f44
jmp 0x1800fcc2f
mov rdi, rdx
lea rax, [rdx - 1]
test rdx, rax
je 0x1800fcc76
mov rcx, rdi
call fcn.1800f5d5b
mov rdi, rax
mov rbx, qword [rsi + 8]
cmp rdi, rbx
jbe 0x1800fcd8d
mov rax, rdi
shr rax, 0x3d
je 0x1800fcc13
jmp 0x1800fceac
lea r10, [rsi + 0x10]
mov rcx, qword [r8 + 8]
mov rax, rdi
shr rax, 1
movabs rdx, 0x5555555555555555
and rdx, rax
mov rax, rdi
sub rax, rdx
movabs rdx, 0x3333333333333333
mov r9, rax
and r9, rdx
shr rax, 2
and rax, rdx
add rax, r9
mov rdx, rax
shr rdx, 4
add rdx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rdx
movabs r9, 0x101010101010101
imul r9, rax
shr r9, 0x38
cmp r9, 1
jbe 0x1800fcea0
cmp rcx, rdi
jb 0x1800fcd0f
mov rax, rcx
xor edx, edx
div rdi
mov rcx, rdx
mov rax, qword [rsi]
mov qword [rax + rcx*8], r10
mov r10, qword [r8]
test r10, r10
je 0x1800fcc50
lea r11, [rdi - 1]
jmp 0x1800fcd5d
mov rdx, qword [r10]
mov qword [r8], rdx
mov rdx, qword [rsi]
mov rdx, qword [rdx + rax*8]
mov rdx, qword [rdx]
mov qword [r10], rdx
mov rdx, qword [rsi]
mov rax, qword [rdx + rax*8]
mov qword [rax], r10
mov r10, r8
mov rax, rcx
mov r8, r10
mov r10, qword [r10]
mov rcx, rax
test r10, r10
je 0x1800fcc50
mov rax, qword [r10 + 8]
cmp r9d, 1
jbe 0x1800fce98
cmp rax, rdi
jb 0x1800fcd78
xor edx, edx
div rdi
mov rax, rdx
cmp rax, rcx
je 0x1800fcd48
mov rdx, qword [rsi]
cmp qword [rdx + rax*8], 0
jne 0x1800fcd28
mov qword [rdx + rax*8], r8
jmp 0x1800fcd4b
cmp rdi, rbx
jae 0x1800fcc50
mov rax, qword [rsi + 0x18]
test rax, rax
jns 0x1800fcdb6
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
jmp 0x1800fcdbb
cvtsi2ss xmm0, rax
divss xmm0, dword [rsi + 0x20]
call fcn.180203dd8
cvttss2si rcx, xmm0
mov rdx, rcx
subss xmm0, dword [0x1803507c0]
cvttss2si rax, xmm0
sar rdx, 0x3f
and rax, rdx
or rax, rcx
cmp rbx, 3
jb 0x1800fce6e
mov rcx, rbx
shr rcx, 1
movabs rdx, 0x5555555555555555
and rdx, rcx
mov rcx, rbx
sub rcx, rdx
movabs rdx, 0x3333333333333333
mov r8, rcx
shr r8, 2
and rcx, rdx
and r8, rdx
add r8, rcx
mov rcx, r8
shr rcx, 4
add rcx, r8
movabs rdx, 0xf0f0f0f0f0f0f0f
and rdx, rcx
movabs rcx, 0x101010101010101
imul rcx, rdx
shr rcx, 0x38
cmp ecx, 1
ja 0x1800fce6e
lea rcx, [rax - 1]
bsr rcx, rcx
xor ecx, 0x3f
neg cl
mov edx, 1
shl rdx, cl
cmp rax, 2
cmovb rdx, rax
jmp 0x1800fce79
mov rcx, rax
call fcn.1800f5d5b
mov rdx, rax
cmp rdi, rdx
cmova rdx, rdi
cmp rdx, rbx
jae 0x1800fcc50
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1802cb450
and rax, r11
jmp 0x1800fcd78
lea rax, [rdi - 1]
and rcx, rax
jmp 0x1800fcd0f
call fcn.180267d05
int3
Function at 0x1800fd670
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
movapd xmmword [rsp + 0x40], xmm6
mov rsi, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x20]
call fcn.1800fd9d0
mov qword [rsp + 0x28], 0
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
movsd xmm0, qword [0x1803d4718]
xorpd xmm6, xmm6
ucomisd xmm0, xmm6
jne 0x1800fd6ce
jnp 0x1800fd734
ucomisd xmm0, xmm6
jne 0x1800fd6d6
jnp 0x1800fd730
movsd xmm1, qword [rsp + 0x28]
unpcklps xmm1, xmmword [0x180350230]
subpd xmm1, xmmword [0x180350240]
movapd xmm2, xmm1
unpckhpd xmm2, xmm1
addsd xmm2, xmm1
divsd xmm2, xmm0
mulsd xmm2, qword [0x18035ca88]
cvttsd2si rax, xmm2
mov qword [rsi], rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1801e6610
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1800fd708
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, eax
call rbx
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x1803d4728]
mov ecx, dword [0x1803c8448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1800fd851
mov eax, dword [0x1803d4738]
mov ecx, dword [0x1803c8448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1800fd88b
rdtsc
mov rbx, rax
mov r14, rdx
xor r12d, r12d
lea r15, [rsp + 0x30]
mov qword [r15], r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r13, qword [r15]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [r15], r12
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub r13, qword [0x1803d4730]
cvtsi2sd xmm1, r13
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rdi]
divsd xmm1, xmm0
xorpd xmm0, xmm0
movsd xmm2, qword [0x18035ca80]
ucomisd xmm2, xmm1
ja 0x1800fd6ce
shl r14, 0x20
or rbx, r14
sub rbx, qword [0x1803d4720]
movq xmm2, rbx
punpckldq xmm2, xmmword [0x180350230]
subpd xmm2, xmmword [0x180350240]
movapd xmm0, xmm2
unpckhpd xmm0, xmm2
addsd xmm0, xmm2
divsd xmm0, xmm1
movsd qword [0x1803d4718], xmm0
jmp 0x1800fd6ce
lea rcx, [0x1803d4728]
call fcn.1801e5060
cmp dword [0x1803d4728], 0xffffffff
jne 0x1800fd77d
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1803d4720], rdx
lea rcx, [0x1803d4728]
call fcn.1801e50f8
jmp 0x1800fd77d
lea rcx, [0x1803d4738]
call fcn.1801e5060
cmp dword [0x1803d4738], 0xffffffff
jne 0x1800fd7a2
lea rbx, [rsp + 0x30]
mov qword [rbx], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx]
mov qword [0x1803d4730], rax
lea rcx, [0x1803d4738]
call fcn.1801e50f8
jmp 0x1800fd7a2
Function at 0x1800fe640
Capabilities:
Check if file exists

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r9
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov qword [rcx], rax
mov r12, qword [rdx]
mov qword [rdx], rax
lea r13, [r12 + 1]
cmp r13, 2
jb 0x1800fe677
call fcn.18010a990
mov r15, qword [rsp + 0x90]
cmp qword [rsi], r12
je 0x1800fe6b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r14d, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x1800fe6df
cmp r13, 2
jb 0x1800fe6a7
mov qword [rsi], r12
call fcn.18010a990
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rsi + 8], ebp
mov qword [rsi + 0x10], rbx
movups xmm0, xmmword [r15]
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x1800fe6f5
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.18010a990
mov rcx, qword [rsi]
call fcn.1800fd300
mov qword [rsi], 0
jmp 0x1800fe699
call fcn.18010a990
mov rcx, qword [rdi]
call fcn.1800fd300
mov qword [rdi], 0
jmp 0x1800fe6cb

Function at 0x1800fe870
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x1803467d0]
lea r12, [rsp + 0x60]
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rdx, str.Read
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x48
call fcn.18010a970
mov rcx, r12
mov rdx, r15
xor r8d, r8d
call fcn.180101470
mov ebp, 0xffffffff
test r14, r14
js 0x1800fe96c
test esi, esi
js 0x1800fe96c
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.1801191b0
test al, al
jne 0x1800fe9b2
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
lea r9, [rsp + 0x2c]
mov dword [r9], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800fe99f
mov ebp, dword [rsp + 0x2c]
test ebp, ebp
js 0x1800fe99a
lea rcx, [rsp + 0x30]
call fcn.180119240
lea rcx, [rsp + 0x60]
call fcn.1801014d0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1801e6610
mov eax, ebp
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
int3
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
cmp eax, 0x26
setne bpl
neg ebp
jmp 0x1800fe962
mov r9d, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1802f9650
jmp 0x1800fe924
Function at 0x1800fe9d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb0
mov esi, r9d
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x1803b6038]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movaps xmm0, xmmword [0x1803467d0]
lea r12, [rsp + 0x60]
movaps xmmword [r12 + 0x30], xmm0
movaps xmmword [r12 + 0x20], xmm0
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
lea rdx, str.Write
lea r8, str....._base_files_file_win.cc
lea r15, [rsp + 0x40]
mov rcx, r15
mov r9d, 0x85
call fcn.18010a970
mov rcx, r12
mov rdx, r15
xor r8d, r8d
call fcn.180101470
mov ebp, 0xffffffff
test r14, r14
js 0x1800feac9
test esi, esi
js 0x1800feac9
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
call fcn.1801191b0
test al, al
jne 0x1800feaf7
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
lea r14, [rsp + 0x2c]
mov dword [r14], 0xaaaaaaaa
mov rcx, qword [rbx]
mov qword [rsp + 0x20], r15
mov rdx, rdi
mov r8d, esi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ebp, ebp
cmp eax, 1
sbb ebp, ebp
or ebp, dword [r14]
lea rcx, [rsp + 0x30]
call fcn.180119240
lea rcx, [rsp + 0x60]
call fcn.1801014d0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1801e6610
mov eax, ebp
add rsp, 0xb0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r9d, esi
lea rdx, str.File::Write
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1802f9650
jmp 0x1800fea80