joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b1d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov eax, 1
mov qword [rsp + 0x38], rsi
mov r11, rcx
mov rdi, rdx
movzx ecx, byte [rdx + 0xb]
shl eax, cl
cmp byte [rdx + 0xa], 0
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
jge 0x1800b1d80
mov ecx, dword [rdx + 0xc]
lea eax, [rcx - 1]
test ecx, eax
je 0x1800b1d80
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
jmp 0x1800b1d83
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x1800b1dbe
mov qword [rsp + 0x30], rbx
xor r10d, r10d
mov ebx, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x1800b1daf
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x1800b1daf
mov rcx, r11
call fcn.1800b14d0
add r10, 0x10
sub rbx, 1
jne 0x1800b1d91
mov rbx, qword [rsp + 0x30]
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x1800b1e20
nop word [rax + rax]
movzx eax, byte [r10 + 9]
and al, 0x40
test byte [r10 + 8], 0xf
jne 0x1800b1de9
test al, al
je 0x1800b1e17
mov byte [r10 + 9], 0xb
jmp 0x1800b1e17
test al, al
je 0x1800b1dff
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x1800b1dff
mov rcx, r11
call fcn.1800b14d0
test byte [r10 + 8], 0x40
je 0x1800b1e17
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x1800b1e17
mov rcx, r11
call fcn.1800b14d0
add r10, 0x18
cmp r10, rsi
jb 0x1800b1dd0
movzx eax, byte [rdi + 9]
mov rsi, qword [rsp + 0x38]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x1800b1e57
mov rcx, rdi
call fcn.1800b1380
mov rcx, qword [r11 + 0x90]
mov qword [rax], rcx
mov qword [r11 + 0x90], rdi
and byte [rdi + 9], 0xc7
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x1800b1e61
xor al, 2
mov byte [rdi + 9], al
add rsp, 0x20
pop rdi
ret
Function at 0x1800b4070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x1800b417f
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x180000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x1800b40da.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x1800b40da.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x1800b40da.8
cdqe
movzx eax, byte [rdi + rax + 0xb4194]
mov ecx, dword [rdi + rax*4 + 0xb4180]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x1800b40da.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x1800b40fd
and dl, 0xc7
jmp 0x1800b4103
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x1800b40da.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x1800b40da.8
mov rcx, rbx
call fcn.1800b14d0
jmp case.0x1800b40da.8
cmp word [r10 + 0xa], 0
jne case.0x1800b40da.5
mov rdx, qword [r10 + 0x18]
test rdx, rdx
je 0x1800b413f
test byte [rdx + 9], 0x18
je 0x1800b413f
mov rcx, rbx
call fcn.1800b14d0
and byte [r10 + 9], 0xe7
or byte [r10 + 9], 0x20
jmp case.0x1800b40da.8
mov rcx, r10
call fcn.1800b1380
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x1800b4093
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x1800be410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], rbx
mov r13, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor esi, esi
lea r11, [0x1802df7d0]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x1800be47f
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x1800be470
mov qword [rsp + 0x60], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x1800be496
mov r12d, ebp
jmp 0x1800be49f
cmp al, 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x50]
jne 0x1800be5e9
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x1800be5e9
movsd xmm2, qword [0x180307c30]
lea r13, [0x1802df7d0]
add rdx, 2
nop
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x1800be4eb
test edi, edi
jne 0x1800be540
mov edi, ebp
inc rdx
jmp 0x1800be4d0
test byte [r8 + r13 + 1], 0x10
je 0x1800be540
test r10d, r10d
jne 0x1800be503
cmp r8b, 0x30
jne 0x1800be503
inc r14d
jmp 0x1800be534
inc r10d
cmp r10d, 0x1e
jg 0x1800be531
test byte [rcx + r13 + 1], 2
je 0x1800be519
add ecx, 0xffffffd0
jmp 0x1800be51f
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1800be534
inc r9d
test edi, edi
je 0x1800be53b
dec r9d
inc rdx
jmp 0x1800be4d0
mov r13, qword [rsp + 0x58]
lea eax, [r14 + r10]
test eax, eax
je 0x1800be5e9
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x1800be5cf
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x1800be577
lea rdx, [r11 + 2]
jmp 0x1800be581
cmp al, 0x2b
jne 0x1800be57f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x1802df7d0]
test byte [r8 + r11 + 1], 2
je 0x1800be5e9
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x1800be5a0
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x1800be5db
xorps xmm1, xmmword [0x180309630]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x1800be5ec
xorps xmm0, xmm0
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1800be760
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x120]
call fcn.1800be610
mov r9, rax
test rax, rax
je 0x1800be7ad
mov r8, qword [rsp + 0x120]
mov al, 3
sub r9, rbx
mov qword [r14], r8
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x1800be93c
lea rdx, str..xXnN
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x1800be7e8
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x1800be93a
cmp edi, 0x78
jne 0x1800be7ea
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.1800be410
jmp 0x1800be7fb
xor edi, edi
lea rdx, [rsp + 0x120]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x120]
lea rbp, [0x1802df7d0]
cmp rax, rbx
je 0x1800be847
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x1800be835
nop dword [rax]
inc rax
mov qword [rsp + 0x120], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x1800be820
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
jne 0x1800be926
mov edx, 0x2e
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov rsi, rax
test rax, rax
je 0x1800be93a
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1800be870
cmp rcx, 0xc8
ja 0x1800be93a
lea rdx, [rsp + 0x20]
mov rcx, rbx
sub rdx, rbx
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800be891
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub rsi, rbx
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x20]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rsi + 0x20], al
cmp edi, 0x78
jne 0x1800be8cb
call fcn.1800be410
jmp 0x1800be8d1
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x120]
lea rcx, [rsp + 0x20]
cmp rax, rcx
je 0x1800be93a
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x1800be905
nop dword [rax]
inc rax
mov qword [rsp + 0x120], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x1800be8f0
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
je 0x1800be93a
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
add r9, rax
test r9, r9
je 0x1800be93a
mov al, 0x13
movsd qword [r14], xmm0
sub r9, rbx
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x1800be93c
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800c8c30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x48
mov rsi, rdx
mov rbp, rcx
xor edx, edx
mov r9d, 0x658
mov rcx, rsi
lea r8d, [rdx + 8]
call rbp
test rax, rax
jne 0x1800c8c5a
add rsp, 0x48
pop rsi
pop rbp
ret
mov qword [rsp + 0x68], rbx
xor ecx, ecx
lea rbx, [rax + 0xd0]
mov word [rax + 0x10], 0x808
mov byte [rbx + 0x64], 8
mov qword [rax + 0x20], rbx
mov qword [rsp + 0x70], rdi
lea rdi, [rax + 8]
mov qword [rdi + 0x50], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [fcn.1800c8c30]
mov qword [rbx + 8], rsi
mov qword [rsp + 0x40], r14
xor r14d, r14d
mov dword [rdi + 0xb0], r14d
add dword [rdi + 0xb0], 0x10000
mov qword [rdi + 0x30], r14
mov qword [rdi + 0x20], r14
lea esi, [r14 + 0x18]
mov word [rdi + 0xc], r14w
mov qword [rdi + 0x58], r14
mov qword [rdi + 0xa0], r14
mov qword [rsp + 0x30], rax
mov dword [rdi + 0xc0], r14d
mov qword [rdi + 0xb8], r14
mov word [rdi + 0xa], 0x100
mov qword [rdi + 0x38], r14
mov qword [rdi + 0xa8], r14
mov dword [rdi + 0xb4], r14d
mov qword [rbx + 0x70], rdi
mov qword [rdi], r14
mov qword [rbx], rbp
mov qword [rbx + 0x578], r14
mov qword [rbx + 0x580], r14
mov qword [rbx + 0x108], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
xor eax, esi
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rsp + rsi + 0x1f]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub rsi, 1
jne 0x1800c8d30
mov dword [rbx + 0x60], eax
lea rdx, [0x1800c8850]
mov dword [rbx + 0x6a], 0x19320002
xor r8d, r8d
mov qword [rbx + 0x38], r14
mov rcx, rdi
mov qword [rbx + 0x30], r14
mov byte [rbx + 0x48], r14b
mov qword [rbx + 0x100], r14
mov dword [rbx + 0x65], 0x14000008
mov qword [rbx + 0xb8], r14
mov qword [rbx + 0xb0], r14
mov qword [rbx + 0x80], r14
mov qword [rbx + 0xd0], r14
mov qword [rbx + 0xc8], r14
mov qword [rbx + 0xc0], r14
mov qword [rbx + 0xd8], r14
mov qword [rbx + 0xf0], r14
mov qword [rbx + 0xe8], r14
mov qword [rbx + 0xe0], r14
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x90], r14
mov qword [rbx + 0x88], r14
mov qword [rbx + 0xa8], r14
mov qword [rbx + 0xa0], r14
mov qword [rbx + 0x98], r14
mov qword [rbx + 0xf8], r14
mov qword [rbx + 0x10], 0x658
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x28], r14
mov qword [rbx + 0x50], r14
mov byte [rbx + 0x58], 3
mov byte [rbx + 0x6e], 0xd
mov byte [rbx + 0x69], 0x19
mov qword [rbx + 0x1e0], r14
mov qword [rbx + 0x1e8], r14
mov qword [rbx + 0x1f0], r14
mov qword [rbx + 0x1f8], r14
mov qword [rbx + 0x200], r14
mov qword [rbx + 0x208], r14
mov qword [rbx + 0x210], r14
mov qword [rbx + 0x218], r14
mov qword [rbx + 0x220], r14
call fcn.1800aea40
mov rbx, qword [rsp + 0x68]
test eax, eax
je 0x1800c8e68
mov rcx, rdi
call fcn.1800c8ae0
mov rdi, r14
mov r14, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x70]
add rsp, 0x48
pop rsi
pop rbp
ret
Function at 0x1800c91c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
cmp r8, 0x28
ja 0x1800c91e5
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800c9010
movabs rax, 0x7fffffffffffffdf
cmp rdi, rax
jae 0x1800c9226
mov rdx, rdi
mov qword [rsp + 0x30], rbx
call fcn.1800c8fa0
mov r8, rdi
mov rdx, rsi
mov rbx, rax
lea rcx, [rax + 0x18]
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1800bbb80
int3

Function at 0x1800db8a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1800dc160
mov r9, qword [rbx]
mov rdi, rax
shl rdi, 0x20
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1800db911
lea r8, [r9 + 8]
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800db8d0
mov ecx, dword [r9]
jmp 0x1800db9f4
cmp ecx, 0x4e0
jb 0x1800db9f4
lea r10, [r9 + 0x9c4]
mov ebx, 0xe3
mov r11d, dword [r10]
nop dword [rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800db930
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800db980
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1800dbdd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1800dbe31
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800dbdf0
mov ecx, dword [r9]
jmp 0x1800dbf18
cmp ecx, 0x4e0
jb 0x1800dbf18
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800dbe50
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800dbea0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800dbf60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, r9d
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.1800dc160
mov rdi, rax
add ebp, 0xffffffff
je 0x1800dc13c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
xor r12d, r12d
nop dword [rax]
mov r9, qword [rsi]
shl rdi, 0x20
mov ecx, dword [r9]
cmp ecx, 0x270
jne 0x1800dc004
lea rax, [r9 + 8]
mov r10d, ecx
nop dword [rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r10, 1
jne 0x1800dbfc0
mov ecx, dword [r9]
jmp 0x1800dc0e3
cmp ecx, 0x4e0
jb 0x1800dc0e3
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov ebx, dword [r10]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x1800dc020
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov ebx, dword [r10]
nop word [rax + rax]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x1800dc070
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov ecx, r12d
mov dword [r9], r12d
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rdi, rax
add ebp, 0xffffffff
jne 0x1800dbfa0
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rax, r15
mov rsi, qword [rsp + 0x58]
mul rdi
mov qword [r14], rax
mov rax, r14
mov qword [r14 + 8], rdx
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800dc160
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1800dc1c1
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800dc180
mov ecx, dword [r9]
jmp 0x1800dc2a8
cmp ecx, 0x4e0
jb 0x1800dc2a8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800dc1e0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1800dc230
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
add rsp, 8
ret
Function at 0x1800e1650
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov r10, r8
mov rdi, rcx
lea rsi, [r8 + r9]
mov r14b, 1
mov rbp, qword [rsp + 0x60]
nop dword [rax]
mov rax, qword [rdi + 8]
mov rcx, qword [rdi]
mov r8, rax
sub r8, rcx
mov rdx, rsi
sub rdx, r10
cmp rdx, r8
jl 0x1800e1706
mov r9, rsi
sub r9, r8
mov rdx, rcx
mov rbx, r10
cmp rcx, rax
je 0x1800e16cc
sub r10, rcx
nop dword [rax]
movzx r8d, byte [rdx]
cmp byte [r10 + rdx], r8b
je 0x1800e16c4
cmp r8b, 0xcc
jne 0x1800e177d
inc rdx
cmp rdx, rax
jne 0x1800e16b0
cmp rbx, rsi
jae 0x1800e1706
mov qword [rsp + 0x50], rbx
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1800e1790
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x10]
test al, al
sete r14b
mov r10, qword [rdi + 8]
sub r10, qword [rdi]
add r10, rbx
test al, al
je 0x1800e1680
xor r14b, 1
mov rcx, qword [rdi]
xor ebx, ebx
test rcx, rcx
je 0x1800e174c
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1800e173c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800e1797
mov rcx, r8
call fcn.180284a64
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1800e1766
mov r8, qword [rcx]
cmp rcx, rbp
setne dl
call qword [r8 + 0x20]
mov qword [rbp + 0x38], rbx
movzx eax, r14b
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
cmp rbx, r9
je 0x1800e1706
inc rbx
mov r10, rbx
mov rdx, rcx
jmp 0x1800e16a9
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1800ed690
Capabilities:
Hide graphical window

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Dll_eject_in_10_seconds__
mov byte [0x180350b1a], 1
mov byte [0x180350acc], 0
call fcn.18000b990
lea rdx, [0x18000bb70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [0x180350c00]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x270f
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180350bd0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x270f
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180350bf8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180350c98]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x12]
call qword [sym.imp.USER32.dll_SendMessageA]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.1801359b0
xor r8d, r8d
lea rcx, [0x180347040]
mov dl, 1
call fcn.180047f20
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1801354d0
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180350b80]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180350b78]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]