joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180067650
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov r13, rcx
mov dword [rbp - 0x20], 0
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea r8, [rbp - 1]
call fcn.180068c30
mov rdi, qword [r13]
movabs r12, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
nop word cs:[rax + rax]
lea rbx, [rdi + 0x48]
lea r14, [rdi + 0xf8]
mov qword [rbp - 0x10], rbx
mov r15, qword [r13 + 8]
cmp rdi, r15
je 0x1800677e8
movzx eax, byte [rdi + 0x48]
xor rax, r12
imul rax, rsi
movzx ecx, byte [rdi + 0x49]
xor rcx, rax
imul rcx, rsi
movzx eax, byte [rdi + 0x4a]
xor rax, rcx
imul rax, rsi
movzx ecx, byte [rdi + 0x4b]
xor rcx, rax
imul rcx, rsi
and rcx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x48]
mov rax, rcx
shl rax, 4
mov rax, qword [r8 + rax + 8]
cmp rax, qword [rbp - 0x58]
je 0x1800677d0
mov edx, dword [rbx]
cmp edx, dword [rax + 0x10]
je 0x180067742
add rcx, rcx
mov rcx, qword [r8 + rcx*8]
nop word cs:[rax + rax]
cmp rax, rcx
je 0x1800677d0
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180067730
cmp r14, r15
je 0x18006779d
mov rsi, r13
mov rbx, r14
mov r14, r12
mov r12, rdi
nop word cs:[rax + rax]
lea r13, [r12 + 0xf8]
mov rcx, r12
mov rdx, r13
call fcn.180068840
add r12, 0x1f0
cmp r12, r15
mov r12, r13
jne 0x180067760
mov r13, rsi
mov r15, qword [rsi + 8]
mov r12, r14
mov r14, rbx
movabs rsi, 0x100000001b3
mov rbx, qword [rbp - 0x10]
add r15, 0xffffffffffffff08
mov rcx, r15
call fcn.180039110
add qword [r13 + 8], 0xffffffffffffff08
mov r15, qword [r13 + 8]
cmp rdi, r15
jne 0x1800676cc
jmp 0x1800677e8
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x20]
mov r8, rbx
call fcn.180067e00
mov rdi, r14
jmp 0x1800676b0
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x180067830
mov rdx, qword [rbp - 0x38]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x180067819
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18006788b
add rdx, 0x27
mov rcx, rax
call fcn.1800a77d0
xorps xmm0, xmm0
lea rax, [rbp - 0x48]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x180067869
nop word [rax + rax]
mov rsi, qword [rcx]
mov edx, 0x18
call fcn.1800a77d0
mov rcx, rsi
test rsi, rsi
jne 0x180067850
mov rax, qword [rbp - 0x58]
mov edx, 0x18
mov rcx, rax
call fcn.1800a77d0
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1800b109c
int3
Function at 0x180068db0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x180068f5f
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.18002c220
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov rax, qword [rax]
cmp rax, rdi
je 0x180068f52
movabs rcx, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
jmp 0x180068e51
mov qword [r9 + r10*8], r8
mov qword [r9 + rbx*8], r8
cmp rax, rdi
je 0x180068f52
mov r8, rax
mov rax, qword [rax]
movzx r9d, byte [r8 + 0x10]
xor r9, rcx
imul r9, rdx
movzx r10d, byte [r8 + 0x11]
xor r10, r9
imul r10, rdx
movzx r9d, byte [r8 + 0x12]
xor r9, r10
imul r9, rdx
movzx r11d, byte [r8 + 0x13]
xor r11, r9
imul r11, rdx
and r11, qword [rsi + 0x30]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11*2 + 1]
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x180068e40
mov r14, qword [r9 + rbx*8]
mov ebp, dword [r8 + 0x10]
cmp ebp, dword [r14 + 0x10]
jne 0x180068ef0
mov r10, qword [r14]
cmp r10, r8
je 0x180068e44
mov r11, qword [r8 + 8]
mov qword [r11], rax
mov r14, qword [rax + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], r8
mov qword [r10 + 8], r14
mov qword [rax + 8], r11
mov qword [r8 + 8], r15
jmp 0x180068e44
cmp r11, r14
je 0x180068f28
mov r14, qword [r14 + 8]
cmp ebp, dword [r14 + 0x10]
jne 0x180068ef0
mov r9, qword [r14]
mov r10, qword [r8 + 8]
mov qword [r10], rax
mov r11, qword [rax + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r8
mov qword [r9 + 8], r11
mov qword [rax + 8], r10
mov qword [r8 + 8], rbx
jmp 0x180068e48
mov rbx, qword [r8 + 8]
mov qword [rbx], rax
mov r14, qword [rax + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], r8
mov qword [r11 + 8], r14
mov qword [rax + 8], rbx
mov qword [r8 + 8], r15
mov qword [r9 + r10*8], r8
jmp 0x180068e48
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800a8c98
int3
Function at 0x180070d90
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.180071b00
and byte [rsi], 0xf8
movzx eax, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
add rsp, 0x20
pop rsi
ret

Function at 0x180070dc0
Capabilities:
Enumerate pe sections

Disassembly:
mov r8, rdx
lea rdx, [0x18010ae20]
jmp fcn.18006fe20

Function at 0x180070dd0
Capabilities:
Encrypt data using curve25519

Disassembly:
sub rsp, 0x48
mov rax, r8
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm1
and byte [rsp + 0x20], 0xf8
movzx edx, byte [rsp + 0x3f]
and dl, 0x3f
or dl, 0x40
mov byte [rsp + 0x3f], dl
lea r8, [rsp + 0x20]
mov rdx, rax
call fcn.18006fe20
nop
add rsp, 0x48
ret
Function at 0x18008e000
Capabilities:
Encode data using xor
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rsi, qword [rcx + 0x60]
mov dl, 0x80
call fcn.18008daa0
cmp byte [rdi + 0x68], 0x38
je 0x18008e030
nop word [rax + rax]
mov rcx, rdi
xor edx, edx
call fcn.18008daa0
cmp byte [rdi + 0x68], 0x38
jne 0x18008e020
mov rdx, rsi
shr rdx, 0x38
mov rcx, rdi
call fcn.18008daa0
mov rdx, rsi
shr rdx, 0x30
mov rcx, rdi
call fcn.18008daa0
mov rdx, rsi
shr rdx, 0x28
mov rcx, rdi
call fcn.18008daa0
mov rdx, rsi
shr rdx, 0x20
mov rcx, rdi
call fcn.18008daa0
mov edx, esi
shr edx, 0x18
mov rcx, rdi
call fcn.18008daa0
mov edx, esi
shr edx, 0x10
mov rcx, rdi
call fcn.18008daa0
mov edx, esi
shr edx, 8
mov rcx, rdi
call fcn.18008daa0
mov rcx, rdi
mov edx, esi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.18008daa0

Function at 0x18008e330
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rsi, rcx
cmp qword [rdx + 0x18], 0x10
mov r14, rdx
jb 0x18008e361
mov r14, qword [rdx]
mov r15, qword [rdx + 0x10]
mov qword [rsi + 8], 0
mov ecx, 0x30
call fcn.1800a77e0
mov rdi, rax
mov qword [rsi], rax
mov qword [rsi + 0x10], 0x20
mov qword [rsi + 0x18], 0x2f
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax], xmm0
mov byte [rax + 0x20], 0
movaps xmm0, xmmword [0x18010b0b0]
movaps xmmword [rbp - 0x60], xmm0
movaps xmm0, xmmword [0x18010b0c0]
movaps xmmword [rbp - 0x50], xmm0
mov qword [rbp], 0
mov byte [rbp + 8], 0
test r15, r15
je 0x18008e3e5
xor r12d, r12d
lea rbx, [rbp - 0x60]
nop dword [rax]
movzx edx, byte [r14 + r12]
mov rcx, rbx
call fcn.18008daa0
inc r12
cmp r15, r12
jne 0x18008e3d0
lea rcx, [rbp - 0x60]
mov rdx, rdi
call fcn.18008e0b0
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x180090380
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x110
mov rsi, rdx
and rsi, 0xfffffffffffffff0
je 0x180090428
mov rdi, rcx
mov r15, qword [rsp + 0x160]
mov rbx, r9
shr rbx, 2
add ebx, 6
lea r14, [rsp + 0x20]
mov rcx, r14
mov rdx, r8
mov r8, r9
call fcn.180090450
mov rax, qword [r15]
xor qword [rdi], rax
mov rax, qword [r15 + 8]
xor qword [rdi + 8], rax
mov rcx, rdi
mov rdx, rdi
mov r8, r14
mov r9d, ebx
call fcn.180090870
cmp rsi, 0x10
je 0x180090428
add rsi, 0xfffffffffffffff0
add rdi, 0x10
lea r14, [rsp + 0x20]
nop word cs:[rax + rax]
movups xmm0, xmmword [rdi - 0x10]
movups xmm1, xmmword [rdi]
xorps xmm1, xmm0
movups xmmword [rdi], xmm1
mov rcx, rdi
mov rdx, rdi
mov r8, r14
mov r9d, ebx
call fcn.180090870
add rdi, 0x10
add rsi, 0xfffffffffffffff0
jne 0x180090400
add rsp, 0x110
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180090d90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x138
mov rsi, r9
mov rdi, rdx
mov rbx, rcx
mov r14, qword [rsp + 0x190]
lea rcx, [rsp + 0x40]
mov rdx, r8
mov r8, r9
call fcn.180090e40
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x20], xmm0
and rdi, 0xfffffffffffffff0
je 0x180090e28
shr rsi, 2
add esi, 6
lea r15, [rsp + 0x20]
lea rax, [rsp + 0x30]
lea r14, [rsp + 0x40]
nop word cs:[rax + rax]
mov r12, rax
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
mov rcx, rbx
mov rdx, rbx
mov r8, r14
mov r9d, esi
call fcn.180090ef0
mov rax, qword [r15]
xor qword [rbx], rax
mov rax, qword [r15 + 8]
xor qword [rbx + 8], rax
add rbx, 0x10
mov rax, r15
mov r15, r12
add rdi, 0xfffffffffffffff0
jne 0x180090df0
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x180090e40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, r8
mov rsi, rcx
call fcn.180090450
mov eax, dword [0x18014bbd0]
mov ecx, dword [0x18014d474]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x30]
jg 0x180090ebe
test byte [0x18014bbb7], 2
jne 0x180090e82
add rsp, 0x28
pop rdi
pop rsi
ret
cmp rdi, 0x20
je 0x180090ea2
cmp rdi, 0x18
je 0x180090eb0
cmp rdi, 0x10
jne 0x180090e7b
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.18009fac0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.18009fbd0
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.18009fb30
lea rcx, [0x18014bbd0]
call fcn.1800a7fbc
cmp dword [0x18014bbd0], 0xffffffff
jne 0x180090e72
lea rcx, [0x18014bb90]
call fcn.180041b00
lea rcx, [0x18014bbd0]
call fcn.1800a7f50
jmp 0x180090e72
Function at 0x1800918f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
mov qword [rsp + 0x80], r9
mov qword [rsp + 0x88], r8
mov r13, rdx
mov r14, rcx
mov rsi, qword [rsp + 0x210]
mov rbx, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x200]
mov r8, qword [rsp + 0x208]
mov r15, r8
shr r15, 2
add r15d, 6
lea rdi, [rsp + 0xa0]
mov rcx, rdi
call fcn.180090450
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
lea r12, [rsp + 0x90]
mov rcx, r12
mov rdx, r12
mov r8, rdi
mov r9d, r15d
call fcn.180090870
lea rcx, [rsp + 0x70]
mov rdx, r12
mov r8, rsi
mov r9, rbx
call fcn.180091b50
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x68], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x7c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x6c], eax
mov rdi, r13
xor r12d, r12d
and rdi, 0xfffffffffffffff0
je 0x180091a07
lea rbp, [rsp + 0x60]
lea rsi, [rsp + 0x50]
lea rbx, [rsp + 0xa0]
nop dword [rax]
mov rcx, rbp
mov rdx, rsi
mov r8, rbx
mov r9d, r15d
call fcn.180090870
movups xmm0, xmmword [r14 + r12]
xorps xmm0, xmmword [rsp + 0x50]
movups xmmword [r14 + r12], xmm0
mov eax, dword [rsp + 0x6c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x6c], eax
add r12, 0x10
cmp r12, rdi
jb 0x1800919d0
mov rbp, qword [rsp + 0x220]
mov rsi, r13
and rsi, 0xf
je 0x180091ac1
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0xa0]
mov r9d, r15d
call fcn.180090870
mov eax, r13d
and eax, 3
cmp esi, 4
jae 0x180091a45
xor ecx, ecx
jmp 0x180091a94
sub rsi, rax
lea rdx, [r12 + r14]
add rdx, 3
xor ecx, ecx
nop word cs:[rax + rax]
movzx r8d, byte [rsp + rcx + 0x50]
xor byte [rdx + rcx - 3], r8b
movzx r8d, byte [rsp + rcx + 0x51]
xor byte [rdx + rcx - 2], r8b
movzx r8d, byte [rsp + rcx + 0x52]
xor byte [rdx + rcx - 1], r8b
movzx r8d, byte [rsp + rcx + 0x53]
xor byte [rdx + rcx], r8b
add rcx, 4
cmp rsi, rcx
jne 0x180091a60
test rax, rax
je 0x180091ac1
add r12, rcx
add r12, r14
add rcx, rsp
add rcx, 0x50
xor edx, edx
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
xor byte [r12 + rdx], r8b
inc rdx
cmp rax, rdx
jne 0x180091ab0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r15d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, r14
mov r8, r13
mov r9, qword [rsp + 0x88]
call fcn.180091e40
nop
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180092120
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1a8
mov r15, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rdx, qword [rsp + 0x210]
mov r8, qword [rsp + 0x218]
mov rbx, r8
shr rbx, 2
add ebx, 6
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call fcn.180090450
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
lea r12, [rsp + 0xa0]
mov rcx, r12
mov rdx, r12
mov r8, rsi
mov r9d, ebx
call fcn.180090870
lea r13, [rsp + 0x80]
mov rcx, r13
mov rdx, r12
mov r8, qword [rsp + 0x220]
mov r9, qword [rsp + 0x228]
call fcn.180091b50
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
lea rcx, [rsp + 0x90]
mov rdx, rdi
mov r8, rbp
mov r9, r14
call fcn.180091e40
mov rax, qword [rsp + 0x230]
movdqu xmm0, xmmword [rax]
pcmpeqb xmm0, xmmword [rsp + 0x90]
pmovmskb eax, xmm0
xor ecx, ecx
cmp eax, 0xffff
setne cl
jne 0x180092343
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov eax, dword [rsp + 0x8c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x7c], eax
mov rsi, rbp
and rsi, 0xfffffffffffffff0
mov dword [rsp + 0x6c], ecx
je 0x1800922a8
xor r13d, r13d
lea r14, [rsp + 0x70]
lea r15, [rsp + 0x50]
lea r12, [rsp + 0xb0]
nop word cs:[rax + rax]
mov rcx, r14
mov rdx, r15
mov r8, r12
mov r9d, ebx
call fcn.180090870
movdqu xmm0, xmmword [rdi + r13]
pxor xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rdi + r13], xmm0
mov eax, dword [rsp + 0x7c]
bswap eax
inc eax
bswap eax
mov dword [rsp + 0x7c], eax
add r13, 0x10
cmp r13, rsi
jb 0x180092260
mov r14, rbp
and r14, 0xf
jne 0x1800922b8
jmp 0x18009233f
xor r13d, r13d
mov r14, rbp
and r14, 0xf
je 0x18009233f
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea r8, [rsp + 0xb0]
mov r9d, ebx
call fcn.180090870
and ebp, 3
cmp r14d, 4
jae 0x1800922df
xor eax, eax
jmp 0x18009231c
sub r14, rbp
lea rcx, [rdi + r13]
add rcx, 3
xor eax, eax
nop dword [rax]
movzx edx, byte [rsp + rax + 0x50]
xor byte [rcx + rax - 3], dl
movzx edx, byte [rsp + rax + 0x51]
xor byte [rcx + rax - 2], dl
movzx edx, byte [rsp + rax + 0x52]
xor byte [rcx + rax - 1], dl
movzx edx, byte [rsp + rax + 0x53]
xor byte [rcx + rax], dl
add rax, 4
cmp r14, rax
jne 0x1800922f0
test rbp, rbp
je 0x18009233f
add r13, rax
add rdi, r13
add rax, rsp
add rax, 0x50
xor ecx, ecx
movzx edx, byte [rax + rcx]
xor byte [rdi + rcx], dl
inc rcx
cmp rbp, rcx
jne 0x180092330
mov ecx, dword [rsp + 0x6c]
test ecx, ecx
sete al
add rsp, 0x1a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180092430
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rdx, qword [rcx]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
lea rax, str.cw
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rcx, qword [rcx + 0x18]
movzx edx, byte [rcx + 3]
mov r8d, edx
and r8d, 0xfffffff0
and edx, 0xf
add r8, rax
movzx eax, byte [rdx + r8]
mov byte [rcx + 3], al
ret
Function at 0x1800929d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rdx, qword [rcx]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
lea rax, [0x18010c250]
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 8]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rdx, qword [rcx + 0x10]
movzx r8d, byte [rdx + 3]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 3], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 1]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 1], r8b
mov rdx, qword [rcx + 0x18]
movzx r8d, byte [rdx + 2]
mov r9d, r8d
and r9d, 0xfffffff0
and r8d, 0xf
add r9, rax
movzx r8d, byte [r8 + r9]
mov byte [rdx + 2], r8b
mov rcx, qword [rcx + 0x18]
movzx edx, byte [rcx + 3]
mov r8d, edx
and r8d, 0xfffffff0
and edx, 0xf
add r8, rax
movzx eax, byte [rdx + r8]
mov byte [rcx + 3], al
ret
Function at 0x1800933a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
mov r12, qword [r8 + 8]
sub r12, qword [r8]
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
cmp r12, 0x10
jb 0x180093412
mov rsi, r8
mov rdi, rdx
shr r12, 4
xor r13d, r13d
lea r14, [rsp + 0x20]
lea r15, [rsp + 0x30]
nop dword [rax]
mov rax, qword [rsi]
movups xmm0, xmmword [rax + r13]
movups xmm1, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rbx]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
mov rcx, rbx
mov rdx, r14
mov r8, r15
call fcn.180093780
add r13, 0x10
dec r12
jne 0x1800933e0
mov rax, rbx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18009b940
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movups xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x70]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm0, xmmword [rcx + 0x60]
movaps xmmword [rsp + 0xa0], xmm0
movups xmm0, xmmword [rcx + 0x50]
movaps xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [rcx + 0x40]
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm3
movaps xmmword [rsp + 0x60], xmm2
movaps xmmword [rsp + 0x50], xmm1
mov eax, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + rax*8 - 0x38]
mov r9, qword [rsp + rax*8 + 0x30]
mov r10, r8
ror r10, 1
mov r11, r8
rol r11, 0x38
xor r11, r10
mov r10, r8
mov rsi, r9
rol rsi, 0x2d
shr r10, 7
mov rdi, r9
rol rdi, 3
xor r10, r11
xor rdi, rsi
shr r9, 6
xor r9, rdi
add rcx, qword [rsp + rax*8 + 8]
add rcx, r10
add rcx, r9
mov qword [rsp + rax*8 + 0x40], rcx
inc rax
mov rcx, r8
cmp rax, 0x50
jne 0x18009b9b0
mov rax, qword [rdx]
mov rbp, qword [rdx + 8]
mov rsi, qword [rdx + 0x10]
mov rcx, qword [rdx + 0x18]
mov r14, qword [rdx + 0x20]
mov r9, qword [rdx + 0x28]
mov r10, qword [rdx + 0x30]
mov r8, qword [rdx + 0x38]
xor r12d, r12d
lea r13, [0x18010d6b0]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x30], r10
mov rbx, rax
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rcx
nop word [rax + rax]
mov r15, r10
mov r10, r9
mov r9, r14
mov r14, rcx
mov rcx, rsi
mov rsi, rbp
mov rbp, r9
rol rbp, 0x32
mov rdi, r9
rol rdi, 0x2e
xor rdi, rbp
mov rbp, r9
rol rbp, 0x17
xor rbp, rdi
mov rdi, r10
and rdi, r9
add rdi, r8
mov r8, r9
not r8
and r8, r15
add r8, rdi
add r8, rbp
add r8, qword [r12 + r13]
add r8, qword [rsp + r12 + 0x40]
mov rbp, rbx
mov rdi, rbx
rol rdi, 0x24
rol rbx, 0x1e
xor rbx, rdi
mov rdi, rbp
rol rdi, 0x19
xor rdi, rbx
mov r11, rcx
xor r11, rsi
and r11, rbp
mov rbx, rcx
and rbx, rsi
xor rbx, r11
add rbx, rdi
add r14, r8
add rbx, r8
add r12, 8
mov r8, r15
cmp r12, 0x280
jne 0x18009ba60
add rax, rbx
mov qword [rdx], rax
mov rax, qword [rsp + 8]
add rax, rbp
mov qword [rdx + 8], rax
mov rax, qword [rsp + 0x10]
add rax, rsi
mov qword [rdx + 0x10], rax
mov rax, qword [rsp + 0x18]
add rax, rcx
mov qword [rdx + 0x18], rax
mov rax, qword [rsp + 0x20]
add rax, r14
mov qword [rdx + 0x20], rax
mov rax, qword [rsp + 0x28]
add rax, r9
mov qword [rdx + 0x28], rax
mov rax, qword [rsp + 0x30]
add rax, r10
mov qword [rdx + 0x30], rax
mov rax, qword [rsp + 0x38]
add rax, r15
mov qword [rdx + 0x38], rax
add rsp, 0x2c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret