joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00550060]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0054fdf1], 0
je 0x458eb6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005503a0]
aesenc xmm0, xmmword [0x005503b0]
aesenc xmm0, xmmword [0x005503c0]
movq rax, xmm0
ret
jmp 0x408640

Function at 0x45a860
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00550320]
mov qword [rsp + 8], rdx
lea r8d, [0x0054fe08]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00458d60
add rsp, 0x30
ret

Function at 0x45ada0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45adcc
call fcn.00458d60
shl rcx, 3
add rcx, 0x1480
mov qword [0x0054ffc8], rcx
ret

Function at 0x466880
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4668eb
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4668a4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4668c1
cmp rdx, 0
je 0x46690d
test rdx, 0xf
je 0x46689d
test rdx, 7
jne 0x4668c1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x46689d
ret
Function at 0x468ac0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x468aff
jb 0x468b14
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x468b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x468c50
jb 0x468caf
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00468a60
aeskeygenassist xmm1, xmm0, 1
call fcn.00468a80
aeskeygenassist xmm1, xmm2, 2
call fcn.00468a60
aeskeygenassist xmm1, xmm0, 2
call fcn.00468a80
aeskeygenassist xmm1, xmm2, 4
call fcn.00468a60
aeskeygenassist xmm1, xmm0, 4
call fcn.00468a80
aeskeygenassist xmm1, xmm2, 8
call fcn.00468a60
aeskeygenassist xmm1, xmm0, 8
call fcn.00468a80
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00468a60
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00468a80
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00468a60
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00468a80
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00468a60
jmp 0x468d1d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004689c0
aeskeygenassist xmm1, xmm2, 2
call fcn.00468a20
aeskeygenassist xmm1, xmm2, 4
call fcn.004689c0
aeskeygenassist xmm1, xmm2, 8
call fcn.00468a20
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004689c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00468a20
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004689c0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00468a20
jmp 0x468d1d
aeskeygenassist xmm1, xmm0, 1
call fcn.00468980
aeskeygenassist xmm1, xmm0, 2
call fcn.00468980
aeskeygenassist xmm1, xmm0, 4
call fcn.00468980
aeskeygenassist xmm1, xmm0, 8
call fcn.00468980
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00468980
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00468980
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00468980
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00468980
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00468980
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00468980
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x468d2a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x469680
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4698bc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
call fcn.004678e0
xorps xmm15, xmm15
mov r14, qword [0x0054ffc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
add qword [rcx + 0x68], rax
mov rdx, qword [rcx + 0x60]
test rdx, rdx
jle 0x4697ca
nop
cmp rdx, 0x40
ja 0x4698ae
lea rsi, [rdx - 0x40]
mov rdi, rsi
neg rsi
cmp rax, rsi
cmovl rsi, rax
mov qword [rsp + 0x28], rsi
sar rdi, 0x3f
and rdi, rdx
lea rdx, [rdi + 0x20]
add rdx, rcx
mov rbx, qword [rsp + 0x60]
cmp rbx, rdx
je 0x469739
mov rax, rdx
mov rcx, rsi
nop
call fcn.00459d20
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdx, qword [rcx + 0x60]
add rdx, rsi
mov qword [rcx + 0x60], rdx
cmp rdx, 0x40
jne 0x4697a1
mov qword [rsp], rcx
lea rax, [rcx + 0x20]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.00469ce0
xorps xmm15, xmm15
mov r14, qword [0x0054ffc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x60], 0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
cmp rax, rsi
jb 0x4698a3
mov rdi, qword [rsp + 0x70]
sub rdi, rsi
mov rdx, rax
sub rax, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x4697d7
mov rdx, rax
mov rbx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
cmp rax, 0x40
jl 0x469857
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
and rax, 0xffffffffffffffc0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], r8
call fcn.00469ce0
xorps xmm15, xmm15
mov r14, qword [0x0054ffc8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rdx, qword [rsp + 0x68]
mov rax, rcx
mov rcx, qword [rsp + 0x58]
test rax, rax
je 0x469892
cmp rax, 0x40
mov esi, 0x40
cmovl rsi, rax
lea rax, [rcx + 0x20]
cmp rbx, rax
je 0x46988e
mov qword [rsp + 0x38], rsi
mov rcx, rsi
call fcn.00459d20
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rcx + 0x60], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rcx, rax
mov rax, rsi
call fcn.00459480
mov rax, rdx
mov ecx, 0x40
call fcn.00459480
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00456d80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00469680
Function at 0x469b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x469ca6
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movups xmmword [rsp + 0x98], xmm15
movups xmmword [rsp + 0xa8], xmm15
mov rcx, qword [rax + 0x68]
mov rsi, rcx
and ecx, 0x3f
lea r8, [rcx - 0x38]
neg r8
lea r9, [rcx - 0x78]
neg r9
cmp rcx, 0x38
cmovb r9, r8
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x78], xmm15
mov byte [rsp + 0x40], pe_nt_image_headers64
lea rcx, [r9 + 8]
nop
cmp rcx, 0x48
ja 0x469c96
cmp r9, rcx
ja 0x469c8e
mov qword [rsp + 0xb8], rax
shl rsi, 3
lea rdx, [r9 - 0x48]
sar rdx, 0x3f
and r9, rdx
bswap rsi
mov qword [rsp + r9 + 0x40], rsi
lea rbx, [rsp + 0x40]
mov edi, 0x48
nop dword [rax]
call fcn.00469680
mov rdx, qword [rsp + 0xb8]
cmp qword [rdx + 0x60], 0
jne 0x469c7b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
mov eax, dword [rdx]
bswap eax
mov dword [rsp + 0x20], eax
mov eax, dword [rdx + 4]
bswap eax
mov dword [rsp + 0x24], eax
mov eax, dword [rdx + 8]
bswap eax
mov dword [rsp + 0x28], eax
mov eax, dword [rdx + 0xc]
bswap eax
mov dword [rsp + 0x2c], eax
mov eax, dword [rdx + 0x10]
bswap eax
mov dword [rsp + 0x30], eax
mov eax, dword [rdx + 0x14]
bswap eax
mov dword [rsp + 0x34], eax
mov eax, dword [rdx + 0x18]
bswap eax
mov dword [rsp + 0x38], eax
cmp byte [rdx + 0x70], 0
jne 0x469c51
mov eax, dword [rdx + 0x1c]
bswap eax
mov dword [rsp + 0x3c], eax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x98], xmm0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0xa8], xmm0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
lea rax, [0x00474a20]
lea rbx, [0x00499dc0]
call fcn.0042fac0
mov rax, r9
call fcn.004594a0
mov edx, 0x48
nop dword [rax + rax]
call fcn.00459420
nop
mov qword [rsp + 0x28], rax
call fcn.00456d80
mov rax, qword [rsp + 0x28]
jmp fcn.00469b20
Function at 0x1800280f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18026d300]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1802786e0]
mov edi, ecx
cmp byte [rbx + 0x4235], 0
jne 0x180028151
cmp byte [rbx + 0x4236], 0
jne 0x180028151
movsx r9d, word [rbx + 0x531a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.180019990
test dil, 1
je 0x180028278
jmp 0x1800281da
movss xmm1, dword [rbx + 0x3890]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x531a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x18023d5c8]
mulss xmm1, dword [0x18023d5bc]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xdf4]
addss xmm1, dword [rbx + 0xdf8]
mov qword [rbx + 0x3fa0], rax
mov dword [rbx + 0x3f8c], 1
movss dword [rbx + 0x3f98], xmm0
movss dword [rbx + 0x3f9c], xmm1
movss xmm0, dword [rbx + 0x38ec]
mulss xmm0, dword [0x18023d268]
or dword [rbx + 0x3f88], 0x41
movss dword [rbx + 0x3fe8], xmm0
call fcn.180019990
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180028230
lea r11, [0x180209e20]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x180028213
cmp byte [r8], r9b
jne 0x180028213
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180028200
not ecx
call fcn.180021310
test rax, rax
je 0x180028278
cmp byte [rax + 0x96], 0
je 0x180028278
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x531a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x531a]
call fcn.180019990
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.180023aa0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801c0bb0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x18002ca70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53c8], 0
lea rbx, [rcx + 0x53d0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18002cb17
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x18002caca
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18002e9e0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.18001a2a0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53c8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53d8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1802786d8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18002cb1f
mov rcx, rbx
call fcn.18001a2a0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180082b90
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x18026d300]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rsi, rcx
mov qword [rsp + 0x80], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov dword [rsp + 0x20], 1
mov rcx, qword [0x1802786f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
mov rcx, qword [0x1802786f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rcx, dword [rax + 0x3c]
movzx ebp, word [rcx + rbx + 6]
mov rcx, qword [0x1802786f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
mov rcx, qword [0x1802786f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rdi, dword [rax + 0x3c]
add rdi, rbx
mov rcx, qword [0x1802786f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
mov rcx, qword [0x1802786f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsxd rcx, dword [rax + 0x3c]
movzx eax, word [rcx + rbx + 0x14]
lea rbx, [rdi + 0x18]
add rbx, rax
cmp r14w, bp
jae 0x180082d51
mov edi, ebp
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov qword [rsp + 0x98], r14
mov qword [rsp + 0xa0], r14
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x180082c92
mov rdx, rbx
lea rcx, [rsp + 0x88]
call fcn.18005b090
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.18005ec40
movups xmm2, xmmword [rbx]
movaps xmmword [rsp + 0x50], xmm2
movups xmm3, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0x60], xmm3
movsd xmm4, qword [rbx + 0x20]
movsd qword [rsp + 0x70], xmm4
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x180082d1d
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rdx], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
movups xmmword [rdx + 0x20], xmm2
movups xmmword [rdx + 0x30], xmm3
movsd qword [rdx + 0x40], xmm4
add qword [rsi + 8], 0x48
jmp 0x180082d2b
lea r8, [rsp + 0x30]
mov rcx, rsi
call fcn.18009d180
nop
lea rcx, [rsp + 0x30]
call fcn.18005eec0
nop
lea rcx, [rsp + 0x88]
call fcn.18005eec0
add rbx, 0x28
sub rdi, 1
jne 0x180082c70
mov rax, rsi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1801c0bb0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180082d80
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18026d300]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x30], rdx
xor r13d, r13d
lea rcx, [rsp + 0x40]
call fcn.180082b90
nop
mov rdi, qword [rsp + 0x40]
mov rbx, rdi
mov rbp, qword [rsp + 0x48]
cmp rdi, rbp
je 0x180082e18
mov r15, qword [rsi + 0x18]
mov r12, qword [rsi + 0x10]
nop dword [rax + rax]
mov rdx, rsi
cmp r15, 0xf
jbe 0x180082dec
mov rdx, qword [rsi]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180082dfd
mov rcx, qword [rbx]
cmp r8, r12
jne 0x180082e0f
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180082e97
add rbx, 0x48
cmp rbx, rbp
jne 0x180082de0
test rdi, rdi
je 0x180082f5d
cmp rdi, rbp
je 0x180082e3c
mov rcx, rdi
call fcn.18005eec0
add rdi, 0x48
cmp rdi, rbp
jne 0x180082e26
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
sub rcx, rdi
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*8]
shl rdx, 3
mov rax, rdi
cmp rdx, 0x1000
jb 0x180082f55
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180082f55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, rbx
mov rcx, r14
call fcn.18005ec40
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [r14 + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [r14 + 0x30], xmm1
movsd xmm0, qword [rbx + 0x40]
movsd qword [r14 + 0x40], xmm0
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x180082fae
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x180082eed
mov rcx, rbx
call fcn.18005eec0
add rbx, 0x48
cmp rbx, rdi
jne 0x180082ed7
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
sub rcx, rbx
movabs rax, 0xe38e38e38e38e39
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*8]
shl rdx, 3
mov rax, rbx
cmp rdx, 0x1000
jb 0x180082f3d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180082e90
mov rcx, rbx
call fcn.1801c0ca0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r13
jmp 0x180082fae
mov rcx, rdi
call fcn.1801c0ca0
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Memcury::PE::Section::GetSection
lea rdx, str.Section_not_found
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14 + 0x20], xmm0
movups xmmword [r14 + 0x30], xmm0
mov qword [r14 + 0x40], rax
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r14], al
mov rcx, rsi
call fcn.18005eec0
mov rax, r14
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801c0bb0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800ac6d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov rdi, r8
mov r14, rdx
mov r8, qword [r8 + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800ac6fa
mov rdx, qword [rdi]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
test r8, r8
je 0x1800ac733
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x1800ac720
mov r9, rbx
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.1800acca0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1800ac75a
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1800ac91b
movabs rax, 0x492492492492492
cmp qword [0x18027acd0], rax
jne 0x1800ac77b
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x18027acc8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov ecx, gethostname
call fcn.1801c1444
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rdi
lea rcx, [rax + 0x10]
call fcn.18005ec40
mov rcx, qword [r15]
mov qword [rsi + 0x30], rcx
mov r8, qword [0x18027acd0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1800ac7cf
cvtsi2ss xmm0, rcx
jmp 0x1800ac7e4
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [0x18027acf8]
xorps xmm2, xmm2
test rdi, rdi
js 0x1800ac7fa
cvtsi2ss xmm2, rdi
jmp 0x1800ac812
mov rcx, rdi
shr rcx, 1
mov rax, rdi
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
movss xmm3, dword [0x18027acc0]
comiss xmm1, xmm3
seta al
test al, al
je 0x1800ac8b7
divss xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor ecx, ecx
movss xmm1, dword [0x18023d64c]
comiss xmm0, xmm1
jb 0x1800ac85d
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800ac85d
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x1800ac88f
cmp rdi, 0x200
jae 0x1800ac88c
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x1800ac88f
mov rdi, rcx
mov rdx, rdi
call fcn.1800aca20
mov r9, rbx
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x30]
call fcn.1800acca0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r8, qword [0x18027acd0]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x18027acd0], r8
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rdx], rsi
mov qword [rcx + 8], rsi
and rbx, qword [0x18027acf0]
add rbx, rbx
mov rax, qword [0x18027acd8]
mov r8, qword [rax + rbx*8]
cmp r8, qword [0x18027acc8]
jne 0x1800ac8fc
mov qword [rax + rbx*8], rsi
jmp 0x1800ac90e
cmp r8, rcx
jne 0x1800ac907
mov qword [rax + rbx*8], rsi
jmp 0x1800ac913
cmp qword [rax + rbx*8 + 8], rdx
jne 0x1800ac913
mov qword [rax + rbx*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret