joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180177df0
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1d8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r15d, r9d
mov ebp, r8d
mov r13, rdx
mov rdi, rcx
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0x250]
xor ebx, ebx
mov dword [rax], ebx
call fcn.1801563c0
mov r8, r14
mov rdx, r13
mov rcx, rdi
call fcn.1801550e0
test al, al
je 0x180152981
mov rcx, qword [rdi + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x180152981
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x4c], ebx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov edx, 0xffff
lea r8d, [rbx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [0x180388cbc]
test eax, eax
je 0x180152867
cmp eax, ebp
jl 0x180152867
cmp eax, r15d
jg 0x180152867
inc eax
mov esi, ebp
cmp eax, r15d
cmovle esi, eax
jmp 0x180152873
mov edx, r15d
mov ecx, ebp
call fcn.1800df810
mov esi, eax
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x50]
call fcn.180211600
lea rcx, [rsp + 0x50]
call fcn.1800deb00
nop
mov ebx, esi
lea rcx, [r13 + 0xf40]
call fcn.1800d6d80
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
lea r9, [rsp + 0x30]
mov r8, rax
movzx edx, bx
mov qword [rsp + 0x20], rcx
mov rcx, rdi
cmp byte [r13 + 0xfd8], 0
je 0x1801528cc
call fcn.1801536f0
jmp 0x1801528d1
call fcn.1801535c0
test al, al
jne 0x18015291c
lea eax, [rbx + 1]
mov ebx, ebp
cmp eax, r15d
cmovle ebx, eax
cmp ebx, esi
jne 0x180152892
mov rax, qword [r14]
lea rdx, str.Failed_to_find_usable_port_in_range
mov rcx, r14
call qword [rax + 0x28]
mov r8d, ebp
lea rdx, str.startingPort
mov rcx, r14
call fcn.180106220
mov r8d, r15d
lea rdx, str.endingPort
mov rcx, r14
call fcn.180106220
xor bl, bl
jmp 0x180152972
mov r8d, ebx
lea rdx, str.port
mov rcx, r14
call fcn.180106220
mov rax, qword [rsp + 0x38]
mov dword [rax], ebx
mov edx, dword [rsp + 0x240]
mov rcx, qword [rdi + 0x298]
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
jns 0x180152969
mov rax, qword [r14]
lea rdx, str.Failed_to_listen_on_socket.
mov rcx, r14
call qword [rax + 0x28]
mov rcx, rdi
call fcn.1801563c0
xor bl, bl
jmp 0x180152972
mov byte [rdi + 0x291], 1
mov bl, 1
lea rcx, [rsp + 0x50]
call fcn.1800deb30
movzx eax, bl
jmp 0x180152983
xor al, al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x1d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp dword [rcx + 0xf80], 1
je 0x180177dfc
xor al, al
ret
add rcx, 0xbe0
jmp 0x1801527a0
Function at 0x180177e10
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
jne 0x180153204
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x48
ret
test dl, dl
mov dword [rsp + 0x30], 1
mov edx, 0xffff
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 8
jne 0x180153235
lea r9, [rsp + 0x34]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x48
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
movzx esi, dl
mov rbx, rcx
jne 0x180177e49
mov rax, qword [rcx + 0xf70]
test rax, rax
je 0x180177e7b
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x180177e90
xor ecx, ecx
call fcn.1800c57e0
cmp dword [rbx + 0xf80], 2
mov r8, rdi
movzx edx, sil
jne 0x180177eb3
lea rcx, [rbx + 0x220]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1801d3a20
cmp dword [rcx + 0xf80], 2
jne 0x180177e50
add rcx, 0x220
call fcn.1801d4880
test rax, rax
je 0x180177e50
mov r8, rdi
movzx edx, sil
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1801e3e20
lea rcx, [rbx + 0xbe0]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1801531d0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
movzx ebp, dl
mov rbx, rcx
xor dil, dil
call fcn.1800ba710
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x1801c42fc
mov r8, rsi
movzx edx, bpl
call 0x1801531d0
jmp 0x1801c4311
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1801c4314
mov r8, rsi
movzx edx, bpl
call fcn.180177e10
movzx edi, al
mov rcx, rbx
call fcn.1800ba690
mov rbx, qword [rsp + 0x30]
movzx eax, dil
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
add rcx, 0x18
jmp 0x1801c42c0
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r8
movzx edi, dl
mov rbx, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1801035a0
nop
lea rcx, [rbx + 0x670]
mov r8, rsi
movzx edx, dil
call 0x1801c42c0
movzx ebx, al
lea rcx, [rsp + 0x28]
call fcn.180103680
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1801794b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
movzx esi, dl
mov rbx, rcx
jne 0x1801794e9
mov rax, qword [rcx + 0xf70]
test rax, rax
je 0x18017951b
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x180179530
xor ecx, ecx
call fcn.1800c57e0
cmp dword [rbx + 0xf80], 2
mov rdx, rdi
jne 0x180179609
lea rcx, [rbx + 0x220]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1801d4d40
cmp dword [rcx + 0xf80], 2
jne 0x1801794f0
add rcx, 0x220
call fcn.1801d4880
test rax, rax
je 0x1801794f0
mov rdx, rdi
mov rcx, rax
call fcn.1801dc150
test al, al
je 0x1801795de
test sil, sil
jne 0x18017955f
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi + 0x161], 0
je 0x180179578
mov rax, qword [rdi]
lea rdx, str.Checking_SSH_channel...
mov rcx, rdi
call qword [rax + 0x30]
cmp qword [rbx + 0xf70], 0
je 0x18017959d
mov eax, dword [rbx + 0xf78]
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp dword [rbx + 0xf80], 2
jne 0x1801795c7
lea rcx, [rbx + 0x220]
call fcn.1801d4870
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
test eax, eax
setne al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi + 0x161], 0
je 0x1801795f7
mov rax, qword [rdi]
lea rdx, str.SSH_tunnel_is_not_connected.
mov rcx, rdi
call qword [rax + 0x30]
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0xbe0]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180158850
add rcx, 0x18
jmp fcn.1801c4ba0

Function at 0x180179720
Capabilities:
Get socket status

Disassembly:
mov rax, qword [rcx + 0xf70]
test rax, rax
je 0x180179734
mov rcx, rax
jmp fcn.1801df030
cmp dword [rcx + 0xf80], 2
jne 0x180179749
add rcx, 0x220
jmp fcn.1801d49d0
add rcx, 0xbe0
jmp fcn.180157c80
Function at 0x180179890
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 0x298]
cmp rcx, 0xffffffffffffffff
je 0x180157e57
test dl, dl
mov dword [rsp + 0x30], 1
mov edx, 0xffff
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 4
jne 0x180157e51
lea r9, [rsp + 0x34]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x48
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
movzx edi, dl
mov rbx, rcx
jne 0x1801798c1
mov rax, qword [rcx + 0xf70]
test rax, rax
je 0x1801798eb
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x180179900
xor ecx, ecx
call fcn.1800c57e0
cmp dword [rbx + 0xf80], 2
jne 0x180179923
lea rcx, [rbx + 0x220]
movzx edx, dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1801d49f0
cmp dword [rcx + 0xf80], 2
jne 0x1801798c8
add rcx, 0x220
call fcn.1801d4880
test rax, rax
je 0x1801798c8
mov rcx, rax
call fcn.1801da820
mov rcx, rax
movzx edx, dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180157e00
lea rcx, [rbx + 0xbe0]
movzx edx, dil
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180157e00
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rbx, [rcx + 0x18]
movzx edi, dl
mov rcx, rbx
call fcn.1801c4340
test rax, rax
je 0x1801d4a22
movzx edx, dil
mov rcx, rax
call 0x180157e00
mov rcx, rbx
call fcn.1801c4830
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180179940
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xdc]
je 0x180157e8a
mov dword [rcx + 0xdc], edx
test edx, edx
je 0x180157e8a
mov rdx, r8
jmp fcn.180153870
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
mov esi, edx
mov rbx, rcx
jne 0x180179978
mov rax, qword [rcx + 0xf70]
test rax, rax
je 0x1801799a8
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x1801799bd
xor ecx, ecx
call fcn.1800c57e0
cmp dword [rbx + 0xf80], 2
jne 0x1801799cf
lea rcx, [rbx + 0x220]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1801d4a30
cmp dword [rcx + 0xf80], 2
jne 0x18017997f
add rcx, 0x220
call fcn.1801d4880
test rax, rax
je 0x18017997f
mov rcx, rax
call fcn.1801da820
mov rcx, rax
jmp 0x1801799d6
lea rcx, [rbx + 0xbe0]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x180157e70
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x18]
mov rbx, r8
mov rcx, rdi
mov esi, edx
call fcn.1801c4340
test rax, rax
jne 0x1801d4a75
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [str.No_socket_connection.]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x28]
mov r8, rbx
mov edx, esi
mov rcx, rax
call 0x180157e70
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1801c4830
Function at 0x1801799f0
Capabilities:
Set socket configuration

Disassembly:
cmp edx, dword [rcx + 0xd8]
je 0x180157eaa
mov dword [rcx + 0xd8], edx
test edx, edx
je 0x180157eaa
mov rdx, r8
jmp fcn.180153920
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0xc64d29ea
mov rdi, r8
mov esi, edx
mov rbx, rcx
jne 0x180179a28
mov rax, qword [rcx + 0xf70]
test rax, rax
je 0x180179a58
cmp dword [rax + 0x3c], 0xc64d29ea
je 0x180179a6d
xor ecx, ecx
call fcn.1800c57e0
cmp dword [rbx + 0xf80], 2
jne 0x180179a7f
lea rcx, [rbx + 0x220]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1801d4aa0
cmp dword [rcx + 0xf80], 2
jne 0x180179a2f
add rcx, 0x220
call fcn.1801d4880
test rax, rax
je 0x180179a2f
mov rcx, rax
call fcn.1801da820
mov rcx, rax
jmp 0x180179a86
lea rcx, [rbx + 0xbe0]
mov r8, rdi
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x180157e90
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rdi, [rcx + 0x18]
mov rbx, r8
mov rcx, rdi
mov esi, edx
call fcn.1801c4340
test rax, rax
jne 0x1801d4ae5
mov rax, qword [rbx]
mov rcx, rbx
mov rdx, qword [str.No_socket_connection.]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x28]
mov r8, rbx
mov edx, esi
mov rcx, rax
call 0x180157e90
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1801c4830
Function at 0x180179da0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
mov edi, r9d
mov rsi, qword [rsp + 0x88]
mov r12d, r8d
mov r15, rdx
mov byte [rbx], 0
cmp byte [rsi + 0x10], 0
jne 0x180179df5
mov rcx, qword [rsp + 0x90]
mov rdx, qword [str.Internal_error:_Socket_IO_params_not_valid.__Contact_support_chilkatsoft.com]
mov rax, qword [rcx]
call qword [rax + 0x28]
xor al, al
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
lea rbp, [rcx - 0x88]
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x78], r14
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x88], rbp
test r9d, r9d
jne 0x180179e6c
mov rax, qword [rcx + 0xee8]
mov r8, r14
mov rdx, rsi
test rax, rax
je 0x180179e3c
mov rcx, rax
call fcn.1801df030
jmp 0x180179e5f
cmp dword [rcx + 0xef8], 2
jne 0x180179e53
add rcx, 0x198
call fcn.1801d49d0
jmp 0x180179e5f
add rcx, 0xb58
call fcn.180157c80
test al, al
je 0x180179f41
mov edi, 0x7530
mov rcx, r15
call fcn.1800be430
mov r9d, edi
mov qword [rsp + 0x28], r14
mov r8d, r12d
mov qword [rsp + 0x20], rsi
mov rdx, r15
mov rcx, rbp
mov r13d, eax
call fcn.180179aa0
movzx ebp, al
test al, al
je 0x180179f41
mov rcx, r15
call fcn.1800be430
cmp eax, r13d
jbe 0x180179ebc
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + ioctlsocket]
mov byte [rbx], al
mov al, 1
jmp 0x180179f43
call sub.KERNEL32.dll_GetTickCount
mov r12d, eax
xor ebx, ebx
mov rcx, r15
call fcn.1800be430
cmp eax, r13d
jne 0x180179f14
cmp ebx, edi
jae 0x180179f14
mov r8d, dword [rsp + 0x70]
mov r9d, edi
mov rcx, qword [rsp + 0x88]
mov rdx, r15
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rsi
call fcn.180179aa0
movzx ebp, al
call sub.KERNEL32.dll_GetTickCount
mov ebx, eax
cmp eax, r12d
jb 0x180179f41
sub ebx, r12d
cmp ebx, edi
jae 0x180179f2d
test bpl, bpl
jne 0x180179ec6
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + ioctlsocket]
mov rcx, qword [rsp + 0x80]
mov byte [rcx], al
movzx eax, bpl
jmp 0x180179f43
mov rax, qword [r14]
lea rdx, str.Timed_out......
mov rcx, r14
call qword [rax + 0x28]
mov byte [rsi + 0x28], 1
xor al, al
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x18017bf10
Capabilities:
Get socket status

Disassembly:
mov rax, qword [rcx + 0xf70]
test rax, rax
je 0x18017bf24
mov rcx, rax
jmp fcn.1801e98a0
cmp dword [rcx + 0xf80], 2
jne 0x18017bf39
add rcx, 0x220
jmp fcn.1801d5460
add rcx, 0xbe0
jmp fcn.18015a110
Function at 0x180186d60
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x180388cf8], 0
mov rbx, rcx
jne 0x180186db8
cmp qword [0x180388cf0], 0
jne 0x180186ea7
lea rcx, str.ncrypt.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x180388cf0], rax
test rax, rax
jne 0x180186dc0
mov rcx, rbx
mov byte [0x180388cf8], 1
call fcn.180106a70
mov rax, qword [rbx]
lea rdx, str.Failed_to_load_ncrypt.dll
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
add rsp, 0x20
pop rbx
ret
lea rdx, str.NCryptOpenStorageProvider
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180388ce8], rax
test rax, rax
jne 0x180186e06
lea rdx, str.NCryptOpenStorageProvider_function_not_found.
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
mov byte [0x180388cf8], 1
mov qword [0x180388cf0], 0
add rsp, 0x20
pop rbx
ret
mov rcx, qword [0x180388cf0]
lea rdx, str.NCryptSignHash
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180388cd8], rax
test rax, rax
jne 0x180186e2f
lea rdx, str.NCryptSignHash_function_not_found.
jmp 0x180186de3
mov rcx, qword [0x180388cf0]
lea rdx, str.NCryptFreeObject
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180388cd0], rax
test rax, rax
je 0x180186e26
mov rcx, qword [0x180388cf0]
lea rdx, str.NCryptSetProperty
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180388ce0], rax
test rax, rax
jne 0x180186e7b
lea rdx, str.NCryptSetProperty_function_not_found.
jmp 0x180186de3
mov rcx, qword [0x180388cf0]
lea rdx, str.NCryptGetProperty
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180388cc8], rax
test rax, rax
jne 0x180186ea7
lea rdx, str.NCryptGetProperty_function_not_found.
jmp 0x180186de3
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1801966f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov eax, dword [rcx + 0x60]
movzx r9d, byte [rcx + 0x5c]
test eax, eax
jle 0x180196748
mov r8d, dword [rcx + 0x288]
mov r10d, eax
mov qword [rsp], rbx
lea rbx, [0x180379580]
nop word [rax + rax]
mov edx, r8d
mov eax, r8d
shr rdx, 0x18
xor rdx, r9
shl eax, 8
mov r8d, dword [rbx + rdx*4]
xor r8d, eax
sub r10, 1
jne 0x180196720
mov rbx, qword [rsp]
mov dword [rcx + 0x288], r8d
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r8, dword [rcx + 0x60]
mov edx, r8d
sub edx, 1
je 0x180196828
sub edx, 1
je 0x18019681a
cmp edx, 1
je 0x1801967e0
mov byte [r8 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r9b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r9b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r9b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r9b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
add rsp, 8
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r9b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r9b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r9b
inc dword [rcx + 0x6c]
add rsp, 8
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r9b
jmp 0x1801967ff
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r9b
inc dword [rcx + 0x6c]
add rsp, 8
ret
Function at 0x18019dbb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xdc0]
sub rsp, 0xec0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xf00], rbx
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rbp + 0xdb0], rax
mov ebx, r9d
mov r15, r8
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], rcx
mov r13, qword [rbp + 0xe28]
test r13, r13
jne 0x18019dc0f
xor al, al
jmp 0x18019de59
mov esi, 0x40
mov r14d, dword [rbp + 0xe20]
lea eax, [r14 - 2]
mov ecx, pe_nt_image_headers64
cmp eax, 1
cmovbe esi, ecx
mov ecx, r14d
call fcn.1800eec90
movsxd r12, eax
cmp ebx, esi
jle 0x18019dc57
lea r9, [rbp + 0xc70]
mov r8d, r14d
mov edx, ebx
mov rcx, r15
call fcn.1800ee4d0
lea r15, [rbp + 0xc70]
mov ebx, r12d
mov edi, esi
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0xb50]
call fcn.180211600
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0xbe0]
call fcn.180211600
mov eax, esi
cmp ebx, esi
cmovle eax, ebx
movsxd rbx, eax
mov r8, rbx
mov rdx, r15
lea rcx, [rbp + 0xb50]
call fcn.180210e90
mov r8, rbx
mov rdx, r15
lea rcx, [rbp + 0xbe0]
call fcn.180210e90
xor ecx, ecx
mov eax, ecx
movdqa xmm2, xmmword [str.6666666666666666_]
movdqa xmm3, xmmword [0x1802b8470]
nop dword [rax]
movdqu xmm0, xmmword [rbp + rax + 0xb50]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0xb50], xmm1
movdqu xmm0, xmmword [rbp + rax + 0xbe0]
pxor xmm0, xmm3
movdqu xmmword [rbp + rax + 0xbe0], xmm0
movdqu xmm0, xmmword [rbp + rax + 0xb60]
pxor xmm0, xmm2
movdqu xmmword [rbp + rax + 0xb60], xmm0
movdqu xmm0, xmmword [rbp + rax + 0xbf0]
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0xbf0], xmm1
movdqu xmm0, xmmword [rbp + rax + 0xb70]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0xb70], xmm1
movdqu xmm0, xmmword [rbp + rax + 0xc00]
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0xc00], xmm1
movdqu xmm0, xmmword [rbp + rax + 0xb80]
pxor xmm0, xmm2
movdqu xmmword [rbp + rax + 0xb80], xmm0
movdqu xmm0, xmmword [rbp + rax + 0xc10]
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0xc10], xmm1
add ecx, 0x40
add rax, 0x40
cmp rax, rdi
jl 0x18019dcc0
movsxd rax, ecx
cmp rax, rdi
jge 0x18019ddb8
nop dword [rax]
xor byte [rbp + rax + 0xb50], 0x36
xor byte [rbp + rax + 0xbe0], 0x5c
inc rax
cmp rax, rdi
jl 0x18019dda0
lea rcx, [rsp + 0x40]
call fcn.1800ba850
nop
mov dword [rbp + 0xb48], 2
lea rax, [rbp + 0xb50]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x748], esi
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x20]
mov dword [rbp + 0x74c], eax
lea r8, [rbp + 0xcb0]
mov edx, r14d
lea rcx, [rsp + 0x40]
call fcn.1800ee730
mov r8, rdi
lea rdx, [rbp + 0xbe0]
lea rcx, [rbp + 0xcf0]
call fcn.180210e90
mov r8, r12
lea rcx, [rbp + 0xcf0]
add rcx, rdi
lea rdx, [rbp + 0xcb0]
call fcn.180210e90
lea edx, [r12 + rsi]
mov r9, r13
mov r8d, r14d
lea rcx, [rbp + 0xcf0]
call fcn.1800ee4d0
nop
lea rcx, [rsp + 0x40]
call fcn.1800baa80
mov al, 1
mov rcx, qword [rbp + 0xdb0]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0xf00]
add rsp, 0xec0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18019df20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbp
push rbx
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rax, qword [rbp + 0x210]
mov r14d, r9d
mov qword [rsp + 0x20], rax
mov ebx, r8d
mov r15, rdx
mov r13, rcx
test rax, rax
je 0x18019e152
mov qword [rsp + 0x2b8], rsi
lea eax, [r9 - 2]
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x2b0], rdi
cmp eax, 1
mov qword [rsp + 0x2a8], r12
mov esi, 0x40
cmovbe esi, ecx
mov ecx, r14d
call fcn.1800eec90
movsxd r12, eax
cmp ebx, esi
jle 0x18019dfbd
lea r9, [rbp + 0x50]
mov r8d, r14d
mov edx, ebx
mov rcx, r15
call fcn.1800ee4d0
lea r15, [rbp + 0x50]
mov ebx, r12d
mov r8d, esi
lea rcx, [rsp + 0x30]
xor edx, edx
mov edi, esi
call fcn.180211600
mov r8d, esi
lea rcx, [rbp - 0x40]
xor edx, edx
call fcn.180211600
cmp ebx, esi
lea rcx, [rsp + 0x30]
mov eax, esi
mov rdx, r15
cmovle eax, ebx
movsxd rbx, eax
mov r8, rbx
call fcn.180210e90
mov r8, rbx
lea rcx, [rbp - 0x40]
mov rdx, r15
call fcn.180210e90
movdqa xmm2, xmmword [str.6666666666666666_]
xor ecx, ecx
movdqa xmm3, xmmword [0x1802b8470]
mov eax, ecx
nop dword [rax]
movdqu xmm0, xmmword [rsp + rax + 0x30]
add ecx, 0x40
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x30], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x40]
pxor xmm0, xmm3
movdqu xmmword [rbp + rax - 0x40], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x40]
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x40], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x30]
pxor xmm0, xmm3
movdqu xmmword [rbp + rax - 0x30], xmm0
movdqu xmm0, xmmword [rsp + rax + 0x50]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x20]
movdqu xmmword [rsp + rax + 0x50], xmm1
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqu xmm0, xmmword [rsp + rax + 0x60]
movdqu xmmword [rbp + rax - 0x20], xmm1
pxor xmm0, xmm2
movdqu xmmword [rsp + rax + 0x60], xmm0
movdqu xmm0, xmmword [rbp + rax - 0x10]
pxor xmm0, xmm3
movdqu xmmword [rbp + rax - 0x10], xmm0
add rax, 0x40
cmp rax, rdi
jl 0x18019e020
movsxd rax, ecx
cmp rax, rdi
jge 0x18019e0d2
xor byte [rsp + rax + 0x30], 0x36
xor byte [rbp + rax - 0x40], 0x5c
inc rax
cmp rax, rdi
jl 0x18019e0c0
lea rax, [rsp + 0x30]
mov dword [r13 + 0x808], esi
lea r8, [rbp + 0x90]
mov qword [r13 + 8], rax
mov edx, r14d
mov rcx, r13
call fcn.1800ee730
mov r8, rdi
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0xd0]
call fcn.180210e90
lea rcx, [rbp + 0xd0]
mov r8, r12
add rcx, rdi
lea rdx, [rbp + 0x90]
call fcn.180210e90
mov r9, qword [rsp + 0x20]
lea edx, [r12 + rsi]
mov r8d, r14d
lea rcx, [rbp + 0xd0]
call fcn.1800ee4d0
mov r12, qword [rsp + 0x2a8]
mov al, 1
mov rdi, qword [rsp + 0x2b0]
mov rsi, qword [rsp + 0x2b8]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop rbx
pop rbp
ret