joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b1a0
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rbp, r8
mov r14, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test edi, edi
je 0x18000b231
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7530
jae 0x18000b21e
mov r8d, edi
mov edx, ebx
sub r8d, ebx
add rdx, rbp
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x18000b200
add ebx, eax
jmp 0x18000b218
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x18000b218
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebx
jne 0x18000b1d1
jmp 0x18000b231
mov rcx, qword [0x18006abc8]
lea rdx, str.Log:SmbClient::SendPacket___Operation_timed_out._r_n
call fcn.180002450
mov rbp, qword [rsp + 0x38]
cmp edi, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
sete al
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18000b260
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rbp, r8
mov r14, rdx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
test edi, edi
je 0x18000b2f1
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, esi
cmp eax, 0x7530
jae 0x18000b2de
mov r8d, edi
mov edx, ebx
sub r8d, ebx
add rdx, rbp
xor r9d, r9d
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x18000b2c0
add ebx, eax
jmp 0x18000b2d8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x18000b2d8
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebx
jne 0x18000b291
jmp 0x18000b2f1
mov rcx, qword [0x18006abc8]
lea rdx, str.Log:SmbClient::ReceivePacket___Operation_timeout._r_n
call fcn.180002450
mov rbp, qword [rsp + 0x38]
cmp edi, ebx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
sete al
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18000b320
Capabilities:
Check for time delay via gettickcount
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov edi, r9d
mov r15, r8
mov rsi, rdx
mov r14, rcx
cmp r9d, 0x23
jb 0x18000b4b8
cmp r9d, dword [rcx + 0x60]
ja 0x18000b4b8
mov eax, r9d
mov qword [rsp + 0x50], rbx
bswap eax
xor ebx, ebx
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x58], rbp
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebp, eax
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebp
cmp eax, 0x7530
jae 0x18000b3c6
mov r8d, 4
mov eax, ebx
lea rdx, [rsp + 0x70]
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x18000b3a7
add ebx, eax
jmp 0x18000b3bf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x18000b3bf
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 4
jne 0x18000b370
jmp 0x18000b3e2
mov rcx, qword [0x18006abc8]
lea rdx, str.Log:SmbClient::SendPacket___Operation_timed_out._r_n
call fcn.180002450
cmp ebx, 4
jne 0x18000b498
mov r9d, edi
mov r8, r15
mov rdx, rsi
call fcn.18000b1a0
test al, al
je 0x18000b498
cmp byte [rsp + 0x78], 0
jne 0x18000b498
mov rdx, rsi
call fcn.18000b560
mov r9, rax
test rax, rax
je 0x18000b498
cmp byte [rsp + 0x88], 0
jne 0x18000b4b3
mov r8, qword [rax]
test r8, r8
je 0x18000b490
mov r10d, dword [rax + 8]
cmp r10d, 0x23
jb 0x18000b490
cmp dword [r8], 0x424d53ff
jne 0x18000b490
cmp byte [r8 + 9], 0
jge 0x18000b490
movzx eax, word [r8 + 0xa]
test ax, ax
js 0x18000b490
and eax, dword [r14 + 0x6c]
cmp eax, dword [r14 + 0x6c]
jne 0x18000b490
movzx edx, byte [r8 + 0x20]
lea r11d, [rdx*2 + 0x21]
mov ecx, r11d
add rcx, 2
cmp rcx, r10
ja 0x18000b490
movzx ecx, word [r8 + rdx*2 + 0x21]
add ecx, 2
add ecx, r11d
cmp ecx, r10d
ja 0x18000b490
movzx ecx, byte [r8 + 4]
cmp byte [r15 + 4], cl
je 0x18000b4b3
mov rcx, r9
call fcn.18000b4d0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
mov rax, r9
jmp 0x18000b49a
mov rsi, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18000b560
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov byte [rsp + 0x18], r8b
push rdi
sub rsp, 0x30
xor ebx, ebx
mov dword [rsp + 0x50], 0
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x7530
jae 0x18000b5e6
mov r8d, 4
mov eax, ebx
lea rdx, [rsp + 0x50]
sub r8d, ebx
add rdx, rax
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x18000b5c7
add ebx, eax
jmp 0x18000b5df
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x18000b5df
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp ebx, 4
jne 0x18000b590
jmp 0x18000b5fe
mov rcx, qword [0x18006abc8]
lea rdx, str.Log:SmbClient::ReceivePacket___Operation_timeout._r_n
call fcn.180002450
cmp ebx, 4
jne 0x18000b660
mov ebx, dword [rsp + 0x50]
bswap ebx
lea eax, [rbx - 0x23]
cmp eax, 0x1ffdc
ja 0x18000b660
mov ecx, ebx
call fcn.180011270
mov r9d, ebx
mov r8, rax
mov rdx, rsi
mov rdi, rax
call fcn.18000b260
test al, al
je 0x18000b656
mov ecx, reloc.WS2_32.dll_recv
call fcn.180010eb4
mov qword [rsp + 0x40], rax
mov dword [rax + 8], 0
mov dword [rax + 8], ebx
mov qword [rax], rdi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rdi
call fcn.180010c10
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18000cc90
Capabilities:
Create thread

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x180068020]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, r8
mov rsi, rcx
cmp edx, 1
jne 0x18000ce1a
movups xmm0, xmmword [str.CymulateCredsStealNSpread.dll]
mov eax, dword [0x18005f380]
lea rcx, [rsp + 0x5e]
mov dword [rsp + 0x58], eax
xor edx, edx
movzx eax, word [0x18005f384]
movaps xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x18005f378]
mov qword [0x18006abf0], r8
mov r8d, 0xe6
mov qword [r11 + 0x10], rbx
movsd qword [rsp + 0x50], xmm0
mov qword [r11 - 0x18], rbp
mov word [rsp + 0x5c], ax
call fcn.180022f00
mov ecx, 0xc0
call fcn.180010eb4
mov qword [rsp + 0x30], rax
xor ebp, ebp
mov rcx, rax
mov rbx, rax
mov qword [rax + 0x68], rbp
mov qword [rax + 0x70], rbp
mov qword [rax + 0x78], rbp
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [rsp + 0x40]
mov byte [rbx + 0xa0], 1
mov qword [rbx + 0xa8], rax
xor ecx, ecx
lea rax, str.NO_ID
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x80], rax
mov qword [rbx + 0x88], rbp
mov qword [rbx + 0x98], rbp
mov qword [rbx + 0x90], rbp
mov qword [rbx + 0x58], rbp
mov qword [rbx + 0xb8], rbp
mov byte [rbx + 0x50], bpl
mov word [rbx + 0xb0], bp
call fcn.18002c45c
mov r9, rsi
mov qword [rsp + 0x28], rbp
lea r8, [0x18000bd00]
mov dword [rbx + 0xb4], eax
xor edx, edx
mov qword [0x18006abc8], rbx
xor ecx, ecx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, qword [rsp + 0x160]
mov rbx, rax
mov qword [rsp + 0x30], rax
cmp rax, 0xffffffffffffffff
je 0x18000ce12
mov rcx, qword [0x18006abc8]
add rcx, 0x68
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x18000cdf7
mov qword [rdx], rax
add qword [rcx + 8], 8
jmp 0x18000ce01
lea r8, [rsp + 0x30]
call fcn.180008700
test rdi, rdi
je 0x18000ce12
cmp rdi, 0x12345678
je 0x18000ce12
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x188]
mov eax, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180010bf0
add rsp, 0x168
pop rdi
pop rsi
ret

Function at 0x18000ce40
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18006abc8]
cmp byte [rax + 0x50], 0
jne 0x18000ce69
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x18006abc8]
cmp byte [rax + 0x50], 0
je 0x18000ce51
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18000ce80
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x20a
call fcn.180011270
xor edx, edx
mov r8d, 0x20a
mov rcx, rax
mov rbx, rax
call fcn.180022f00
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8d, 0x104
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, str.mstsc
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x18000cef8
mov rax, qword [0x18006abc8]
cmp byte [rax + 0x50], 0
jne 0x18000cef8
nop
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x18006abc8]
cmp byte [rax + 0x50], 0
je 0x18000cee0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x18000d050
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x68
mov rax, qword [0x180068020]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov edx, 8
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
xorps xmm0, xmm0
lea rcx, [rsp + 0x48]
movups xmmword [rsp + 0x48], xmm0
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x54]
mov rax, qword [rsp + 0x40]
movzx r10d, word [rsp + 0x52]
movzx r11d, word [rsp + 0x50]
movzx r9d, word [rsp + 0x4e]
movzx r8d, word [rsp + 0x4a]
movzx edx, word [rsp + 0x48]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], ecx
lea rcx, str._04u_02u_02u_02u_02u_02u_llu
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r11d
call fcn.180001620
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180010bf0
add rsp, 0x68
ret
Function at 0x180012a90
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x680
mov rax, qword [0x180068020]
xor rax, rsp
mov qword [rsp + 0x670], rax
cmp dword [rdx], 0
mov r14, rdx
mov rsi, rcx
jne 0x180012c0b
xor r15d, r15d
nop
mov rcx, rsi
call fcn.1800143e0
xor edx, edx
lea rcx, [rsp + 0x250]
mov r8d, 0x208
mov rdi, rax
call fcn.180022f00
xor edx, edx
mov dword [rsp + 0x250], 1
mov r8d, 0x208
mov qword [rsp + 0x258], rdi
lea rcx, [rsp + 0x40]
call fcn.180022f00
xor edx, edx
mov dword [rsp + 0x40], 1
mov r8d, 0x208
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x460]
call fcn.180022f00
mov qword [rsp + 0x30], r15
mov rcx, rsi
mov dword [rsp + 0x460], 1
mov qword [rsp + 0x468], rdi
mov dword [rsp + 0x30], 2
call fcn.180015cf0
test al, 0x10
lea r8, [rsp + 0x250]
mov ebp, eax
lea rdx, [rsp + 0x40]
cmove r8, r15
lea r9, [rsp + 0x460]
mov ebx, eax
and ebp, 0x300
lea rax, [rsp + 0x30]
cmove rdx, r15
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x180012c5b
test ebp, ebp
je 0x180012bb7
lea rdx, [rsp + 0x40]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x180012bbd
and ebx, 0xfffffcff
test bl, 0x10
je 0x180012bd6
lea rdx, [rsp + 0x250]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x180012bd9
and ebx, 0xffffffef
lea rdx, [rsp + 0x460]
mov rcx, rdi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x180012bf0
or ebx, 1
test ebx, ebx
je 0x180012c02
mov edx, ebx
mov rcx, rsi
call fcn.180015af0
test eax, eax
js 0x180012c3a
cmp dword [r14], r15d
je 0x180012ad0
xor eax, eax
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.180010bf0
lea r11, [rsp + 0x680]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov rcx, rsi
call fcn.180011dc0
mov r8, rax
lea rdx, str.smb2_service_failed_with_:__s_n
mov rcx, rsi
call fcn.180011ef0
mov eax, 0xffffffff
jmp 0x180012c0d
lea rdx, str.Select_failed
mov rcx, rsi
call fcn.180011ef0
mov eax, 0xffffffff
jmp 0x180012c0d
Function at 0x180014920
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x88]
mov rdi, rdx
mov qword [r8 + 0x18], rax
mov rdx, rcx
mov rcx, qword [rcx + 0x88]
mov rbx, r8
inc rcx
mov qword [rdx + 0x88], rcx
movzx eax, word [r8 + 6]
cmp ax, 1
jbe 0x18001496a
movzx eax, ax
dec rcx
add rcx, rax
mov qword [rdx + 0x88], rcx
mov rcx, qword [rdi]
mov edx, 4
mov eax, dword [r8]
mov dword [rcx], eax
mov rcx, rdi
movzx r8d, word [r8 + 4]
call fcn.180015050
movzx r8d, word [rbx + 6]
mov edx, 6
mov rcx, rdi
call fcn.180015050
mov r8d, dword [rbx + 8]
mov edx, 8
mov rcx, rdi
call fcn.180015070
movzx r8d, word [rbx + 0xc]
mov edx, reloc.WS2_32.dll_inet_ntoa
mov rcx, rdi
call fcn.180015050
movzx r8d, word [rbx + 0xe]
mov edx, recv
mov rcx, rdi
call fcn.180015050
mov r8d, dword [rbx + 0x10]
mov edx, reloc.WS2_32.dll_recv
mov rcx, rdi
call fcn.180015070
mov r8d, dword [rbx + 0x14]
mov edx, socket
mov rcx, rdi
call fcn.180015070
mov r8, qword [rbx + 0x18]
mov edx, 0x18
mov rcx, rdi
call fcn.180015090
test byte [rbx + 0x10], 2
mov edx, 0x20
mov rcx, rdi
je 0x180014a17
mov r8, qword [rbx + 0x20]
call fcn.180015090
jmp 0x180014a31
mov r8d, dword [rbx + 0x20]
call fcn.180015070
mov r8d, dword [rbx + 0x24]
mov edx, 0x24
mov rcx, rdi
call fcn.180015070
mov r8, qword [rbx + 0x28]
mov edx, 0x28
mov rcx, rdi
call fcn.180015090
movups xmm0, xmmword [rbx + 0x30]
mov rax, qword [rdi]
mov rbx, qword [rsp + 0x30]
movups xmmword [rax + 0x30], xmm0
add rsp, 0x20
pop rdi
ret

Function at 0x1800150d0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
add rsp, 0x28
ret

Function at 0x180015100
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, [0x18004b154]
call qword [sym.imp.WS2_32.dll_getprotobyname]
test rax, rax
je 0x18001514e
movsx edx, word [rax + 0x10]
lea r9, [rsp + 0x50]
mov r8d, ebx
mov dword [rsp + 0x20], 4
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
add rsp, 0x30
pop rdi
ret
Function at 0x18001aff0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0xf]
mov r8d, reloc.WS2_32.dll_recv
lea r10, [rcx + 0xf]
cmp rcx, rax
ja 0x18001b00b
xor r9d, r9d
cmp r10, rdx
jae 0x18001b01e
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx], xmm1
mov r9, r8
cmp r9, r8
jae 0x18001b040
sub rdx, rcx
lea rax, [r9 + rcx]
sub r8, r9
nop dword [rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x18001b030
ret

Function at 0x18001b460
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1e8
mov rax, qword [0x180068020]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov esi, r9d
mov rbx, r8
mov r15d, edx
mov r14, rcx
test rcx, rcx
je 0x18001b5dc
mov ecx, edx
call fcn.18001e6a0
movsxd r12, eax
mov ecx, r15d
mov dword [r14 + 8], r12d
call fcn.18001e6c0
mov dword [r14 + 4], eax
mov edi, eax
mov dword [r14], r15d
cmp esi, r12d
jle 0x18001b50d
mov edx, r15d
lea rcx, [rsp + 0x20]
call fcn.18001e760
test eax, eax
jne 0x18001b5dc
mov r8d, esi
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.18001e700
test eax, eax
jne 0x18001b5dc
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x20]
call fcn.18001e7c0
test eax, eax
jne 0x18001b5dc
lea rbx, [rsp + 0x190]
mov esi, edi
mov qword [rsp + 0x1e0], rbp
xor ebp, ebp
movsxd r8, esi
mov r10d, ebp
test esi, esi
jle 0x18001b569
lea rax, [rsp + 0x110]
mov r9, r14
sub rbx, rax
lea rcx, [rsp + 0x110]
sub r9, rcx
mov edi, ebp
mov r10d, esi
nop
lea rdx, [rsp + 0x110]
add rdx, rdi
inc rdi
movzx ecx, byte [rbx + rdx]
movzx eax, cl
xor cl, 0x5c
xor al, 0x36
mov byte [r9 + rdx + 0xf8], cl
mov byte [rdx], al
cmp rdi, r8
jl 0x18001b540
movsxd rax, r10d
mov r10, r12
cmp rax, r12
jge 0x18001b5a3
lea rdi, [r14 + 0xf8]
add rdi, rax
lea r9, [rsp + 0x110]
add r9, rax
sub r10, rax
mov eax, 0x5c
mov rcx, r10
rep stosb byte [rdi], al
mov rdi, r9
mov rcx, r10
mov eax, 0x36
rep stosb byte [rdi], al
mov edx, r15d
lea rcx, [r14 + 0x10]
call fcn.18001e760
test eax, eax
jne 0x18001b5cb
mov r8d, r12d
lea rdx, [rsp + 0x110]
lea rcx, [r14 + 0x10]
call fcn.18001e700
test eax, eax
je 0x18001b5d0
mov ebp, 1
mov eax, ebp
mov rbp, qword [rsp + 0x1e0]
jmp 0x18001b5e1
mov eax, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180010bf0
add rsp, 0x1e8
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x18001e240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r10, rdx
mov r9, r8
mov rdx, rcx
mov rcx, r8
call fcn.18001e2a0
mov qword [0x180069e00], r9
mov qword [0x180069e08], r10
call fcn.18001e320
add rsp, 0x28
jmp 0x18001e2d0
mov qword [rsp + 8], rbx
mov rax, qword [0x180069e00]
lea rbx, [0x180069e10]
xor r10b, r10b
movzx r11d, cl
shl r11d, 2
nop
movzx r9d, r10b
xor r8b, r8b
add r9d, r11d
shl r9d, 2
nop
movzx ecx, r8b
inc r8b
add ecx, r9d
movzx ecx, byte [rcx + rbx]
xor byte [rax], cl
inc rax
cmp r8b, 4
jb 0x18001e270
inc r10b
cmp r10b, 4
jb 0x18001e260
mov rbx, qword [rsp + 8]
ret
push rbx
sub rsp, 0x20
xor ecx, ecx
call 0x18001e240
mov bl, 1
nop
call fcn.18001e620
call fcn.18001e5c0
call fcn.18001e510
movzx ecx, bl
call 0x18001e240
inc bl
cmp bl, 0xa
jb 0x18001e2e0
call fcn.18001e620
call fcn.18001e5c0
mov cl, 0xa
add rsp, 0x20
pop rbx
jmp 0x18001e240

Function at 0x18001e2d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r10, rdx
mov r9, r8
mov rdx, rcx
mov rcx, r8
call fcn.18001e2a0
mov qword [0x180069e00], r9
mov qword [0x180069e08], r10
call fcn.18001e320
add rsp, 0x28
jmp 0x18001e2d0
mov qword [rsp + 8], rbx
mov rax, qword [0x180069e00]
lea rbx, [0x180069e10]
xor r10b, r10b
movzx r11d, cl
shl r11d, 2
nop
movzx r9d, r10b
xor r8b, r8b
add r9d, r11d
shl r9d, 2
nop
movzx ecx, r8b
inc r8b
add ecx, r9d
movzx ecx, byte [rcx + rbx]
xor byte [rax], cl
inc rax
cmp r8b, 4
jb 0x18001e270
inc r10b
cmp r10b, 4
jb 0x18001e260
mov rbx, qword [rsp + 8]
ret
push rbx
sub rsp, 0x20
xor ecx, ecx
call 0x18001e240
mov bl, 1
nop
call fcn.18001e620
call fcn.18001e5c0
call fcn.18001e510
movzx ecx, bl
call 0x18001e240
inc bl
cmp bl, 0xa
jb 0x18001e2e0
call fcn.18001e620
call fcn.18001e5c0
mov cl, 0xa
add rsp, 0x20
pop rbx
jmp 0x18001e240

Function at 0x18001e510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x180069e00]
mov edi, 4
add r8, 2
nop word [rax + rax]
movzx r11d, byte [r8 - 2]
movzx ebx, r11b
movzx ecx, r11b
xor bl, byte [r8 - 1]
xor bl, byte [r8 + 1]
xor cl, byte [r8 - 1]
xor bl, byte [r8]
call fcn.18001e680
xor al, r11b
xor al, bl
mov byte [r8 - 2], al
movzx r10d, byte [r8]
movzx ecx, byte [r8 - 1]
xor cl, r10b
call fcn.18001e680
xor al, byte [r8 - 1]
movzx ecx, r10b
xor al, bl
mov byte [r8 - 1], al
xor cl, byte [r8 + 1]
call fcn.18001e680
xor al, r10b
xor al, bl
mov byte [r8], al
xor r11b, byte [r8 + 1]
movzx ecx, r11b
call fcn.18001e680
xor al, byte [r8 + 1]
lea r8, [r8 + 4]
xor al, bl
mov byte [r8 - 3], al
sub rdi, 1
jne 0x18001e530
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18001e670
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
movzx eax, cl
lea rcx, str.cw
movzx eax, byte [rax + rcx]
ret
Function at 0x18001e760
Capabilities:
Hash data using sha1
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
test rcx, rcx
je 0x18001e7b2
mov dword [rcx], edx
test edx, edx
je 0x18001e7a9
sub edx, 1
je 0x18001e7a0
sub edx, 1
je 0x18001e797
sub edx, 1
je 0x18001e78e
cmp edx, 1
je 0x18001e785
mov eax, 4
ret
add rcx, 8
jmp 0x180020c40
add rcx, 8
jmp 0x1800202b0
add rcx, 8
jmp 0x180020280
add rcx, 8
jmp 0x18001fa50
add rcx, 8
jmp 0x18001f910
mov eax, 1
ret
test rcx, rcx
jne 0x18001f91b
mov eax, 1
ret
xor eax, eax
mov qword [rcx + 0x14], rax
mov word [rcx + 0x1c], ax
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x60], rax
ret
lea rdx, [0x180068100]
jmp 0x1800200a0
test rcx, rcx
jne 0x1800200a9
lea eax, [rcx + 1]
ret
xor r8d, r8d
mov qword [rcx + 0x20], r8
mov word [rcx + 0x28], r8w
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 4], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x1c], eax
xor eax, eax
mov qword [rcx + 0x6c], r8
ret
lea rdx, [0x180068120]
jmp 0x1800200a0
lea rdx, [0x180068140]
jmp 0x180020a00
test rcx, rcx
jne 0x180020a09
lea eax, [rcx + 1]
ret
xor r8d, r8d
mov word [rcx + 0x50], r8w
mov qword [rcx + 0x40], r8
mov qword [rcx + 0x48], r8
mov rax, qword [rdx]
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 0x18]
mov qword [rcx + 0x18], rax
mov rax, qword [rdx + 0x20]
mov qword [rcx + 0x20], rax
mov rax, qword [rdx + 0x28]
mov qword [rcx + 0x28], rax
mov rax, qword [rdx + 0x30]
mov qword [rcx + 0x30], rax
mov rax, qword [rdx + 0x38]
mov qword [rcx + 0x38], rax
xor eax, eax
mov qword [rcx + 0xd4], r8
ret
lea rdx, [0x180068180]
jmp 0x180020a00
Function at 0x18001f450
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movsx rcx, word [rcx + 0x1c]
mov rax, rcx
mov byte [rcx + rbx + 0x1e], dl
movzx eax, word [rbx + 0x1c]
inc ax
mov word [rbx + 0x1c], ax
cmp ecx, 0x38
jl 0x18001f4a3
cmp ax, 0x40
jge 0x18001f497
nop dword [rax + rax]
movsx rax, ax
mov byte [rax + rbx + 0x1e], 0
inc word [rbx + 0x1c]
movzx eax, word [rbx + 0x1c]
cmp ax, 0x40
jl 0x18001f480
mov rcx, rbx
call fcn.18001f510
movzx eax, word [rbx + 0x1c]
cmp ax, 0x38
jge 0x18001f4c5
nop dword [rax]
movsx rax, word [rbx + 0x1c]
mov byte [rax + rbx + 0x1e], 0
inc word [rbx + 0x1c]
cmp word [rbx + 0x1c], 0x38
jl 0x18001f4b0
movzx eax, byte [rbx + 0x1b]
mov rcx, rbx
mov byte [rbx + 0x56], al
movzx eax, byte [rbx + 0x1a]
mov byte [rbx + 0x57], al
mov eax, dword [rbx + 0x18]
shr eax, 8
mov byte [rbx + 0x58], al
movzx eax, byte [rbx + 0x18]
mov byte [rbx + 0x59], al
movzx eax, byte [rbx + 0x17]
mov byte [rbx + 0x5a], al
movzx eax, byte [rbx + 0x16]
mov byte [rbx + 0x5b], al
mov eax, dword [rbx + 0x14]
shr eax, 8
mov byte [rbx + 0x5c], al
movzx eax, byte [rbx + 0x14]
mov byte [rbx + 0x5d], al
add rsp, 0x20
pop rbx
jmp fcn.18001f510
Function at 0x18001fae0
Capabilities:
Hash data using murmur3

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movsx rcx, word [rcx + 0x28]
mov rax, rcx
mov byte [rcx + rbx + 0x2a], dl
movzx eax, word [rbx + 0x28]
inc ax
mov word [rbx + 0x28], ax
cmp ecx, 0x38
jl 0x18001fb33
cmp ax, 0x40
jge 0x18001fb27
nop dword [rax + rax]
movsx rax, ax
mov byte [rax + rbx + 0x2a], 0
inc word [rbx + 0x28]
movzx eax, word [rbx + 0x28]
cmp ax, 0x40
jl 0x18001fb10
mov rcx, rbx
call fcn.18001fba0
movzx eax, word [rbx + 0x28]
cmp ax, 0x38
jge 0x18001fb55
nop dword [rax]
movsx rax, word [rbx + 0x28]
mov byte [rax + rbx + 0x2a], 0
inc word [rbx + 0x28]
cmp word [rbx + 0x28], 0x38
jl 0x18001fb40
movzx eax, byte [rbx + 0x27]
mov rcx, rbx
mov byte [rbx + 0x62], al
movzx eax, byte [rbx + 0x26]
mov byte [rbx + 0x63], al
mov eax, dword [rbx + 0x24]
shr eax, 8
mov byte [rbx + 0x64], al
movzx eax, byte [rbx + 0x24]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 0x23]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 0x22]
mov byte [rbx + 0x67], al
mov eax, dword [rbx + 0x20]
shr eax, 8
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 0x20]
mov byte [rbx + 0x69], al
add rsp, 0x20
pop rbx
jmp fcn.18001fba0