joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001e330
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x18001e3a8
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x18001e380
mov ecx, r12d
sub r10d, 1
je 0x18001e3cf
sub r10d, 1
je 0x18001e3c5
cmp r10d, 1
jne 0x18001e3d5
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x18001e45f
lea rdx, str.kernel32.dll
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001e464
cmp r14, rbx
jne 0x18001e440
mov dword [rsp + 0x20], 0xa
mov r9d, listen
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.180020860
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.180020860
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x18001e4f3
lea rcx, [0x180139cc0]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18001e4f3
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, rsi
jmp 0x18001e500
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18001e520
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x18001e598
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x18001e570
mov ecx, r12d
sub r10d, 1
je 0x18001e5bf
sub r10d, 1
je 0x18001e5b5
cmp r10d, 1
jne 0x18001e5c5
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x18001e64f
lea rdx, str.kernel32.dll
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001e654
cmp r14, rbx
jne 0x18001e630
mov dword [rsp + 0x20], 0xa
mov r9d, listen
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.180020860
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.180020860
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x18001e6e3
lea rcx, vtable.std::_Func_impl_no_alloc_int____cdecl___void____ptr64___int__void____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18001e6e3
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, rsi
jmp 0x18001e6f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18001e710
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x18001e788
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x18001e760
mov ecx, r12d
sub r10d, 1
je 0x18001e7af
sub r10d, 1
je 0x18001e7a5
cmp r10d, 1
jne 0x18001e7b5
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x18001e83f
lea rdx, str.kernel32.dll
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001e844
cmp r14, rbx
jne 0x18001e820
mov dword [rsp + 0x20], 0xa
mov r9d, listen
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.180020860
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.180020860
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x18001e8d3
lea rcx, [0x180139b70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18001e8d3
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, rsi
jmp 0x18001e8e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x18001e900
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x18001e978
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x18001e950
mov ecx, r12d
sub r10d, 1
je 0x18001e99f
sub r10d, 1
je 0x18001e995
cmp r10d, 1
jne 0x18001e9a5
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x18001ea2f
lea rdx, str.kernel32.dll
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18001ea34
cmp r14, rbx
jne 0x18001ea10
mov dword [rsp + 0x20], 0xa
mov r9d, listen
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.180020860
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.180020860
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x18001eac3
lea rcx, vtable.std::_Func_impl_no_alloc_unsigned_long_int____cdecl___void____ptr64__unsigned_long_int____ptr64___unsigned_long_int__void____ptr64__unsigned_long_int____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18001eac3
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
mov rax, rsi
jmp 0x18001ead0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180020860
Capabilities:
Encode data using xor
Hash data using murmur2
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rsi
push r15
sub rsp, 0x28
movsxd rax, dword [rdx + 0x3c]
xor r11d, r11d
mov qword [rsp + 0x48], rbx
mov rsi, rdx
mov qword [rsp + 0x20], rbp
mov r15d, 0xffffffff
mov qword [rsp + 0x18], rdi
mov qword [rsp + 8], r13
mov qword [rsp], r14
mov r14d, dword [rax + rdx + 0x88]
add r14, rdx
mov edi, r9d
mov ebx, dword [r14 + 0x20]
mov r13d, dword [r14 + 0x24]
add rbx, rdx
mov ebp, dword [r14 + 0x18]
add r13, rdx
sub ebp, 1
je 0x1800209c3
imul eax, edi, 0x5bd1e995
mov qword [rsp + 0x10], r12
mov r12d, dword [rsp + 0x60]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r9d, ecx, 0x5bd1e995
mov dword [rsp + 0x40], r9d
nop word [rax + rax]
mov eax, dword [rbx]
mov r8d, edi
add rax, rsi
mov r10d, r12d
cmp edi, 4
jl 0x18002093e
mov r9, rdi
shr r9, 2
lea ecx, [r9*4]
sub r8d, ecx
imul ecx, dword [rax], 0x5bd1e995
add rax, 4
imul r10d, r10d, 0x5bd1e995
mov edx, ecx
shr edx, 0x18
xor edx, ecx
imul edx, edx, 0x5bd1e995
xor r10d, edx
sub r9, 1
jne 0x180020912
mov r9d, dword [rsp + 0x40]
xor edx, edx
sub r8d, 1
je 0x180020962
sub r8d, 1
je 0x180020959
cmp r8d, 1
jne 0x180020967
movzx edx, byte [rax + 2]
shl edx, 0x10
movzx ecx, byte [rax + 1]
shl ecx, 8
xor edx, ecx
movzx ecx, byte [rax]
xor edx, ecx
imul eax, edx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, r10d, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, eax
imul edx, ecx, 0x5bd1e995
xor edx, r9d
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
cmp dword [rsp + 0x50], eax
je 0x1800209b8
inc r11d
add rbx, 4
cmp r11d, ebp
jb 0x1800208f0
jmp 0x1800209be
movzx r15d, word [r13 + r11*2]
mov r12, qword [rsp + 0x10]
mov ecx, dword [r14 + 0x1c]
mov r14, qword [rsp]
add rcx, rsi
mov r13, qword [rsp + 8]
mov rdi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x48]
cmp r15d, ecx
jbe 0x1800209eb
xor eax, eax
jmp 0x1800209f4
mov eax, r15d
mov eax, dword [rcx + rax*4]
add rax, rsi
add rsp, 0x28
pop r15
pop rsi
ret

Function at 0x18002aac0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x18002aafd
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.18002aa60
add rsp, 0x58
ret
Function at 0x180035890
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1800eb590
cdqe
add rsp, 0x28
ret

Function at 0x180035b90
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, Ordinal_46
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x180035c5b
xor r14d, r14d
nop dword [rax]
mov edi, 4
lea rdx, [rsp + 0x50]
cmp rsi, rdi
mov r8d, 4
mov rcx, rbp
cmovb rdi, rsi
call fcn.180040fe0
cmp eax, 4
jne 0x180035c0c
cmp byte [0x18014d0bc], r14b
jne 0x180035c18
lea r9d, [rax - 2]
mov dword [rsp + 0x50], r14d
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov edx, eax
test eax, eax
jne 0x180035c5d
mov eax, dword [rsp + 0x50]
jmp 0x180035c37
imul eax, dword [0x18014d0b8], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x18014d0b8], eax
rol eax, 0x10
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x180035c52
sub rsi, rdi
nop
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x180035c40
mov dword [rsp + 0x50], eax
test rsi, rsi
jne 0x180035bc0
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180035c70
Capabilities:
Generate random numbers via winapi

Disassembly:
mov r11, rsp
push rsi
push r12
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x18014a040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rax, r8
lea r15, [rsp + 0x30]
and rax, 0xfffffffffffffffe
mov r14, r8
mov rsi, rdx
mov r12, rcx
cmp rax, 0x100
jae 0x180035e1c
test r14b, 1
je 0x180035e1c
mov qword [r11 + 0x18], rbx
dec r14
mov qword [r11 - 0x28], rbp
mov ecx, Ordinal_46
mov qword [r11 - 0x30], rdi
mov rbp, r14
shr rbp, 1
lea rdi, [rsp + 0x30]
mov qword [r11 - 0x38], r13
je 0x180035d9b
xor r13d, r13d
nop word [rax + rax]
mov ebx, 4
lea rdx, [rsp + 0x20]
cmp rbp, rbx
mov r8d, 4
mov rcx, r12
cmovb rbx, rbp
call fcn.180040fe0
cmp eax, 4
jne 0x180035d3c
cmp byte [0x18014d0bc], r13b
jne 0x180035d4c
lea r9d, [rax - 2]
mov dword [rsp + 0x20], r13d
mov r8d, eax
lea rdx, [rsp + 0x20]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x180035ddd
mov eax, dword [rsp + 0x20]
jmp 0x180035d6b
imul eax, dword [0x18014d0b8], 0x41c64e6d
mov ecx, r13d
add eax, 0x3039
mov dword [0x18014d0b8], eax
rol eax, 0x10
mov dword [rsp + 0x20], eax
test rbx, rbx
je 0x180035d92
sub rbp, rbx
nop dword [rax]
nop word [rax + rax]
mov byte [rdi], al
inc rdi
shr eax, 8
sub rbx, 1
jne 0x180035d80
mov dword [rsp + 0x20], eax
test rbp, rbp
jne 0x180035cf0
mov eax, ecx
test ecx, ecx
jne 0x180035ddd
test r14, r14
je 0x180035dd8
lea rdx, [0x18010ed80]
nop dword [rax]
movzx ecx, byte [r15]
lea r15, [r15 + 1]
mov eax, ecx
and ecx, 0xf
shr rax, 4
movzx eax, byte [rax + rdx]
mov byte [rsi], al
movzx eax, byte [rcx + rdx]
mov byte [rsi + 1], al
add rsi, 2
sub r14, 2
jne 0x180035db0
mov byte [rsi], 0
xor eax, eax
mov rdi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x110]
mov r13, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180028950
add rsp, 0xd8
pop r15
pop r14
pop r12
pop rsi
ret
mov eax, Ordinal_46
jmp 0x180035dfd
Function at 0x180048fc0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x1801103f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x180048fea
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180110410]
mov rcx, rbx
mov r14, rax
call fcn.1800d3b40
test rax, rax
je 0x18004904d
mov rcx, rbx
test r14, r14
je 0x180049037
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x180049085
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180049085
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x180049148
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1800490b0
lea ecx, [rax + 1]
add rcx, rdx
call qword [fcn.1800affb0]
mov rdi, rax
test rax, rax
je 0x18004913a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18004913a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x1800490e0
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x1800490f4
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x180049110
mov rcx, rdi
test r14, r14
je 0x180049131
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x180049137
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.1800aaac0]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800491b0
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x18014a040]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x180049216
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800491f9
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x1800491f3
shr ax, 8
cmp al, 2
je 0x180049216
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180028950
add rsp, 0x1e8
ret
call fcn.180079d90
test eax, eax
jne 0x180049420
mov qword [rsp + 0x200], rsi
lea rcx, [0x1801103f0]
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x180049256
mov qword [0x18014d1a8], rsi
jmp 0x1800493dd
mov qword [rsp + 0x1f0], rbx
lea rdx, str.LoadLibraryExA
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rbx, str.iphlpapi.dll
mov rbp, rax
mov rcx, rbx
lea rdx, [0x180110410]
call fcn.1800d3b40
test rax, rax
je 0x1800492ba
mov rcx, rbx
test rbp, rbp
je 0x1800492ac
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x18004939c
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
jmp 0x18004939c
test rbp, rbp
je 0x1800492e9
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800492e9
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x18004939c
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r14d, eax
test eax, eax
je 0x180049394
lea ecx, [rax + 1]
add rcx, 0xc
call qword [fcn.1800affb0]
mov rdi, rax
test rax, rax
je 0x18004938b
mov edx, r14d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18004938b
mov rcx, 0xffffffffffffffff
mov rax, rcx
cmp byte [rdi + rax + 1], sil
lea rax, [rax + 1]
jne 0x180049335
mov edx, 0x5c
mov word [rax + rdi], dx
nop dword [rax]
inc rcx
cmp byte [rdi + rcx], sil
jne 0x180049350
mov rdx, rdi
sub rdx, rbx
add rdx, rcx
movzx eax, byte [rbx]
mov byte [rdx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x180049362
mov rcx, rdi
test rbp, rbp
je 0x180049382
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x180049388
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
mov rcx, rdi
call qword [fcn.1800aaac0]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x18014d1a8], rsi
test rsi, rsi
je 0x1800493dd
lea rdx, str.if_nametoindex
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x18014d1a0]
test rax, rax
cmovne rcx, rax
mov qword [0x18014d1a0], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.180079940
test al, al
lea rcx, [0x18014e960]
setne byte [0x18014e958]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180028950
add rsp, 0x1e8
ret
Function at 0x180057d50
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.18003d530
mov rcx, rbx
movups xmm6, xmmword [rax]
call case.0x18004627f.2
mov rcx, rdi
mov rsi, rax
call case.0x18004627f.2
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x180057e00
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.18003d530
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.18003d5c0
cmp rax, 0x3e8
ja 0x180057e31
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x180057db0
test rsi, rsi
je 0x180057e0d
mov rcx, rsi
call fcn.1800aaac0
test rbx, rbx
je 0x180057e1a
mov rcx, rbx
call fcn.1800aaac0
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x180057e3e
mov rcx, rsi
call fcn.1800aaac0
test rbx, rbx
je 0x180057e4b
mov rcx, rbx
call fcn.1800aaac0
mov eax, 1
jmp 0x180057e1c