joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180108030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.18017e6d0
sub rsp, rax
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1801081f6
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x180108193
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.180106e40
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x180108130
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1801081f6
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180179370
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180108220
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
mov ebx, edx
mov rsi, r8
lea rdx, [0x18020c0f0]
mov r8d, 0x1048
mov rdi, rcx
call fcn.18017dd20
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9d, ebx
nop word [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x180108270
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180106e40
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x1801082d0
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180106e40
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x180108300
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18010af80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
mov rbp, r9
mov rdi, r9
mov rbx, r8
shr rbp, 3
mov rsi, rdx
mov r12, rcx
cmp r8, r9
jb 0x18010b046
nop
xor r8d, r8d
test rbp, rbp
je 0x18010b032
nop dword [rax + rax]
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
inc r8
shl rcx, 8
add rsi, 8
or rcx, rax
movzx eax, byte [rsi - 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 6]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 8]
shl rcx, 8
or rcx, rax
xor qword [r12 + r8*8 - 8], rcx
cmp r8, rbp
jb 0x18010afd0
mov rcx, r12
call fcn.18010ab50
sub rbx, rdi
cmp rbx, rdi
jae 0x18010afc0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x1801146b9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1801148b7
push rbp
mov eax, 0xe0
call fcn.18017e6d0
sub rsp, rax
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
lea rsi, [r8 - 1]
mov qword [rsp + 0xc0], r13
shr rsi, 3
mov rbp, rdx
lea r12, [rcx + 0xc]
inc rsi
lea r13, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.1800a4e20
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.1800a4e80
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.1800a1070
mov rcx, r13
call fcn.1800a4e20
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1800a4e80
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.1800a1070
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
dec rsi
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x180114720
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180179370
add rsp, 0xe0
pop rbp
repz ret

Function at 0x180114a00
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.18017e8a0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x18011a340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x18011a36c
mov rbx, r8
jmp 0x18011a372
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
call fcn.180070430
test rax, rax
jne 0x18011a38f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x18011a3c4
mov r9d, r8d
nop dword [rax + rax]
mov rax, qword [rsi]
mov rcx, qword [rbx]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x18011a3a0
movsxd rdx, r8d
cmp r8d, dword [rbx + 8]
jge 0x18011a3ed
shl rdx, 3
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x18011a3d1
mov eax, dword [rbx + 8]
mov rcx, rdi
mov dword [rdi + 8], eax
call fcn.18006fcd0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180127530
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs r9, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [rcx + 0x28]
imul r8, r9
xor r8, rax
imul r8, r9
mov rax, r8
shr rax, 0x20
xor rax, r8
and rax, rdx
cmp qword [rcx + 0x30], rax
ja 0x1801275c0
shr rdx, 1
or rcx, 0xffffffffffffffff
sub rcx, rdx
add rax, rcx
ret
Function at 0x18012c7d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [rcx + 0x70], 0
mov dword [rcx + 0x4c], edx
jne 0x18012c7e3
mov dword [rcx + 0x70], 1
mov dword [rcx + 0x54], edx
mov r8d, edx
sub r8d, dword [rcx + 0x54]
lea eax, [r8 + 0x2710]
cmp eax, 0x4e1f
jbe 0x18012c7fd
mov dword [rcx + 0x54], edx
jmp 0x18012c802
test r8d, r8d
js 0x18012c81b
mov r8d, dword [rcx + 0x50]
add dword [rcx + 0x54], r8d
cmp edx, dword [rcx + 0x54]
js 0x18012c816
lea eax, [r8 + rdx]
mov dword [rcx + 0x54], eax
jmp fcn.18012bfb0
ret

Function at 0x18012ccb0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
mov eax, dword [0x18026e410]
test al, 1
jne 0x18012cd19
or eax, 1
lea rcx, [rsp + 0x20]
mov dword [0x18026e410], eax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x40]
lea eax, [rax*2 + 2]
cmp eax, 0x200
jae 0x18012cd05
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [rsp + 0x40]
lea eax, [rax*2 + 2]
mov dword [0x18026e414], eax
add rsp, 0x58
ret
mov dword [0x18026e414], 0x200
mov eax, 0x200
add rsp, 0x58
ret
mov eax, dword [0x18026e414]
add rsp, 0x58
ret
Function at 0x180139420
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x48], edx
mov edx, 6
lea r9, [rsp + 0x48]
lea r8d, [rdx - 5]
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x180139450
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x48], edx
lea r9, [rsp + 0x48]
mov r8d, 0xffffff7f
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x180139480
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov word [rsp + 0x48], dx
mov word [rsp + 0x4a], r8w
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x80
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x1801394c0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x48], edx
lea r9, [rsp + 0x48]
mov r8d, 0x1002
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x1801394f0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x48], edx
lea r9, [rsp + 0x48]
mov r8d, 0x1001
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x180139520
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x48], edx
lea r9, [rsp + 0x48]
mov r8d, 0x1006
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x180139550
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x48], edx
lea r9, [rsp + 0x48]
mov r8d, 0x1005
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret

Function at 0x180139590
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x48], edx
lea r9, [rsp + 0x48]
mov r8d, 0xfffffffb
mov edx, 0xffff
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x180139a10
Capabilities:
Encode data using base64

Disassembly:
jmp 0x18015f030
mov qword [rsp + 0x20], rbx
push rdi
lea r10d, [rdx + 2]
mov eax, 0xaaaaaaab
mov edi, edx
mov rbx, r9
mov r11, rcx
mul r10d
mov r10d, edx
shr r10d, 1
shl r10d, 2
test r8, r8
je 0x18015f1b1
cmp dword [r9], r10d
jb 0x18015f1b1
mov eax, 0xaaaaaaab
mov qword [rsp + 0x20], r14
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mul edi
shr edx, 1
lea ecx, [rdx + rdx*2]
xor edx, edx
test ecx, ecx
je 0x18015f10e
dec ecx
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
inc edx
mov r9d, edx
lea edx, [rdx + rdx*2]
nop dword [rax + rax]
movzx eax, byte [r11]
add r8, 4
add r11, 3
shr rax, 2
movzx eax, byte [rax + r14]
mov byte [r8 - 4], al
movzx ecx, byte [r11 - 3]
movzx eax, byte [r11 - 2]
shr rax, 4
and ecx, 3
shl rcx, 4
add rcx, rax
movzx eax, byte [rcx + r14]
mov byte [r8 - 3], al
movzx ecx, byte [r11 - 2]
movzx eax, byte [r11 - 1]
shr rax, 6
and ecx, 0xf
lea rcx, [rax + rcx*4]
movzx eax, byte [rcx + r14]
mov byte [r8 - 2], al
movzx eax, byte [r11 - 1]
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [r8 - 1], al
dec r9
jne 0x18015f0a0
cmp edx, edi
jae 0x18015f197
mov qword [rsp + 0x10], rbp
movzx ebp, byte [r11]
mov qword [rsp + 0x18], rsi
lea esi, [rdx + 1]
cmp esi, edi
jae 0x18015f132
movzx ecx, byte [r11 + 1]
jmp 0x18015f134
xor cl, cl
movzx edx, bpl
movzx eax, bpl
mov rbp, qword [rsp + 0x10]
shr rax, 2
and edx, 3
movzx r9d, cl
movzx eax, byte [rax + r14]
mov ecx, r9d
shl rdx, 4
shr ecx, 4
mov byte [r8], al
add rdx, rcx
cmp esi, edi
mov rsi, qword [rsp + 0x18]
movzx eax, byte [rdx + r14]
mov byte [r8 + 1], al
jae 0x18015f185
and r9d, 0xf
shl r9d, 2
movsxd rax, r9d
movzx ecx, byte [rax + r14]
jmp 0x18015f18a
mov ecx, 0x3d
mov byte [r8 + 2], cl
mov byte [r8 + 3], 0x3d
add r8, 4
mov r14, qword [rsp + 0x20]
cmp dword [rbx], r10d
jbe 0x18015f1a8
mov byte [r8], 0
mov dword [rbx], r10d
xor eax, eax
mov rbx, qword [rsp + 0x28]
pop rdi
ret
mov rbx, qword [rsp + 0x28]
mov dword [r9], r10d
mov eax, 0xfffffffb
pop rdi
ret

Function at 0x18013a3e0
Capabilities:
Hash data using fnv

Disassembly:
mov r8d, edx
mov rdx, rcx
jmp fcn.180153d20
Function at 0x18013a3f0
Capabilities:
Check if file exists

Disassembly:
mov r8d, edx
mov rdx, rcx
jmp 0x180154370
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x60
mov rbx, rdx
test r8d, r8d
je 0x1801543a4
mov r8d, 1
call fcn.180153d20
test eax, eax
jne 0x1801543a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1801543a4
xor eax, eax
add rsp, 0x60
pop rbx
ret
mov qword [rsp + 0x50], r13
lea r8, [0x18022fa30]
lea rcx, [rsp + 0x70]
xor r13d, r13d
mov rdx, rbx
mov qword [rsp + 0x70], r13
call fcn.18017d05c
test eax, eax
je 0x180154402
call fcn.18017b3b8
cmp dword [rax], 2
jne 0x1801543e2
lea ecx, [r13 + 2]
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180154545
call fcn.18017b3b8
mov ecx, WSASetLastError
mov edx, 5
cmp dword [rax], 0xd
cmove ecx, edx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x180154545
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x58], r12
xor ecx, ecx
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r15
call fcn.18017b6d4
lea rcx, [0x18026e2f0]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov rbp, qword [0x18026e2f8]
mov r14, qword [rbp]
cmp r14, rbp
je 0x18015450e
nop dword [rax]
nop word [rax + rax]
mov r15, qword [r14 + 0x18]
mov rsi, qword [r15]
cmp rsi, r15
je 0x180154502
mov r9, qword [rsi + 0x10]
mov r8, qword [r14 + 0x10]
mov rcx, qword [rsp + 0x70]
lea rdx, str._s__s_n
call fcn.180179720
test eax, eax
js 0x180154562
mov rdi, qword [rsi + 0x18]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1801544f6
nop dword [rax]
mov rax, qword [rbx + 0x30]
cmp rax, r12
jle 0x1801544ee
mov rcx, qword [rbx + 0x18]
mov r8, qword [rbx + 0x10]
lea r9, [0x18022fa3c]
cmp byte [rcx], r13b
lea rdx, str._t_s__s__I64d__d__d__d_n
cmovne r9, rcx
mov ecx, dword [rbx + 0x40]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbx + 0x3c]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rbx + 0x38]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.180179720
test eax, eax
js 0x180154562
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1801544a0
mov rsi, qword [rsi]
cmp rsi, r15
jne 0x180154470
mov r14, qword [r14]
cmp r14, rbp
jne 0x180154460
lea rcx, [0x18026e2f0]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov r13d, 1
mov r14, qword [rsp + 0x48]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180154554
call fcn.18017d2dc
mov eax, r13d
mov r13, qword [rsp + 0x50]
add rsp, 0x60
pop rbx
ret
mov ecx, 0x1d
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [0x18026e2f0]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
jmp 0x180154521
Function at 0x18013b380
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov ebx, edx
mov rdi, rcx
test edx, edx
jne 0x18013b398
lea ebx, [rdx - 2]
jmp 0x18013b39a
jns 0x18013b3ac
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
imul ebx, dword [rsp + 0x40]
neg ebx
mov r8d, dword [rdi + 0x54]
mov edx, ebx
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
jmp fcn.18013f000

Function at 0x18013d9b0
Capabilities:
Hash data using fnv

Disassembly:
add rcx, 0x260
jmp 0x18013fd70
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov r15, r8
mov rsi, rcx
xor r14d, r14d
lea rcx, [rsp + 0x70]
call fcn.18013a6c0
nop
movabs rdx, 0xcbf29ce484222325
mov r9d, r14d
mov rax, qword [rsp + 0x70]
or rbp, 0xffffffffffffffff
mov rcx, rbp
inc rcx
cmp byte [rax + rcx], r9b
jne 0x18013fdb7
test rcx, rcx
je 0x18013fdf0
movabs r8, 0x100000001b3
nop
movzx ecx, byte [r9 + rax]
xor rdx, rcx
imul rdx, r8
inc r9
mov rcx, rbp
inc rcx
cmp byte [rax + rcx], 0
jne 0x18013fde2
cmp r9, rcx
jb 0x18013fdd0
mov rcx, rdx
shr rcx, 0x20
xor rdx, rcx
mov r8, qword [rsi + 0xa8]
mov rdi, r8
and rdi, rdx
cmp qword [rsi + 0xb0], rdi
ja 0x18013fe1c
shr r8, 1
mov rcx, rbp
sub rcx, r8
add rdi, rcx
add rdi, rdi
mov rbx, qword [rsi + 0x90]
mov rbx, qword [rbx + rdi*8]
nop word [rax + rax]
mov rcx, qword [rsi + 0x80]
mov rdx, qword [rsi + 0x90]
cmp qword [rdx + rdi*8], rcx
je 0x18013fe4c
mov rcx, qword [rdx + rdi*8 + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x20], rcx
cmp rbx, rcx
je 0x18013fee5
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x18013feda
mov rdx, rax
mov rcx, qword [rbx + 0x10]
call fcn.18017bdf4
test eax, eax
je 0x18013fe81
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x70]
jmp 0x18013fe30
mov rdx, qword [rbx + 0x10]
mov eax, r14d
test rdx, rdx
setne al
test eax, eax
jne 0x18013fe9d
mov ecx, 0x80004005
call fcn.180127e80
int3
mov rcx, qword [rsp + 0x70]
call fcn.18017bdf4
test eax, eax
je 0x18013febe
mov rax, qword [rsi + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
jmp 0x18013fec8
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x70]
jmp 0x18013fef4
mov ecx, 0x80004005
call fcn.180127e80
int3
mov rcx, qword [rsi + 0x80]
mov qword [rsp + 0x88], rcx
lea rdx, [rax - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18013ff08
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rsp + 0x88]
cmp rax, qword [rsi + 0x80]
je 0x18013ff26
mov rcx, qword [rax + 0x18]
mov qword [r15], rcx
mov r14d, 1
mov eax, r14d
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x18013df40
Capabilities:
Hash data using fnv

Disassembly:
mov rcx, qword [rcx + 0x460]
jmp 0x18013fd70
Function at 0x18013ef00
Capabilities:
Terminate thread

Disassembly:
push rbx
push rdi
sub rsp, 0x28
cmp qword [rcx + 0x70], 0
mov edi, edx
mov rbx, rcx
je 0x18013efdc
add rcx, 0x28
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test edi, edi
jne 0x18013ef32
mov edi, dword [rbx + 0x54]
mov r8d, edi
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x48], rbp
call fcn.18013f000
mov esi, dword [rbx + 0x18]
dec esi
movsxd rdi, esi
js 0x18013ef9d
nop
test rdi, rdi
js 0x18013efe3
cmp esi, dword [rbx + 0x18]
jge 0x18013efe3
mov rax, qword [rbx + 0x10]
lea rdx, [rsp + 0x40]
mov rbp, qword [rax + rdi*8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x40], 0x103
jne 0x18013ef8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
dec esi
dec rdi
jns 0x18013ef50
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x28]
mov qword [rbx + 0x70], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rbx
ret
xor r9d, r9d
xor r8d, r8d
mov ecx, 0xc000008c
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]