joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180053670
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1801d11f0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov r14d, edx
mov rbx, rcx
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
xor edx, edx
mov ebp, r8d
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18005379b
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_33
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180053792
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x180053774
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180053774
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180053774
mov rdx, qword [rbx]
test rdx, rdx
jne 0x180053732
mov rcx, qword [0x1801ebb18]
mov r8d, 0x200
mov dword [rbx + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180053792
jmp 0x180053767
mov eax, dword [rbx + 8]
cmp dword [rbx + 0xc], eax
jb 0x180053767
mov rcx, qword [0x1801ebb18]
lea r9d, [rax + rax]
mov r8, rdx
shl r9, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180053792
mov eax, dword [rbx + 8]
add eax, eax
mov qword [rbx], rdx
mov dword [rbx + 8], eax
mov ecx, dword [rbx + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_33
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1800536e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], rsi
je 0x1800537f3
cmp dword [rbx + 0xc], esi
jbe 0x1800537f3
nop word [rax + rax]
mov rax, qword [rbx]
xor edx, edx
mov ecx, esi
mov r8d, dword [rax + rcx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1800537ec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rdi
call fcn.1800534c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rbx + 0xc]
jb 0x1800537b0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180146940
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180053820
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1801d11f0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov r8d, 0x40
add rbx, qword [0x1801f49b0]
mov rdx, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [rdx - 5]
cmove rdi, rdx
lea rsi, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180053889
mov eax, 0xa
jmp 0x1800538d6
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800538a5
mov rax, qword [rbx]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rbx + 0x20], 6
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180146940
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180053900
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1801f49bc]
xor edi, edi
mov ebx, edi
test eax, eax
je 0x180053a10
mov rcx, qword [0x1801f49b0]
add rcx, 0x20
test byte [rcx], 2
je 0x180053943
inc ebx
add rcx, 0x38
cmp ebx, eax
jb 0x180053927
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x180053a10
mov edx, 0xffffffff
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.180053670
mov edx, dword [0x1801f49bc]
cmp ebx, edx
jae 0x18005399d
nop dword [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1801f49b0]
test byte [rcx + rax + 0x20], 2
jne 0x180053997
mov ecx, ebx
call fcn.180053820
mov edi, eax
test eax, eax
jne 0x18005399d
mov edx, dword [0x1801f49bc]
inc ebx
cmp ebx, edx
jb 0x180053970
cmp qword [rsp + 0x20], 0
je 0x180053a10
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800539fc
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
mov qword [rsp + 0x48], rsi
nop
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800539e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800539c0
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1801ebb18]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x180059140
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1801d11f0]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rdi, rcx
mov dword [rbp - 0x70], 0x1a8
lea rcx, [rbp - 0x6c]
xor edx, edx
mov r8d, 0x1a4
call fcn.180148760
movdqa xmm0, xmmword [0x1801b4f80]
lea rcx, [rsp + 0x68]
xor esi, esi
mov dword [rsp + 0x40], 0x11506274
mov r9d, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x68], rsi
mov edx, r9d
mov qword [rsp + 0x78], rsi
xor r8d, r8d
mov qword [rbp - 0x80], reloc.WS2_32.dll_ntohs
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], sil
call fcn.180016700
mov eax, esi
mov qword [rsp + 0x268], rbx
cmp rax, 0x14
jae 0x180059351
movzx edx, byte [rsp + rax + 0x30]
xor dl, 0x11
cmp qword [rsp + 0x78], rax
jbe 0x18005934b
cmp qword [rbp - 0x80], 0x10
lea rcx, [rsp + 0x68]
cmovae rcx, qword [rsp + 0x68]
mov byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jl 0x1800591d9
cmp qword [rbp - 0x80], 0x10
lea rbx, [rsp + 0x68]
mov r9d, reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x30], 0x6b7c6a6c
cmovae rbx, qword [rsp + 0x68]
mov eax, ntohl
xor r8d, r8d
mov dword [rsp + 0x34], 0x7d372b2a
mov qword [rsp + 0x48], r8
mov rcx, rsi
mov dword [rsp + 0x50], r8d
mov word [rsp + 0x38], 0x7575
mov byte [rsp + 0x3a], Ordinal_27
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x58], rax
nop
cmp rcx, 0xb
jae 0x180059357
movzx edx, byte [rsp + rcx + 0x30]
xor dl, 0x19
cmp rax, rcx
jbe 0x18005934b
cmp r9, 0x10
lea rax, [rsp + 0x48]
cmovae rax, r8
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 0xb
jge 0x1800592a5
mov r9, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
jmp 0x180059260
cmp qword [rsp + 0x60], 0x10
lea rcx, [rsp + 0x48]
cmovae rcx, qword [rsp + 0x48]
call fcn.1800570c0
mov rdx, rbx
mov rcx, rax
call fcn.180057230
lea rcx, [rsp + 0x48]
mov rbx, rax
call fcn.18000da30
lea rcx, [rsp + 0x68]
call fcn.18000da30
mov r9d, 1
lea r8, [rbp - 0x70]
xor edx, edx
xor ecx, ecx
call rbx
lea rax, [rbp - 0x4c]
mov qword [rdi], rsi
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rax + r8], sil
jne 0x180059307
lea rdx, [rbp - 0x4c]
mov rcx, rdi
call fcn.18000da90
mov rbx, qword [rsp + 0x268]
mov rax, rdi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.180146940
lea r11, [rsp + 0x250]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800c26d0
int3
call fcn.1800c22c0
int3
call fcn.1800c22c0
int3
Function at 0x18005ab80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1400
call fcn.180147670
sub rsp, rax
mov rax, qword [0x1801d11f0]
xor rax, rsp
mov qword [rsp + 0x13f0], rax
movups xmm0, xmmword [str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
mov eax, dword [0x1801b2e30]
mov rbx, rcx
movups xmm1, xmmword [0x1801b2e08]
mov dword [rsp + 0x13e8], eax
movzx eax, word [0x1801b2e34]
movups xmmword [rsp + 0x13b0], xmm0
mov word [rsp + 0x13ec], ax
movups xmm0, xmmword [0x1801b2e18]
movzx eax, byte [0x1801b2e36]
movups xmmword [rsp + 0x13c0], xmm1
mov byte [rsp + 0x13ee], al
movsd xmm1, qword [0x1801b2e28]
movups xmmword [rsp + 0x13d0], xmm0
movsd qword [rsp + 0x13e0], xmm1
call fcn.18014604c
mov edx, eax
mov dword [rsp + 0x24], eax
mov eax, 1
mov dword [rsp + 0x13a4], 0xffffffff
nop dword [rax + rax]
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [rsp + rax*4 + 0x24], edx
inc rax
cmp rax, 0x270
jb 0x18005ac30
xor eax, eax
mov dword [rsp + 0x20], 0x270
mov qword [rbx], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
lea edi, [rax + 0x10]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call fcn.1800d1320
mov ecx, eax
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
cmp eax, 0x4210842
jae 0x18005ac70
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
mov rdx, qword [rbx + 0x18]
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movsxd rax, ecx
mov rcx, qword [rbx + 0x10]
movzx r9d, byte [rsp + rax + 0x13b0]
cmp rcx, rdx
jae 0x18005ace4
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x18005acd9
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18005acf3
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 1]
call fcn.1800c59e0
sub rdi, 1
jne 0x18005ac70
mov rax, rbx
mov rcx, qword [rsp + 0x13f0]
xor rcx, rsp
call fcn.180146940
mov rbx, qword [rsp + 0x1418]
add rsp, 0x1400
pop rdi
ret
Function at 0x18005bf80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x1801d11f0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
cmp qword [r8 + 0x18], 0x10
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
jb 0x18005bfb4
mov rbx, qword [r8]
movdqa xmm0, xmmword [0x1801b3e90]
lea rcx, [rbp - 0x51]
movdqa xmm1, xmmword [0x1801b4050]
xor r14d, r14d
movups xmmword [rbp - 0x31], xmm0
mov dword [rbp + 0x1f], 0x29152f3e
mov r9d, reloc.WLDAP32.dll_Ordinal_45
mov dword [rbp + 0x23], 0x232c2425
xor r8d, r8d
movsd xmm0, qword [rbp + 0x1f]
mov edx, r9d
mov dword [rbp + 0x27], 0x396f652d
mov eax, dword [rbp + 0x27]
movsd qword [rbp - 0x11], xmm0
movups xmmword [rbp - 0x21], xmm1
mov dword [rbp - 9], eax
mov byte [rbp - 5], 0x4a
mov qword [rbp - 0x51], r14
mov qword [rbp - 0x41], r14
mov qword [rbp - 0x39], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], r14b
call fcn.180016700
mov eax, r14d
cmp rax, 0x2d
jae 0x18005c196
movzx r8d, byte [rbp + rax - 0x31]
xor r8b, 0x4a
cmp qword [rbp - 0x41], rax
jbe 0x18005c190
cmp qword [rbp - 0x39], 0x10
lea rcx, [rbp - 0x51]
cmovae rcx, qword [rbp - 0x51]
mov byte [rcx + rax], r8b
inc rax
cmp rax, 0x2d
jl 0x18005c029
cmp qword [rbp - 0x39], 0x10
lea rcx, [rbp - 0x51]
mov rdx, rbx
cmovae rcx, qword [rbp - 0x51]
call fcn.180059990
lea rcx, [rbp - 0x51]
mov rbx, rax
call fcn.18000da30
mov r8, rbx
lea rdx, [rbp - 1]
mov rcx, rsi
call fcn.18005ad30
cmp qword [rbp + 0xf], r14
jbe 0x18005c0ef
lea rdx, [rbp - 0x51]
mov rcx, rsi
call fcn.18005c1b0
lea rcx, [rbp - 0x51]
call fcn.18000d9a0
movups xmm1, xmmword [rbp + 0xf]
mov qword [rbp + 0xf], r14
movups xmm0, xmmword [rbp - 1]
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov byte [rbp - 1], r14b
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
lea rcx, [rbp - 1]
call fcn.18000da30
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180146940
add rsp, 0xc0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r9d, reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x59], 0x7d
mov eax, 1
mov qword [rbp - 0x39], r9
mov qword [rbp - 0x41], rax
mov r8, r14
mov qword [rbp - 0x51], r14
mov rcx, r14
cmp rcx, 1
jae 0x18005c1a2
movzx edx, byte [rbp + rcx - 0x59]
xor dl, 0x7d
cmp rax, rcx
jbe 0x18005c19c
cmp r9, 0x10
lea rax, [rbp - 0x51]
cmovae rax, r8
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 1
jge 0x18005c14d
mov r9, qword [rbp - 0x39]
mov rax, qword [rbp - 0x41]
mov r8, qword [rbp - 0x51]
jmp 0x18005c110
cmp qword [rbp - 0x39], 0x10
lea rdx, [rbp - 0x51]
mov qword [rdi], r14
mov r8, 0xffffffffffffffff
cmovae rdx, qword [rbp - 0x51]
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
inc r8
cmp byte [rdx + r8], r14b
jne 0x18005c171
mov rcx, rdi
call fcn.18000da90
lea rcx, [rbp - 0x51]
call fcn.18000da30
jmp 0x18005c0c9
call fcn.1800c26d0
int3
call fcn.1800c22c0
int3
call fcn.1800c26d0
int3
call fcn.1800c22c0
int3
Function at 0x1800956b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, edx
mov r9d, edx
and r10d, 7
je 0x18009573d
cmp edx, r10d
jge 0x18009572e
mov r9d, dword [rcx + 0x14]
mov eax, 1
mov ecx, edx
mov r8d, edx
shl eax, cl
cmp r9d, eax
jae 0x180095727
mov r11, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r11
jb 0x1800956f2
xor cl, cl
jmp 0x1800956fb
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
lea edx, [r8 + 8]
mov ecx, r8d
mov dword [rbx + 0x10], edx
shl eax, cl
or r9d, eax
mov dword [rbx + 0x14], r9d
cmp edx, 0x18
jg 0x18009572e
mov ecx, edx
mov eax, 1
shl eax, cl
mov r8d, edx
cmp r9d, eax
jb 0x1800956e6
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov ecx, r10d
shr dword [rbx + 0x14], cl
sub edx, r10d
mov dword [rbx + 0x10], edx
mov r9d, edx
xor r10d, r10d
test edx, edx
jle 0x180095772
mov ecx, dword [rbx + 0x14]
lea r8, [rsp + 0x30]
nop dword [rax]
movzx eax, byte [rbx + 0x14]
lea edx, [r9 - 8]
shr ecx, 8
inc r10d
mov byte [r8], al
lea r8, [r8 + 1]
mov dword [rbx + 0x14], ecx
mov r9d, edx
test edx, edx
jg 0x180095750
mov dword [rbx + 0x10], edx
jns 0x18009579f
mov edx, dword [0x1801eadf4]
mov rax, qword gs:[0x58]
mov ecx, Ordinal_41
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r10d
cmp rcx, 4
jge 0x1800957cf
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop
cmp rax, r8
jb 0x1800957b9
xor dl, dl
jmp 0x1800957c2
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1800957b0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x180095774
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x180095844
mov edx, dword [0x1801eadf4]
mov rax, qword gs:[0x58]
mov ecx, Ordinal_41
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x18009585e
mov rcx, rbx
call fcn.180094b10
test eax, eax
je 0x180095837
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.1801480b0
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1800a6ec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov r8, qword [0x1801ebbc0]
test r8, r8
je 0x1800a6fed
mov r9, qword [0x1801f4140]
mov qword [rsp + 0xd8], rbx
xor ebx, ebx
mov edx, ebx
mov ecx, ebx
mov rax, qword [r9 + rcx*8]
test rax, rax
je 0x1800a6f0a
cmp dword [rax + 0x48], 0x54
jne 0x1800a6f0a
cmp dword [rax + 0x40], 8
cmove rdx, rax
inc rcx
cmp rcx, 0x400
jl 0x1800a6ef3
test rdx, rdx
je 0x1800a6ff6
movss xmm0, dword [rdx + 0x10]
movss xmm1, dword [rdx + 0x14]
movss dword [rbp - 0x19], xmm0
movss xmm0, dword [0x1801b31b0]
movss dword [rbp - 0x11], xmm0
movss dword [rbp - 0x15], xmm1
test r8, r8
je 0x1800a6fbc
mov eax, dword [0x1801f48d8]
cmp eax, 0xaf2
jl 0x1800a6f59
mov ebx, 0x144b
jmp 0x1800a6f83
cmp eax, 0x9f1
jl 0x1800a6f67
mov ebx, 0x146b
jmp 0x1800a6f83
cmp eax, 0x7d0
jl 0x1800a6f75
mov ebx, 0x141b
jmp 0x1800a6f83
cmp eax, 0x644
mov ecx, 0x13fb
cmovge rbx, rcx
test byte [rbx + r8], 0x40
je 0x1800a6fbc
cmp eax, 0x88d
jl 0x1800a6fa5
cmp eax, 0xaf2
mov ecx, 0xd30
mov edx, 0xd10
cmovge ecx, edx
jmp 0x1800a6faa
mov ecx, 0xd28
mov r8, qword [rcx + r8]
test r8, r8
jne 0x1800a6fbc
mov r8, qword [rbp + 0x67]
test r8, r8
je 0x1800a6fe5
mov rcx, qword [r8 + 0x30]
test rcx, rcx
je 0x1800a6fe5
movsd xmm1, qword [rbp - 0x19]
mov eax, dword [rbp - 0x11]
movsd qword [rcx + 0x50], xmm1
mov dword [rcx + 0x58], eax
movsd qword [r8 + 0x90], xmm1
mov dword [r8 + 0x98], eax
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
movdqa xmm0, xmmword [0x1801b3220]
lea rdx, [0x1801a7088]
xor r8d, r8d
mov qword [rbp + 0x17], rbx
lea rcx, [rbp + 0x17]
movdqu xmmword [rbp + 0x27], xmm0
call fcn.18000da90
movdqa xmm0, xmmword [0x1801b3f60]
lea rcx, [rbp - 9]
mov r9d, reloc.WLDAP32.dll_Ordinal_26
mov dword [rbp - 0x29], 0x21392f78
mov edx, r9d
mov dword [rbp - 0x25], 0x36313728
xor r8d, r8d
mov word [rbp - 0x21], 0x582c
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 9], rbx
mov qword [rbp + 7], rbx
mov qword [rbp + reloc.WS2_32.dll_ntohs], 0xf
mov byte [rsp + 0x20], bl
call fcn.180016700
mov rcx, rbx
cmp rbx, 0x1a
jae 0x1800a711c
movzx edx, byte [rbp + rcx - 0x39]
xor dl, 0x58
cmp qword [rbp + 7], rcx
jbe 0x1800a7116
cmp qword [rbp + 0xf], 0x10
lea rax, [rbp - 9]
cmovae rax, qword [rbp - 9]
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 0x1a
jl 0x1800a706b
cmp qword [rbp + 0xf], 0x10
lea rdx, [rbp - 9]
movdqa xmm0, xmmword [0x1801b3220]
mov r8, 0xffffffffffffffff
cmovae rdx, qword [rbp - 9]
mov qword [rbp - 0x39], rbx
movdqu xmmword [rbp - 0x29], xmm0
inc r8
cmp byte [rdx + r8], bl
jne 0x1800a70c3
lea rcx, [rbp - 0x39]
call fcn.18000da90
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x37]
call fcn.180013b30
mov rcx, rax
call fcn.180012990
lea rcx, [rbp - 0x39]
call fcn.18000da30
lea rcx, [rbp + 0x17]
call fcn.18000da30
lea rcx, [rbp - 9]
call fcn.18000da30
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call fcn.1800c26d0
int3
call fcn.1800c22c0
int3
Function at 0x1800d1320
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1800d1381
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1800d1340
mov ecx, dword [r10]
jmp 0x1800d146a
cmp ecx, 0x4e0
jb 0x1800d146a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1800d13a0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1800d13f0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1800d9700
Capabilities:
Hash data with md5

Disassembly:
push rbx
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1801d11f0]
xor rax, rsp
mov qword [rsp + 0xb8], rax
xor r15d, r15d
mov byte [rsp + 0x20], 0
cmp qword [rdx + 0x18], 0x10
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x64], r15
mov dword [rsp + 0x6c], 0x67452301
mov dword [rsp + 0x70], 0xefcdab89
mov dword [rsp + 0x74], 0x98badcfe
mov dword [rsp + 0x78], 0x10325476
jb 0x1800d975c
mov rdx, qword [rdx]
mov r8d, dword [r14 + 0x10]
lea rcx, [rsp + 0x20]
call fcn.1800d93b0
lea rcx, [rsp + 0x20]
call fcn.1800d9490
cmp byte [rsp + 0x20], r15b
jne 0x1800d9799
mov qword [rbx], r15
lea rdx, [0x1801a7088]
mov qword [rbx + 0x10], r15
xor r8d, r8d
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
jmp 0x1800d9841
mov qword [rsp + 0x100], rbp
mov ebp, reloc.WS2_32.dll_recv
mov qword [rsp + 0xc8], rsi
lea rsi, [rsp + 0x90]
mov qword [rsp + 0xc0], rdi
lea rdi, [rsp + 0x7c]
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rdi]
lea rdx, str._02x
mov rcx, rsi
call fcn.18002f100
add rsi, 2
lea rdi, [rdi + 1]
sub rbp, 1
jne 0x1800d97d0
mov rdi, qword [rsp + 0xc0]
lea rax, [rsp + 0x90]
mov rsi, qword [rsp + 0xc8]
mov r8, 0xffffffffffffffff
mov rbp, qword [rsp + 0x100]
mov byte [rsp + 0xb0], r15b
mov qword [rbx], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
nop
inc r8
cmp byte [rax + r8], r15b
jne 0x1800d9830
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.18000da90
mov rcx, r14
call fcn.18000da30
mov rax, rbx
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.180146940
add rsp, 0xd0
pop r15
pop r14
pop rbx
ret