joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18016ebd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.1802352b8
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18016ec20
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180248c74
lea r8, [0x180322554]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180242de8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18016f080
add rsp, 0x438
ret

Function at 0x18016f080
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x180519688], 0
mov rbx, rcx
je 0x18016f0e0
mov rcx, qword [0x180519680]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
or r8, 0xffffffffffffffff
mov dword [rsp + 0x48], eax
nop dword [rax]
inc r8
cmp byte [rbx + r8], al
jne 0x18016f0b0
mov rcx, qword [0x180519688]
lea r9, [rsp + 0x48]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [0x180519680]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
add rsp, 0x30
pop rbx
ret

Function at 0x18016f0f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x438
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, 0x400
lea r9, str.__04x_
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
call fcn.1802352b8
lea rcx, [rsp + 0x30]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x18016f140
lea r9, [rsp + 0x448]
lea rcx, [rsp + 0x30]
mov r8d, 0x3fd
mov qword [rsp + 0x20], r9
mov r9, qword [rsp + 0x440]
mov edx, 0x400
sub r8, rax
sub rdx, rax
add rcx, rax
call fcn.180248c74
lea r8, [0x180322554]
lea rcx, [rsp + 0x30]
mov edx, 0x400
call fcn.180242de8
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.18016f080
add rsp, 0x438
ret
Function at 0x18016f2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r8, [0x180519690]
jmp 0x18016f300
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
movzx eax, byte [rdx]
mov r14, r8
mov r9d, 0x41
mov r8, rcx
test al, al
jne 0x18016f33f
mov eax, r9d
jmp 0x18016f342
movsx eax, al
mov byte [r14], al
movsx eax, al
lea rbp, [0x180000000]
movzx esi, byte [rax + rbp + 0x348b00]
movzx eax, byte [rdx + 1]
shl esi, 2
test al, al
je 0x18016f366
movsx r9d, al
movsx eax, r9b
mov byte [r14 + 1], r9b
lea rdx, [rsp + 0xb0]
movzx edi, byte [rax + rbp + 0x348b00]
mov ecx, eax
shl edi, 6
xor ebx, ebx
mov eax, ebx
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
test cl, cl
je 0x18016f4b4
add cl, cl
inc eax
inc rdx
mov byte [rdx - 1], cl
cmp eax, 8
jb 0x18016f390
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xb0]
call fcn.18017f920
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r9d, edi
mov r8d, esi
call fcn.18017fc30
mov rax, qword [rsp + 0x20]
mov r8b, 0x80
mov ecx, eax
mov byte [rsp + 0xb0], al
mov byte [rsp + 0xb8], bl
shr ecx, 8
lea r9, [r14 + 2]
mov r10d, reloc.WS2_32.dll_inet_addr
mov byte [rsp + 0xb1], cl
mov ecx, eax
shr eax, 0x18
mov byte [rsp + 0xb3], al
shr ecx, 0x10
mov byte [rsp + 0xb2], cl
mov ecx, dword [rsp + 0x24]
mov eax, ecx
mov byte [rsp + 0xb4], cl
shr eax, 8
mov byte [rsp + 0xb5], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rsp + 0xb7], cl
mov byte [rsp + 0xb6], al
xor cl, cl
mov edx, 6
nop dword [rax]
add cl, cl
test byte [rsp + rbx + 0xb0], r8b
je 0x18016f45f
or cl, 1
shr r8b, 1
jne 0x18016f469
inc ebx
mov r8b, 0x80
dec rdx
jne 0x18016f450
movzx edx, cl
inc r9
movzx ecx, byte [rdx + rbp + 0x348b80]
mov byte [r9 - 1], cl
dec r10
jne 0x18016f445
mov byte [r14 + 0xd], r10b
mov rax, r14
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180243450
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
cmp eax, 8
jae 0x18016f3af
mov ecx, eax
nop
cmp rcx, 8
jae 0x18016f4dc
inc eax
mov byte [rsp + rcx + 0xb0], bl
inc rcx
cmp eax, 8
jb 0x18016f4c0
jmp 0x18016f3af
call fcn.180243300
int3
Function at 0x180171550
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0xc8
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r12, qword [rsp + 0x120]
xor ebx, ebx
mov rbp, r9
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
mov eax, ebx
test r9, r9
je 0x1801715b0
cmp r9, qword [rcx]
je 0x1801715a6
test rdx, rdx
je 0x1801717e9
test r8d, r8d
js 0x1801717e9
mov eax, 1
mov qword [rcx], r9
jmp 0x1801715bc
mov rbp, qword [rcx]
test rbp, rbp
je 0x1801717e9
mov qword [rsp + 0xc0], r15
test rdx, rdx
je 0x1801716df
mov rcx, rbp
call fcn.18016fcc0
movsxd rcx, eax
cmp rcx, 0x80
jbe 0x18017160c
lea r9, str.Z:metasploit_payloadscmeterpreterdepslibresslcryptohmachmac.c
mov edx, 0xfff
mov ecx, 6
mov r8d, 0x88
mov dword [rsp + 0x20], 0x59
call fcn.1801727e0
xor eax, eax
jmp 0x1801717e1
cmp ecx, esi
jge 0x180171662
lea rcx, [rdi + 8]
mov r8, r12
mov rdx, rbp
call fcn.18016ff60
test eax, eax
je 0x1801717d8
lea rcx, [rdi + 8]
mov r8, rsi
mov rdx, r14
call fcn.1801701a0
test eax, eax
je 0x1801717d8
lea r14, [rdi + 0x98]
lea rdx, [rdi + 0x9c]
lea rcx, [rdi + 8]
mov r8, r14
call fcn.18016fe80
test eax, eax
je 0x1801717d8
jmp 0x18017168b
test esi, esi
js 0x1801716b4
mov r8, rsi
cmp rsi, 0x80
ja 0x1801716b4
lea rcx, [rdi + 0x9c]
mov rdx, r14
call fcn.180230800
lea r14, [rdi + 0x98]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x1801716e7
mov eax, ecx
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rdi + 0x9c]
add rcx, rax
call fcn.180231610
jmp 0x1801716e7
lea r9, str.Z:metasploit_payloadscmeterpreterdepslibresslcryptohmachmac.c
mov edx, 0xfff
mov ecx, 6
mov r8d, 0x89
mov dword [rsp + 0x20], 0x66
call fcn.1801727e0
xor eax, eax
jmp 0x1801717e1
test eax, eax
je 0x1801717c7
lea rcx, [rsp + 0x30]
mov rax, rdi
mov rdx, rbx
sub rax, rcx
lea rsi, [rax + 0x9c]
lea r14, [rax + 0x9d]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x30]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x180171710
lea rcx, [rdi + 0x38]
mov r8, r12
mov rdx, rbp
call fcn.18016ff60
test eax, eax
je 0x1801717d8
mov rcx, rbp
call fcn.18016fcc0
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0x38]
movsxd r8, eax
call fcn.1801701a0
test eax, eax
je 0x1801717d8
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
add rcx, rbx
add rbx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rbx, 0x80
jl 0x180171770
lea rcx, [rdi + 0x68]
mov r8, r12
mov rdx, rbp
call fcn.18016ff60
test eax, eax
je 0x1801717d8
mov rcx, rbp
call fcn.18016fcc0
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0x68]
movsxd r8, eax
call fcn.1801701a0
test eax, eax
je 0x1801717d8
lea rdx, [rdi + 0x38]
lea rcx, [rdi + 8]
call fcn.180170270
test eax, eax
jne 0x1801717dc
xor eax, eax
jmp 0x1801717e1
mov eax, 1
mov r15, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180243450
add rsp, 0xc8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801734c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov esi, edx
mov rbp, rcx
call fcn.180188470
mov rbx, rax
call fcn.1801f70d0
lea rcx, str.uid__u_cmd__s__s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
mov r9, rbp
mov r8, rbx
mov edx, eax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], esi
call fcn.180173470
mov ecx, 1
call fcn.18023c7dc
int3
Function at 0x180188660
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rsi, ecx
xor r9d, r9d
mov rbx, r8
mov rcx, rsi
mov rdi, rdx
call qword [sym.imp.WS2_32.dll_recv]
cdqe
cmp rax, 0xffffffffffffffff
jne 0x1801886cf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2736
je 0x1801886c0
cmp eax, 0x2719
je 0x1801886c0
cmp eax, 0x276d
je 0x1801886c0
mov ecx, eax
call fcn.180188760
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8d, ebx
mov rdx, rdi
mov ecx, esi
call fcn.18023f140
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1801886e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rsi, ecx
xor r9d, r9d
mov rbx, r8
mov rcx, rsi
mov rdi, rdx
call qword [sym.imp.WS2_32.dll_send]
cdqe
cmp rax, 0xffffffffffffffff
jne 0x18018874f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2736
je 0x180188740
cmp eax, 0x2719
je 0x180188740
cmp eax, 0x276d
je 0x180188740
mov ecx, eax
call fcn.180188760
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r8d, ebx
mov rdx, rdi
mov ecx, esi
call fcn.18023facc
cdqe
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180189f20
Capabilities:
Encode data using xor

Disassembly:
xor r11d, r11d
test ecx, ecx
mov edx, ecx
setne r11b
mov r10d, reloc.WS2_32.dll_recv
nop dword [rax]
nop word [rax + rax]
mov ecx, r10d
mov r9d, edx
shr r9d, cl
mov eax, r9d
lea r8d, [r9 - 1]
xor r9d, edx
not eax
shr r8d, 0x1f
shr eax, 0x1f
and r8d, eax
dec r8d
and r9d, r8d
mov ecx, r8d
and ecx, r10d
xor edx, r9d
add r11d, ecx
shr r10d, 1
jne 0x180189f40
mov eax, r11d
ret
Function at 0x18018a0c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov ebp, ecx
cmp rdx, r8
je 0x18018a1ce
cmp r9, 0x7fffffff
ja 0x18018a1f7
cmp r9d, dword [rdx + 0xc]
jg 0x18018a100
mov rax, rdx
jmp 0x18018a10b
mov edx, r9d
mov rcx, rdi
call fcn.18018a410
test rax, rax
je 0x18018a1f7
cmp esi, dword [rbx + 0xc]
jg 0x18018a11e
mov rax, rbx
jmp 0x18018a128
mov edx, esi
mov rcx, rbx
call fcn.18018a410
test rax, rax
je 0x18018a1f7
mov ecx, dword [rdi + 8]
cmp ecx, esi
jg 0x18018a1d5
mov eax, dword [rbx + 8]
cmp eax, esi
jg 0x18018a1d5
xor eax, ecx
lea r10d, [rbp - 1]
not ebp
shr r10d, 0x1f
shr ebp, 0x1f
xor r9d, r9d
and r10d, ebp
movsxd r11, esi
dec r10d
and eax, r10d
xor ecx, eax
mov dword [rdi + 8], ecx
xor dword [rbx + 8], eax
mov ecx, dword [rdi + 0x10]
mov eax, dword [rbx + 0x10]
xor eax, ecx
and eax, r10d
xor ecx, eax
mov dword [rdi + 0x10], ecx
xor dword [rbx + 0x10], eax
mov ecx, dword [rdi + 0x14]
mov eax, ecx
xor eax, dword [rbx + 0x14]
and eax, r10d
and eax, 4
xor ecx, eax
mov dword [rdi + 0x14], ecx
xor dword [rbx + 0x14], eax
test esi, esi
jle 0x18018a1ce
nop word [rax + rax]
mov rax, qword [rdi]
mov ecx, dword [rax + r9*4]
lea rdx, [rax + r9*4]
mov rax, qword [rbx]
inc r9
mov r8d, dword [rax + r9*4 - 4]
xor r8d, ecx
and r8d, r10d
xor ecx, r8d
mov dword [rdx], ecx
mov rax, qword [rbx]
xor dword [rax + r9*4 - 4], r8d
cmp r9, r11
jl 0x18018a1a0
mov eax, 1
jmp 0x18018a1f9
mov ecx, 3
lea r9, str.Z:metasploit_payloadscmeterpreterdepslibresslcrypto_bn_bn_lib.c
mov edx, 0xfff
lea r8d, [rcx + 0x67]
mov dword [rsp + 0x20], 0x375
call fcn.1801727e0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1801a38e0
Capabilities:
Terminate process

Disassembly:
cmp rdx, 0x28
jb 0x1801a39bb
push rbx
sub rsp, 0x20
cmp qword [0x18051b5a0], 0
mov rbx, rcx
jne 0x1801a394a
mov edx, reloc.WS2_32.dll_recv
mov r8d, 0x3000
xor ecx, ecx
lea r9d, [rdx - 0xc]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x18051b5a0], rax
test rax, rax
je 0x1801a39da
mov edx, 0x440
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x18051b5a8], rax
test rax, rax
jne 0x1801a3951
jmp 0x1801a39bc
mov rax, qword [0x18051b5a8]
xor r9d, r9d
mov r8d, 0x100
mov rdx, rbx
mov rcx, rax
call fcn.1801a43a0
mov rdx, qword [0x18051b5a8]
xor eax, eax
mov qword [rdx + 0x30], rax
movzx eax, byte [rbx + 0x22]
movzx ecx, byte [rbx + 0x23]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x21]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x20]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x38], ecx
movzx eax, byte [rbx + 0x26]
movzx ecx, byte [rbx + 0x27]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x25]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x24]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x3c], ecx
add rsp, 0x20
pop rbx
ret
mov rcx, qword [0x18051b5a0]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov qword [0x18051b5a0], rax
mov ecx, 1
call fcn.18023c7dc
int3
Function at 0x1801a3b30
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub rsp, 0x58
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x20]
mov edx, 0x28
call fcn.1801e4200
cmp eax, 0xffffffff
jne 0x1801a3b68
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp qword [0x18051b5a0], 0
jne 0x1801a3b86
lea rcx, [rsp + 0x20]
mov edx, 0x28
call fcn.1801a38e0
jmp 0x1801a3c4e
mov rcx, qword [0x18051b5a8]
mov r9d, 0x400
lea rdx, [rcx + 0x40]
mov r8, rdx
call fcn.1801a3d30
mov eax, 1
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rsp + rax + 0x1f]
mov rdx, qword [0x18051b5a8]
lea rax, [rax + 5]
xor byte [rdx + rax + 0x3a], cl
movzx ecx, byte [rsp + rax + 0x1b]
mov rdx, qword [0x18051b5a8]
xor byte [rdx + rax + 0x3b], cl
movzx ecx, byte [rsp + rax + 0x1c]
mov rdx, qword [0x18051b5a8]
xor byte [rdx + rax + 0x3c], cl
movzx ecx, byte [rsp + rax + 0x1d]
mov rdx, qword [0x18051b5a8]
xor byte [rdx + rax + 0x3d], cl
movzx ecx, byte [rsp + rax + 0x1e]
mov rdx, qword [0x18051b5a8]
xor byte [rdx + rax + 0x3e], cl
lea rcx, [rax - 1]
cmp rcx, 0x28
jb 0x1801a3bb0
mov rcx, qword [0x18051b5a8]
mov edx, 0x28
add rcx, 0x40
call fcn.1801a38e0
mov rax, qword [0x18051b5a8]
xor ecx, ecx
mov qword [rax + 0x40], rcx
mov qword [rax + 0x48], rcx
mov qword [rax + 0x50], rcx
mov qword [rax + 0x58], rcx
mov qword [rax + 0x60], rcx
mov rax, qword [0x18051b5a0]
mov qword [rax], 0x3d8
lea rcx, [rsp + 0x20]
mov edx, 0x28
call fcn.180187af0
mov rax, qword [0x18051b5a0]
xor edx, edx
mov qword [rax], 0
mov rcx, qword [0x18051b5a8]
mov r8d, 0x400
add rcx, 0x40
call fcn.180231610
mov rax, qword [0x18051b5a0]
mov qword [rax + 8], 0x186a00
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180243450
add rsp, 0x58
ret

Function at 0x1801a3cb0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x18051b598]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x1801a3cef
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rcx, rax
xor eax, eax
lock cmpxchg qword [0x18051b598], rcx
je 0x1801a3cef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x18051b598]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, rbx
mov rcx, rdi
call fcn.1801a39f0
mov rcx, qword [0x18051b598]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_ReleaseMutex]
Function at 0x1801a43a0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
movzx eax, byte [rdx + 2]
movzx r9d, byte [rdx + 3]
mov r10, rcx
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx + 1]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx]
shl r9d, 8
or r9d, eax
mov dword [rcx + 0x10], r9d
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x18], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x1c], ecx
cmp r8d, 0x100
jne 0x1801a444b
add rdx, 0x10
lea r8, [0x180375f20]
jmp 0x1801a4452
lea r8, [0x180375f30]
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x20], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x24], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x28], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x2c], ecx
movsx eax, byte [r8 + 2]
movsx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [r10], ecx
movsx eax, byte [r8 + 6]
movsx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 4], ecx
movsx eax, byte [r8 + 0xa]
movsx ecx, byte [r8 + 0xb]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 8], ecx
movsx ecx, byte [r8 + 0xf]
movsx eax, byte [r8 + 0xe]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 0xd]
shl ecx, 8
or ecx, eax
movsx eax, byte [r8 + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0xc], ecx
ret
Function at 0x1801ae350
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.180231610
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1801afb60
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x60]
call fcn.180231610
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1801b2450
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.180231610
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], 0x1c
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1801b27e0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.180231610
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1801bc230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rsp + 0x90], 0
mov r15, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov ebx, dword [r15]
mov r13, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
je 0x1801bc37f
test ebx, ebx
je 0x1801bc2a7
nop word [rax + rax]
test rdi, rdi
je 0x1801bc2a7
movzx edx, byte [r14]
mov ecx, ebx
inc rsi
movzx eax, byte [rcx + rbp]
inc r14
dec rdi
xor edx, eax
inc ebx
mov byte [rcx + rbp], dl
mov byte [rsi - 1], dl
and ebx, 7
jne 0x1801bc280
cmp rdi, 8
jb 0x1801bc34b
mov r15, rsi
mov r13, rdi
mov r12, r14
shr r13, 3
sub r15, rbp
sub r12, rbp
imul rax, r13, 0xfffffffffffffff8
add rdi, rax
lea rax, [r13*8]
add rsi, rax
add r14, rax
mov qword [rsp + 0x68], rsi
mov rsi, qword [rsp + 0x78]
mov rdx, rsi
mov rcx, rbp
call fcn.1801bd9c0
cmp ebx, 8
jae 0x1801bc32a
mov edx, 7
mov ecx, ebx
sub edx, ebx
add rcx, rbp
shr edx, 3
inc edx
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r12 + rcx]
lea rcx, [rcx + 8]
xor qword [rcx - 8], rax
mov rax, qword [rcx - 8]
mov qword [r15 + rcx - 8], rax
dec rdx
jne 0x1801bc310
add r15, 8
add r12, 8
xor ebx, ebx
dec r13
jne 0x1801bc2e3
mov rsi, qword [rsp + 0x68]
mov r13, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x1801bc45a
mov rdx, r13
mov rcx, rbp
call fcn.1801bd9c0
nop
mov edx, ebx
inc ebx
movzx ecx, byte [rdx + r14]
movzx eax, byte [rdx + rbp]
xor ecx, eax
mov byte [rdx + rbp], cl
mov byte [rdx + rsi], cl
dec rdi
jne 0x1801bc360
jmp 0x1801bc45a
test ebx, ebx
je 0x1801bc3aa
test rdi, rdi
je 0x1801bc3aa
movzx edx, byte [r14]
mov ecx, ebx
inc rsi
movzx eax, byte [rcx + rbp]
inc r14
dec rdi
xor al, dl
inc ebx
mov byte [rsi - 1], al
mov byte [rcx + rbp], dl
and ebx, 7
jne 0x1801bc383
cmp rdi, 8
jb 0x1801bc42a
mov r12, rdi
mov r15, rsi
shr r12, 3
sub r15, rbp
imul rax, r12, 0xfffffffffffffff8
add rdi, rax
mov rdx, r13
mov rcx, rbp
call fcn.1801bd9c0
cmp ebx, 8
jae 0x1801bc40f
mov r9d, 7
mov r8d, ebx
mov r10, r14
sub r9d, ebx
add r8, rbp
sub r10, rsi
shr r9d, 3
inc r9d
lea rcx, [r15 + r8]
lea r8, [r8 + 8]
mov rdx, qword [rcx + r10]
mov rax, rdx
xor rax, qword [r8 - 8]
mov qword [rcx], rax
mov qword [r8 - 8], rdx
dec r9
jne 0x1801bc3f0
add rsi, 8
add r15, 8
add r14, 8
xor ebx, ebx
dec r12
jne 0x1801bc3c4
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x1801bc45a
mov rdx, r13
mov rcx, rbp
call fcn.1801bd9c0
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + r14]
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rcx + rsi], al
mov byte [rcx + rbp], dl
dec rdi
jne 0x1801bc440
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret