joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140033160
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400331aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400331aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400331aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400331aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400331aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400331ac
xor al, al
add rsp, 0x28
ret

Function at 0x14016d6e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14016d70d
xor al, al
jmp 0x14016d86f
mov rax, qword [0x14018e6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14018e6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14018e6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14018e6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14018e6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14018e6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14018e6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14018e6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14018e700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14016d861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14016d7b9
mov r11d, 2
jmp 0x14016d7dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14016d7d3
mov r11d, 1
jmp 0x14016d7dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14016d885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14016d822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14016d83a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14016d84a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14016d858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14016d7a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14016d86a
Function at 0x18000c730
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x18000c755
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
inc rcx
xor dl, al
or r9b, dl
dec r8
jne 0x18000c740
movzx eax, r9b
ret
Function at 0x18000d480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r10, dword [rdx + 8]
lea rbx, [rcx - 1]
movsxd rcx, dword [r8 + 8]
xor rcx, r10
shr rbx, 0x3f
movsxd rsi, r9d
dec rbx
lea eax, [rsi - 1]
mov r11, r8
and rcx, rbx
mov rdi, rdx
xor r10d, ecx
mov dword [rdx + 8], r10d
xor dword [r8 + 8], ecx
cmp eax, 9
ja case.default.0x18000d4d7
lea rdx, sym.AliAuthSDK.dll_CB9L_7.qqAbQQMYOd__cGhb1_j__94QEyzIa__9fXt
cdqe
mov ecx, dword [rdx + rax*4 + 0xd680]
add rcx, rdx
jmp rcx
mov r9d, 0xa
cmp r9, rsi
jge case.0x18000d4d7.10
nop word [rax + rax]
mov rax, qword [r11]
mov r8, qword [rdi]
inc r9
mov rcx, qword [r8 + r9*8 - 8]
mov rdx, qword [rax + r9*8 - 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8 - 8], rcx
mov rax, qword [r11]
xor qword [rax + r9*8 - 8], rdx
cmp r9, rsi
jl 0x18000d4f0
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x48]
mov rdx, qword [rax + 0x48]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x48], rcx
mov rax, qword [r11]
xor qword [rax + 0x48], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x40]
mov rdx, qword [rax + 0x40]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x40], rcx
mov rax, qword [r11]
xor qword [rax + 0x40], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x38]
mov rdx, qword [rax + 0x38]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x38], rcx
mov rax, qword [r11]
xor qword [rax + 0x38], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x30]
mov rdx, qword [rax + 0x30]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x30], rcx
mov rax, qword [r11]
xor qword [rax + 0x30], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x28]
mov rdx, qword [rax + 0x28]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x28], rcx
mov rax, qword [r11]
xor qword [rax + 0x28], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x20]
mov rdx, qword [rax + 0x20]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x20], rcx
mov rax, qword [r11]
xor qword [rax + 0x20], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x18]
mov rdx, qword [rax + 0x18]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x18], rcx
mov rax, qword [r11]
xor qword [rax + 0x18], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x10]
mov rdx, qword [rax + 0x10]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x10], rcx
mov rax, qword [r11]
xor qword [rax + 0x10], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 8]
mov rdx, qword [rax + 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 8], rcx
mov rax, qword [r11]
xor qword [rax + 8], rdx
mov r8, qword [rdi]
mov rax, qword [r11]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [r8]
mov rcx, qword [rax]
mov rdi, qword [rsp + 0x18]
xor rcx, rdx
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rdx, rcx
mov qword [r8], rdx
mov rax, qword [r11]
xor qword [rax], rcx
ret
Function at 0x180012210
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x180012268
movzx eax, byte [rcx]
test al, al
je 0x180012268
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x180012230
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret
Function at 0x180013420
Capabilities:
Encode data using xor

Disassembly:
mov eax, Ordinal_41
call fcn.1801c83e0
sub rsp, rax
add rsp, 0x28
jmp 0x180013420
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1801c83e0
sub rsp, rax
mov rbx, r8
call fcn.180012e30
test eax, eax
js 0x18001365e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1800134a9
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop dword [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x180013460
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x18001365c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, sym.AliAuthSDK.dll_CB9L_7.qqAbQQMYOd__cGhb1_j__94QEyzIa__9fXt
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x204480]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x204480]
mov r9d, dword [rdi + rdx*4 + 0x205080]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x205880]
movzx ecx, byte [rdi + rax*4 + 0x204480]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x205c80]
movzx ecx, byte [rdi + rax*4 + 0x204480]
xor r9d, dword [rdi + rcx*4 + 0x205480]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x204480]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x204480]
mov r8d, dword [rdi + rdx*4 + 0x205080]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x205880]
movzx ecx, byte [rdi + rax*4 + 0x204480]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x205480]
movzx ecx, byte [rdi + rax*4 + 0x204480]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x205c80]
mov eax, r9d
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x204480]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x204480]
mov r8d, dword [rdi + rdx*4 + 0x205080]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x205880]
movzx ecx, byte [rdi + rax*4 + 0x204480]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x205480]
movzx ecx, byte [rdi + rax*4 + 0x204480]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x205c80]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x204480]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x204480]
mov r8d, dword [rdi + rdx*4 + 0x205880]
mov eax, r9d
xor r8d, dword [rdi + rcx*4 + 0x205480]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x204480]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x205080]
movzx ecx, byte [rdi + rax*4 + 0x204480]
xor r8d, dword [rdi + rcx*4 + 0x205c80]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1800134d0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800141f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1801c83e0
sub rsp, rax
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
mov r10, r14
cmp r8, 0x10
jb 0x180014298
mov qword [rsp + 0x40], rsi
mov rsi, r8
shr rsi, 4
mov rax, rsi
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop word [rax + rax]
mov r8, rbx
sub r10, rbp
mov rcx, rbp
sub r8, rbp
mov edx, 2
mov rax, qword [r10 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r8 + rcx - 8], rax
jne 0x180014261
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rbx, 0x10
add rbp, 0x10
dec rsi
jne 0x180014250
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x180014327
mov rdx, r10
mov r9, rbx
xor r8d, r8d
sub rdx, rbp
sub r9, rbp
mov rcx, rbp
cmp r8, rdi
jae 0x1800142d2
movzx eax, byte [rdx + rcx]
inc r8
inc rcx
xor al, byte [rcx - 1]
mov byte [r9 + rcx - 1], al
cmp r8, 0x10
jb 0x1800142b3
jmp 0x180014300
cmp r8, 0x10
jae 0x180014300
mov edx, reloc.WS2_32.dll_recv
sub r10, rbx
lea rcx, [r8 + rbx]
sub rdx, r8
nop word [rax + rax]
movzx eax, byte [r10 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1800142f0
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x180014327
add rbx, 0x10
add rbp, 0x10
sub rdi, 0x10
jne 0x1800142a1
mov rax, qword [r10]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov qword [r14], rax
mov rax, qword [r10 + 8]
mov qword [r14 + 8], rax
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x180014350
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x40
call fcn.1801c83e0
sub rsp, rax
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp rcx, rdx
je 0x180014408
mov qword [rsp + 0x90], r12
mov r12, r13
cmp rbx, 0x10
jb 0x1800143ed
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop word [rax + rax]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call r15
mov r11, qword [r12]
add rsi, 0x10
xor qword [rsi - 0x10], r11
mov rax, qword [r12 + 8]
mov r12, rdi
xor qword [rsi - 8], rax
add rdi, 0x10
dec rbp
jne 0x1800143c0
mov rax, qword [r12]
mov qword [r13], rax
mov rax, qword [r12 + 8]
mov r12, qword [rsp + 0x90]
mov qword [r13 + 8], rax
jmp 0x180014464
cmp rbx, 0x10
jb 0x180014464
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
mov r11, qword [rdi]
mov rax, qword [r13]
xor rax, qword [rsp + 0x20]
add rsi, 0x10
add rdi, 0x10
mov qword [rsi - 0x10], rax
mov rax, qword [r13 + 8]
mov qword [r13], r11
mov rcx, qword [rdi - 8]
xor rax, qword [rsp + 0x28]
dec rbp
mov qword [rsi - 8], rax
mov qword [r13 + 8], rcx
jne 0x180014420
test rbx, rbx
je 0x1800144ff
lea rax, [rsp + 0x20]
mov rbp, r13
sub rbp, rax
lea rax, [rsp + 0x20]
sub rsi, rax
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
xor r11d, r11d
cmp r11, rbx
jae 0x1800144bf
movzx r8d, byte [rdi + r11]
movzx ecx, byte [rsp + r11 + 0x20]
lea rdx, [r11 + rbp]
xor cl, byte [rsp + rdx + 0x20]
lea rax, [rsi + r11]
inc r11
mov byte [rsp + rax + 0x20], cl
mov byte [rsp + rdx + 0x20], r8b
cmp r11, 0x10
jb 0x180014491
cmp rbx, 0x10
jbe 0x1800144d5
add rdi, 0x10
add rsi, 0x10
sub rbx, 0x10
jne 0x180014480
jmp 0x1800144ff
cmp r11, 0x10
jae 0x1800144ff
mov edx, reloc.WS2_32.dll_recv
sub rdi, r13
lea rcx, [r13 + r11]
sub rdx, r11
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1800144f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801c74b0
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001b740
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, gethostbyname
call fcn.1801c83e0
sub rsp, rax
mov rbx, rdx
mov rsi, rcx
call fcn.18001afb0
mov rdi, rax
test rax, rax
jne 0x18001b819
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [0x1802a6700]
lea edx, [rdi + 1]
lea ecx, [rdi + 2]
mov r8d, eax
mov dword [rsp + 0x20], 0xaf
call fcn.180004810
lea r11, [0x1802a6718]
lea r9, [0x1802a671c]
mov qword [rsp + 0x28], r11
lea rdx, [0x1802a6720]
lea ecx, [rdi + 5]
mov r8, rsi
mov qword [rsp + 0x20], rbx
call fcn.180004bf0
call fcn.1801dc228
cmp dword [rax], 2
je 0x18001b7e5
call fcn.1801dc228
cmp dword [rax], 6
je 0x18001b7e5
mov dword [rsp + 0x20], 0xb8
lea r9, [0x1802a6740]
lea r8d, [rdi + 2]
jmp 0x18001b7fa
mov dword [rsp + 0x20], 0xb6
lea r9, [0x1802a6728]
mov r8d, 0x80
mov edx, WSAGetLastError
lea ecx, [rdx - 0x4d]
call fcn.180004810
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x1802a66b0]
call fcn.180002230
mov rbx, rax
test rax, rax
jne 0x18001b847
mov rcx, rdi
call fcn.1801dc46c
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rax
call fcn.180001850
mov edx, 0x6a
mov r9, rdi
lea r8d, [rdx - 0x69]
mov rcx, rbx
call fcn.180001e20
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18001c6f0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1801c83e0
sub rsp, rax
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x18001c7fd
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, [0x180206b60]
nop dword [rax + rax]
movzx ecx, byte [r10 - 1]
cmp r8d, 3
jl 0x18001c77f
movzx eax, byte [r10]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 2], al
movzx eax, byte [rdx + rbx]
mov byte [r9 + 3], al
jmp 0x18001c7d4
shl ecx, 0x10
cmp r8d, 2
jne 0x18001c791
movzx eax, byte [r10]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
cmp r8d, 1
jne 0x18001c7c0
lea eax, [r8 + 0x3c]
jmp 0x18001c7cb
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
sub r8d, 3
add r9, 4
add r11d, 4
add r10, 3
test r8d, r8d
jg 0x18001c720
mov rbx, qword [rsp]
mov byte [r9], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x1800314e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, 0xb0
call fcn.1801c83e0
sub rsp, rax
mov rax, qword [0x1802d1460]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, qword [rsp + 0x120]
mov rax, qword [rsp + 0x110]
mov r14, qword [rsp + 0x128]
mov ebx, r9d
mov qword [rsp + 0x40], r8
mov r13, rcx
mov qword [rsp + 0x38], rax
lea esi, [rdx - 1]
mov dword [rsp + 0x30], ebx
test rbp, rbp
jne 0x180031547
call fcn.180022100
mov rbp, rax
test r14, r14
mov rcx, rbp
cmove r14, rbp
call fcn.18001d1d0
mov r15d, esi
movsxd r12, eax
lea eax, [r12 + r12]
sub r15d, eax
lea ecx, [r15 - 1]
cmp ebx, ecx
jle 0x180031594
mov edx, 0xa0
lea r9, [0x1802b44a0]
mov ecx, 4
lea r8d, [rdx - 0x32]
mov dword [rsp + 0x20], Ordinal_60
call fcn.180004810
xor eax, eax
jmp 0x180031724
inc eax
cmp esi, eax
jge 0x1800315c3
mov edx, 0xa0
lea r9, [0x1802b44b8]
mov ecx, 4
lea r8d, [rdx - 0x28]
mov dword [rsp + 0x20], 0x40
call fcn.180004810
xor eax, eax
jmp 0x180031724
movsxd rdx, dword [rsp + 0x118]
mov rcx, qword [rsp + 0x38]
mov byte [r13], 0
lea rbx, [r13 + 1]
lea r13, [r12 + r13 + 1]
xor r9d, r9d
mov r8, r13
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0x28], 0
mov rdi, r12
mov qword [rsp + 0x20], rbp
call fcn.180034a70
test eax, eax
je 0x180031690
mov ebp, dword [rsp + 0x30]
lea rcx, [r12 + r13]
xor edx, edx
sub r15d, ebp
dec r15d
movsxd r8, r15d
call fcn.1801c9e80
mov rdx, qword [rsp + 0x40]
movsxd r11, ebp
movsxd rcx, esi
mov r8d, ebp
sub rcx, r11
sub rcx, r12
add rcx, r13
mov byte [rcx - 1], 1
call fcn.1801c9a10
mov edx, r12d
mov rcx, rbx
call fcn.1800103b0
test eax, eax
jle 0x180031690
sub esi, r12d
lea rdx, [0x1802b44d0]
mov r8d, 0x55
mov ecx, esi
call fcn.18000bcf0
mov rbp, rax
test rax, rax
jne 0x180031697
lea r9, [0x1802b44e8]
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
mov edx, 0xa0
mov dword [rsp + 0x20], 0x57
call fcn.180004810
xor eax, eax
jmp 0x18003171c
mov r9d, r12d
mov r8, rbx
mov edx, esi
mov rcx, rax
mov qword [rsp + 0x20], r14
call fcn.180031360
test eax, eax
js 0x180031690
test esi, esi
jle 0x1800316d0
mov r9, rbp
mov rcx, r13
mov edx, esi
sub r9, r13
nop
movzx eax, byte [r9 + rcx]
inc rcx
xor byte [rcx - 1], al
dec rdx
jne 0x1800316c0
lea rcx, [rsp + 0x50]
mov r9d, esi
mov r8, r13
mov edx, r12d
mov qword [rsp + 0x20], r14
call fcn.180031360
test eax, eax
js 0x180031690
test r12d, r12d
jle 0x18003170f
lea rcx, [rsp + 0x50]
sub rcx, rbx
nop dword [rax]
movzx eax, byte [rcx + rbx]
inc rbx
xor byte [rbx - 1], al
dec rdi
jne 0x180031700
mov rcx, rbp
call fcn.18000bff0
mov eax, 1
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1801c74b0
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x180031c50
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, gethostname
call fcn.1801c83e0
sub rsp, rax
mov r10, rcx
cmp dword [rsp + 0x60], r9d
jne 0x180031d3d
movzx eax, byte [r8]
cmp al, 0x6a
je 0x180031c7b
cmp al, 0x6b
jne 0x180031d3d
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp al, 0x6b
jne 0x180031cec
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x180031ca8
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x180031ca8
cmp cl, 0xbb
jne 0x180031cdb
inc eax
cmp eax, ebx
jl 0x180031c92
sub ebx, eax
test eax, eax
jne 0x180031cf0
mov dword [rsp + 0x20], 0x83
lea r9, [0x1802b45c0]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.180004810
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x1802b45a8]
jmp 0x180031cbd
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x180031d26
mov edx, 0x80
lea r9, str..crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], Ordinal_143
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.180004810
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r10
call fcn.1801c9a10
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
lea r9, [0x1802b4590]
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.180004810
or eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x1800353e0
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1801c83e0
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.1801c9e80
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180044910
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1801c83e0
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call fcn.1801c9e80
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180045fc0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1801c83e0
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.1801c9e80
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], Ordinal_32
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180046030
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1801c83e0
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.1801c9e80
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], reloc.WLDAP32.dll_Ordinal_32
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1800578d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, Ordinal_41
call fcn.1801c83e0
sub rsp, rax
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x180057919
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1800578fd
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x180057919
xorpd xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.180010360
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x180057936
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorpd xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.180010360
add rsp, 0x28
ret