joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011e90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x2050
call fcn.1800335d0
sub rsp, rax
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [rsp + 0x20]
call fcn.1800049b0
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.180005970
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18006549c
add qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov rbx, rax
call fcn.180005b00
xor eax, eax
test rbx, rbx
setne al
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.180033630
mov rbx, qword [rsp + 0x2078]
add rsp, 0x2050
pop rdi
ret

Function at 0x1800169d0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.180016050
test rax, rax
je 0x180016a28
mov r8, qword [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_send
sub rax, rbx
mov qword [r14], r8
mov dword [r14 + 8], ecx
inc rax
jmp 0x180016baa
lea rdx, [0x180095d10]
mov rcx, rbx
call fcn.18006f970
test rax, rax
je 0x180016a5f
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x180016ba8
cmp edi, 0x78
jne 0x180016a61
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180016d10
jmp 0x180016a6e
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18006f8bc
mov rcx, qword [rsp + 0x20]
lea rbp, [0x180094580]
cmp rcx, rbx
jne 0x180016a83
xor eax, eax
jmp 0x180016aad
movzx edx, byte [rcx]
test byte [rdx + rbp + 1], 8
je 0x180016aa5
nop dword [rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x180016a90
movzx edx, al
xor eax, eax
test dl, dl
cmove rax, rcx
test rax, rax
jne 0x180016b92
mov edx, 0x2e
mov rcx, rbx
call fcn.18005d218
mov rsi, rax
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x180016ad0
cmp rcx, 0xc8
ja 0x180016ba8
test rsi, rsi
je 0x180016ba8
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180016b00
call fcn.180066db8
sub rsi, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x180016b36
call fcn.180016d10
jmp 0x180016b3b
call fcn.18006f8bc
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
cmp rcx, rax
jne 0x180016b4e
xor eax, eax
jmp 0x180016b8d
movzx edx, byte [rcx]
test byte [rdx + rbp + 1], 8
je 0x180016b75
nop dword [rax + rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x180016b60
movzx edx, al
xor eax, eax
test dl, dl
cmove rax, rcx
test rax, rax
je 0x180016ba8
lea rcx, [rsp + 0x30]
sub rax, rcx
add rax, rbx
test rax, rax
je 0x180016ba8
mov ecx, 3
movsd qword [r14], xmm0
sub rax, rbx
mov dword [r14 + 8], ecx
inc rax
jmp 0x180016baa
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180033630
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180016d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x80], rbx
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rdx
call fcn.180066db8
xor esi, esi
lea r11, [0x180094580]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x180016d7f
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x180016d70
mov qword [rsp + 0x30], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x180016d96
mov r12d, ebp
jmp 0x180016da0
cmp byte [rbx], 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x80]
jne 0x180016ef8
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180016ef8
movsd xmm2, qword [0x180095d80]
lea r13, [0x180094580]
add rdx, 2
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x180016dfb
test edi, edi
jne 0x180016e50
mov edi, ebp
inc rdx
jmp 0x180016de0
test byte [r8 + r13 + 1], 0x10
je 0x180016e50
test r10d, r10d
jne 0x180016e13
cmp r8b, 0x30
jne 0x180016e13
inc r14d
jmp 0x180016e44
inc r10d
cmp r10d, 0x1e
jg 0x180016e41
test byte [rcx + r13 + 1], 2
je 0x180016e29
add ecx, 0xffffffd0
jmp 0x180016e2f
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x180016e44
inc r9d
test edi, edi
je 0x180016e4b
dec r9d
inc rdx
jmp 0x180016de0
mov r13, qword [rsp + 0x20]
lea eax, [r14 + r10]
test eax, eax
je 0x180016ef8
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x180016edf
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x180016e87
lea rdx, [r11 + 2]
jmp 0x180016e91
cmp al, 0x2b
jne 0x180016e8f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x180094580]
test byte [r8 + r11 + 1], 2
je 0x180016ef8
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x180016eb0
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x180016eeb
xorps xmm1, xmmword [0x180095d90]
mov edx, r9d
movaps xmm0, xmm1
call fcn.18006c168
jmp 0x180016efb
xorps xmm0, xmm0
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret

Function at 0x18001c370
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r9, rdx
xor eax, r8d
mov r10, rcx
mov r8, rdx
shr r8, 5
inc r8
cmp rdx, r8
jb 0x18001c3ae
nop word [rax + rax]
movzx edx, byte [r10 + r9 - 1]
mov ecx, eax
shl ecx, 5
sub r9, r8
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
cmp r9, r8
jae 0x18001c390
ret
Function at 0x18001c5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x18001c605
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.18001c120
movabs rax, 0x7fffffffffffffe7
cmp rsi, rax
jae 0x18001c66d
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x50]
call fcn.18000ec10
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call fcn.18008f590
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.180014e70
int3

Function at 0x180029340
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x2058
call fcn.1800335d0
sub rsp, rax
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2040], rax
mov rbx, rdx
lea rcx, [rsp + 0x32]
mov eax, 0x23
xor edx, edx
mov r8d, 0x1006
mov word [rsp + 0x30], ax
call fcn.18008fc30
lea rdi, [rsp + 0x2080]
call fcn.180002580
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x1040]
mov r9, rbx
mov qword [rsp + 0x20], 0
mov r8d, 0x1000
mov rcx, qword [rax]
call fcn.18006466c
lea r8, [rsp + 0x1040]
mov edx, 0x1008
lea rcx, [rsp + 0x30]
call fcn.18006146c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x30]
call fcn.180022930
mov rcx, qword [rsp + 0x2040]
xor rcx, rsp
call fcn.180033630
add rsp, 0x2058
pop rdi
pop rbx
ret

Function at 0x180029580
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180029611
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x180029608
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1800295f3
inc rax
test ecx, ecx
jne 0x1800295e0
test edx, edx
je 0x180029634
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1800295d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180033630
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x180029613
Function at 0x18002b5b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x18002b5d4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x18002b662
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18002b630
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x18002b630
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.18008f590
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18002b64d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18002b655
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x18002b5f1
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x18002b740
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x18002b679
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18002b67b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18002b6ad
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.18008f590
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18002b73d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18002b6e8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18002b71e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.18006549c
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18002b73d
cmp rsi, rax
ja 0x18002b6f1
test rsi, rsi
je 0x18002b73d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.18006549c
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x18002c2e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea r8, [0x180093d5c]
lea rcx, [rsp + 0x20]
call fcn.1800651e4
mov rsi, qword [rsp + 0x20]
mov rcx, rsi
call fcn.180067874
mov edi, eax
xor edx, edx
mov r8d, 2
mov rcx, rsi
call fcn.1800671b0
mov rcx, rsi
call fcn.180067874
movsxd rbx, eax
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call fcn.1800671b0
add rbx, 2
mov rcx, rbx
call fcn.1800732b8
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.18008fc30
mov r9, qword [rsp + 0x20]
mov r8, rbx
mov edx, 1
mov rcx, rdi
call fcn.18006549c
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdi + r8], 0
jne 0x18002c390
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180027940
nop
mov rcx, qword [rsp + 0x20]
call fcn.180064c34
mov rdx, rdi
lea rcx, [0x1800b8b32]
call fcn.18002c1e0
mov rcx, rdi
call fcn.180064780
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x18002c403
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002c3fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c420
call fcn.1800331c0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180033630
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.1800613f4
int3
Function at 0x180034740
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x2c8
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rdx, [rsp + 0xb0]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x1800348d3
mov dword [rsp + 0x20], 0
jmp 0x180034793
mov eax, dword [rsp + 0x20]
add eax, 4
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
movsx eax, byte [rsp + rax + 0xb0]
test eax, eax
je 0x1800348d3
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009b5fc]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
je 0x1800347e8
movsxd rax, dword [rsp + 0x20]
lea rax, [rsp + rax + 0xb0]
lea rdx, [0x18009b624]
mov rcx, rax
call fcn.18008f2a0
test eax, eax
jne 0x1800347ea
jmp 0x180034788
movsxd rax, dword [rsp + 0x20]
mov ecx, 1
imul rcx, rcx, 0
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, dword [rsp + 0x20]
inc eax
cdqe
mov ecx, 1
imul rcx, rcx, 1
movzx eax, byte [rsp + rax + 0xb0]
mov byte [rsp + rcx + 0x24], al
mov eax, 1
imul rax, rax, 2
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 3
jae 0x180034839
jmp 0x18003483e
call fcn.180033f60
mov rax, qword [rsp + 0x30]
mov byte [rsp + rax + 0x24], 0
mov r8d, 0x64
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
jne 0x180034866
xor eax, eax
jmp 0x1800348d5
lea rcx, [rsp + 0x40]
call fcn.180076dd0
mov dword [rsp + 0x28], eax
movsxd rax, dword [rsp + 0x28]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.180065920
test eax, eax
jne 0x1800348ce
lea rdx, [rsp + 0x24]
mov rcx, qword [rsp + 0x2d8]
call fcn.180076d00
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x2d0]
add rcx, rax
mov rax, rcx
mov rdx, rax
mov rcx, qword [rsp + 0x2d8]
call fcn.180076c60
mov eax, 1
jmp 0x1800348d5
jmp 0x180034788
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.180033630
add rsp, 0x2c8
ret

Function at 0x180034900
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x150
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x31]
mov rdi, rax
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, eax
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x18003495c
xor eax, eax
jmp 0x1800349b9
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.PSAPI.DLL_GetProcessImageFileNameA
test eax, eax
jne 0x180034984
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800349b9
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0x30]
call fcn.180034740
test eax, eax
jne 0x1800349a9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800349b9
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180033630
add rsp, 0x150
pop rdi
ret
Function at 0x180038430
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp], 0
mov eax, 1
imul rax, rax, 0
movzx ecx, byte [rsp + 0x30]
mov byte [rsp + rax + 8], cl
mov dword [rsp + 4], 1
jmp 0x18003846c
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 4
jge 0x1800384b9
mov eax, dword [rsp + 4]
dec eax
cdqe
movzx eax, byte [rsp + rax + 8]
shl eax, 1
movsxd rcx, dword [rsp + 4]
mov byte [rsp + rcx + 8], al
mov eax, dword [rsp + 4]
dec eax
cdqe
movzx eax, byte [rsp + rax + 8]
and eax, 0x80
test eax, eax
je 0x1800384b7
movsxd rax, dword [rsp + 4]
movzx eax, byte [rsp + rax + 8]
xor eax, 0x1b
movsxd rcx, dword [rsp + 4]
mov byte [rsp + rcx + 8], al
jmp 0x180038462
mov dword [rsp + 4], 0
jmp 0x1800384cd
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 4
jge 0x1800384fd
movzx eax, byte [rsp + 0x28]
mov ecx, dword [rsp + 4]
sar eax, cl
and eax, 1
test eax, eax
je 0x1800384fb
movsxd rax, dword [rsp + 4]
movzx eax, byte [rsp + rax + 8]
movzx ecx, byte [rsp]
xor ecx, eax
mov eax, ecx
mov byte [rsp], al
jmp 0x1800384c3
movzx eax, byte [rsp]
add rsp, 0x18
ret

Function at 0x180039650
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax + 0x68], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x10325476
ret
Function at 0x18003c7c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1800b7480]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0xffffffff
je 0x18003c7f7
mov rcx, qword [rsp + 0x50]
call fcn.18003c970
call fcn.18003d160
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
cmp dword [rax + 8], 0xffffffff
jne 0x18003c816
xor eax, eax
jmp 0x18003c958
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8d, 6
mov edx, 1
mov ecx, 2
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, qword [rsp + 0x50]
movsxd rcx, dword [rcx + 8]
mov rdx, qword [0x1800b9af8]
mov qword [rdx + rcx*8], rax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1800b9af8]
cmp qword [rcx + rax*8], 0xffffffffffffffff
je 0x18003c942
mov eax, 2
mov word [rsp + 0x28], ax
movzx ecx, word [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x2a], ax
mov ecx, dword [rsp + 0x58]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + 0x28]
mov rcx, qword [0x1800b9af8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x18003c904
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x18003c904
mov dword [rsp + 0x20], 1
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1800b9af8]
mov r8, qword [rcx + rax*8]
mov rax, qword [rsp + 0x50]
mov edx, dword [rax + 8]
mov rcx, qword [rsp + 0x50]
call fcn.18003d1d0
jmp 0x18003c942
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1800b9af8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 8]
mov rcx, qword [0x1800b9af8]
mov qword [rcx + rax*8], 0xffffffffffffffff
mov rax, qword [rsp + 0x50]
mov dword [rax + 8], 0xffffffff
mov rax, qword [rsp + 0x50]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180033630
add rsp, 0x48
ret
Function at 0x18003cb20
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x1800b9af8], 0
je 0x18003cbf4
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0xffffffff
je 0x18003cbf4
cmp dword [rsp + 0x50], 0
je 0x18003cbf4
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 8]
xor r9d, r9d
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [0x1800b9af8]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.WS2_32.dll_send]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jle 0x18003cbc6
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
jmp 0x18003cbef
cmp qword [0x1800b9b00], 0
je 0x18003cbef
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 8]
mov edx, 0xffffffff
mov rcx, qword [0x1800b9b00]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x18003cb45
mov rax, qword [rsp + 0x40]
add rax, 0x34
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0x38
ret

Function at 0x18003d020
Capabilities:
Create thread

Disassembly:
mov byte [rsp + 8], cl
sub rsp, 0x28
movzx eax, byte [rsp + 0x30]
cmp eax, 0x40
jg 0x18003d03b
movzx eax, byte [rsp + 0x30]
test eax, eax
jne 0x18003d03f
xor eax, eax
jmp 0x18003d0b4
movsx eax, word [0x1800b9b10]
test eax, eax
jne 0x18003d0af
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x1800b9af0], rax
movzx eax, byte [rsp + 0x30]
mov word [0x1800b9b10], ax
xor r8d, r8d
xor edx, edx
lea rcx, [0x18003d2c0]
call fcn.180077eb0
mov qword [0x1800b74f0], rax
mov edx, 0xffffffff
mov rcx, qword [0x1800b9af0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1800b9af0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1800b9af0], 0
mov eax, 1
add rsp, 0x28
ret
Function at 0x18003d1d0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
mov dword [rax + 8], ecx
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [0x1800b9b08]
mov rdx, qword [rsp + 0x50]
mov qword [rcx + rax*8], rdx
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [0x1800b9af8]
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax*8], rdx
movsxd rax, dword [rsp + 0x58]
mov r8d, 0x33
mov rcx, qword [0x1800b9b00]
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAEventSelect]
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov r8d, 1
mov edx, 6
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x30], 0x100000
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 0x1002
mov edx, 0xffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov r8d, 0x1001
mov edx, 0xffff
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x48
ret