joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f4240
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rcx
xor edx, edx
cmp qword [rcx + 0x18], rdx
jne 0x1800f4336
mov r8d, 0x105
lea rcx, [rbp + 0x60]
call fcn.18020bef0
lea rdx, [rbp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
lea rax, [rbp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800f42b1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.180099770
lea rax, [0x1800567e8]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800f12c0
nop
lea rax, [0x1800567d8]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800f440a
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f432b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f4433
call fcn.1801e61d0
nop
jmp 0x1800f440a
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.18020bef0
mov qword [rsp + 0x48], 0
lea rcx, [rbx + 8]
cmp qword [rcx + 0x18], 0x10
jb 0x1800f435d
mov rcx, qword [rcx]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1800f4391
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.180099770
lea rax, [0x1800567e8]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800f12c0
nop
lea rax, [0x1800567d8]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800f440a
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f4404
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f442d
call fcn.1801e61d0
nop
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rbp
ret
call fcn.18010fa40
nop
call fcn.18010fa40
int3
Function at 0x1800f45b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x105
lea rcx, [rsp + 0x50]
call fcn.18020bef0
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800f4610
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.180099770
lea rax, [0x1800567e8]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800f12c0
nop
lea rax, [0x1800567d8]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800f4689
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f4683
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f46a5
call fcn.1801e61d0
nop
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x170
pop rbx
ret
call fcn.18010fa40
nop
int3

Function at 0x1800f82d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
mov qword [rdi + 0x20], sendto
mov byte [rdi + 8], cl
lea rax, [0x1800567e8]
mov qword [rdi], rax
mov dword [rsp + 0x20], 1
mov qword [rdi + 0x18], rcx
lea rax, [rdi + 8]
cmp qword [rdi + 0x20], 0x10
jb 0x1800f832d
mov rax, qword [rdi + 8]
mov byte [rax], 0
mov edx, 0x105
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movdqa xmm0, xmmword [0x180056d80]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800f8360
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.180099770
lea rax, [0x1800567d8]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
lea rcx, [rdi + 8]
call fcn.180099630
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1800f83df
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800f83d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800f8403
call fcn.1801e61d0
nop
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret
call fcn.18010fa40
int3
Function at 0x1800fb8a0
Capabilities:
Identify system language via api

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1802b0738]
test rax, rax
jne 0x1800fb921
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
cmp rcx, 4
jne 0x1800fb912
shr rax, 0xa
mov rcx, rax
sub rcx, 3
je 0x1800fb8e0
sub rcx, 1
je 0x1800fb8f9
cmp rcx, 1
jne 0x1800fb8e5
mov eax, 1
shl rax, 0xa
or rax, 4
mov qword [0x1802b0738], rax
add rsp, 0x28
ret
mov eax, 2
shl rax, 0xa
or rax, 4
mov qword [0x1802b0738], rax
add rsp, 0x28
ret
mov rax, rcx
bts rax, 0xb
mov qword [0x1802b0738], rax
add rsp, 0x28
ret
Function at 0x1800fc150
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
inc qword [0x1802b0748]
mov rax, qword [0x1802b0740]
test rax, rax
jne 0x1800fc322
lea ecx, [rax + 0x68]
call fcn.1801e6190
mov rbx, rax
mov qword [rsp + 0x30], rax
xor edi, edi
test rax, rax
je 0x1800fc315
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x30], rdi
mov qword [rax + 0x38], rdi
mov qword [rax + 0x40], rdi
mov qword [rax + 0x48], rdi
mov qword [rax + 0x50], rdi
mov qword [rax + 0x58], rdi
mov qword [rax + 0x60], rdi
lea rcx, [0x180058b58]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 8], rax
lea rdx, [0x180058b68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x58], rax
test rax, rax
je 0x1800fc2cb
lea rcx, [0x180058b88]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx], rax
test rax, rax
je 0x1800fc2cb
lea rdx, [0x180058b98]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x1800fc2cb
lea rdx, [0x180058bb8]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
test rax, rax
je 0x1800fc2cb
lea rdx, [0x180058bc8]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
test rax, rax
je 0x1800fc2cb
lea rdx, [0x180058bd8]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x40], rax
test rax, rax
je 0x1800fc2cb
lea rdx, [0x180058be8]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x48], rax
test rax, rax
je 0x1800fc2cb
lea rdx, [0x180058bf8]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x50], rax
lea rdx, [0x180058c08]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x60], rax
jmp 0x1800fc318
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800fc2f4
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x38], rdi
mov qword [rbx + 0x40], rdi
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800fc318
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
jmp 0x1800fc318
mov rbx, rdi
mov qword [0x1802b0740], rbx
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800fc8e0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx + 0x28], 0xffffffffffffffff
cmp qword [rcx + 0x18], 0
je 0x1800fca4b
call fcn.1800f3a40
test al, al
je 0x1800fca4b
lea rdx, [rbp + 0x17]
mov rcx, rbx
call fcn.1800f3250
nop
cmp qword [rdi + 0x18], 0
jne 0x1800fc943
xor eax, eax
jmp 0x1800fc951
lea rax, [rdi + 8]
cmp qword [rax + 0x18], 0x10
jb 0x1800fc951
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
mov dword [rbp - 0x59], WSACleanup
mov qword [rbp - 0x51], 0
mov dword [rbp - 0x55], 0x440
lea rcx, [rbx + 8]
cmp qword [rcx + 0x18], 0x10
jb 0x1800fc994
mov rcx, qword [rcx]
mov qword [rbp - 0x41], rcx
mov qword [rbp - 0x39], rax
cmp qword [rsi + 0x18], 0
jne 0x1800fc9b3
lea rax, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0x10
cmovae rax, qword [rbp + 0x1f]
jmp 0x1800fc9c1
lea rax, [rsi + 8]
cmp qword [rax + 0x18], 0x10
jb 0x1800fc9c1
mov rax, qword [rax]
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x29], 1
lea rcx, [rbp - 0x59]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1800fc9de
xor bl, bl
jmp 0x1800fca03
mov rax, qword [rbx + 0x30]
mov rdx, qword [rax + 0x50]
test rdx, rdx
je 0x1800fc9f7
mov rcx, qword [rbp + 0xf]
call rdx
mov eax, eax
mov qword [rbx + 0x28], rax
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea rax, [0x1800567d8]
mov qword [rbp + 0x17], rax
mov rdx, qword [rbp + 0x37]
cmp rdx, 0x10
jb 0x1800fca46
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800fca40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800fca6c
call fcn.1801e61d0
nop
movzx eax, bl
jmp 0x1800fca4d
xor al, al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
call fcn.18010fa40
nop
int3
Function at 0x1800fd9b0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
add rcx, 0x10
cmp qword [rcx + 0x18], 0x10
jb 0x1800fd9c2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x180102b70
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, dword [0x1802b2ac4]
mov rax, qword gs:[0x58]
mov edx, 0x26820
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1802b07b0], eax
jg 0x180102bcb
lea rax, [0x1802973d0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x1d8
ret
lea rcx, [0x1802b07b0]
call fcn.1801e66a0
cmp dword [0x1802b07b0], 0xffffffff
jne 0x180102bac
xor edx, edx
mov r8d, 0x198
lea rcx, [rsp + 0x20]
call fcn.18020bef0
mov ecx, 2
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x1802973d0], eax
lea rcx, [0x1802304e0]
call fcn.1801e64f0
nop
lea rcx, [0x1802b07b0]
call fcn.1801e6640
jmp 0x180102bac

Function at 0x180102f10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r9
mov rbp, r8
mov r15, rdx
mov r14, rcx
test rcx, rcx
je 0x18010306d
test rdx, rdx
je 0x18010306d
cmp r8, 0x10
jbe 0x18010306d
test r9, r9
je 0x18010306d
mov qword [rsp + 0x58], rdi
mov rdi, r8
and edi, 0xf
mov qword [rsp + 0x50], r12
mov r12d, reloc.WS2_32.dll_recv
cmove edi, r12d
cmp r8, 0x20
jbe 0x180102fad
mov qword [rsp + 0x60], rbx
mov eax, r12d
mov rbx, r8
cmp rdi, rax
mov ecx, 0x20
cmove eax, ecx
and rbx, 0xfffffffffffffff0
sub rbx, rax
mov rcx, r14
mov r8, rbx
call qword [r14 + gethostname]
add r15, rbx
add rsi, rbx
mov rbx, qword [rsp + 0x60]
lea rdx, [r15 + 0x10]
mov r8, rdi
lea rcx, [rsp + 0x20]
call fcn.18020b840
lea r8, [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call qword [r14 + 0x28]
xor eax, eax
test rdi, rdi
je 0x180102ff1
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rsp + rax + 0x20]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, rdi
jb 0x180102fe0
lea rcx, [rsi + 0x10]
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18020b840
test rdi, rdi
je 0x18010305e
sub r12, rdi
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
add rdx, rdi
add rcx, rdi
mov r8, r12
call fcn.18020b840
lea r8, [rsp + 0x20]
mov rcx, r14
lea rdx, [rsp + 0x20]
call qword [r14 + 0x28]
mov ecx, dword [rsp + 0x20]
xor ecx, dword [r14 + 0x50]
mov dword [rsi], ecx
mov ecx, dword [rsp + 0x24]
xor ecx, dword [r14 + 0x54]
mov dword [rsi + 4], ecx
mov ecx, dword [rsp + 0x28]
xor ecx, dword [r14 + 0x58]
mov dword [rsi + 8], ecx
mov ecx, dword [rsp + 0x2c]
xor ecx, dword [r14 + 0x5c]
mov dword [rsi + 0xc], ecx
mov r12, qword [rsp + 0x50]
mov rax, rbp
mov rdi, qword [rsp + 0x58]
jmp 0x18010306f
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x68
pop r15
pop r14
pop rsi
pop rbp
ret
Function at 0x1801033a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov rsi, r9
and edi, 0xf
mov rbp, r8
mov r15, rdx
mov r14, rcx
test rcx, rcx
je 0x1801034cd
cmp r8, 0x10
jbe 0x1801034cd
mov rax, r8
mov qword [rsp + 0x58], rbx
and rax, 0xfffffffffffffff0
cmp rax, 0x10
jbe 0x180103409
mov rbx, r8
and rbx, 0xfffffffffffffff0
sub rbx, 0x10
mov r8, rbx
call qword [rcx + 0x30]
add r15, rbx
add rsi, rbx
mov eax, dword [r14 + 0x50]
lea r8, [rsp + 0x20]
xor eax, dword [r15]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], eax
mov rcx, r14
mov eax, dword [r15 + 4]
xor eax, dword [r14 + 0x54]
mov dword [rsp + 0x24], eax
mov eax, dword [r15 + 8]
xor eax, dword [r14 + 0x58]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0xc]
xor eax, dword [r14 + 0x5c]
mov dword [rsp + 0x2c], eax
call qword [r14 + 0x20]
test rdi, rdi
je 0x1801034b3
lea rdx, [r15 + 0x10]
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.18020b840
lea rcx, [rsi + 0x10]
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.18020b840
xor eax, eax
test rdi, rdi
je 0x180103491
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 0x30]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, rdi
jb 0x180103480
lea r8, [r14 + 0x50]
mov rcx, r14
lea rdx, [rsp + 0x20]
call qword [r14 + 0x20]
movups xmm0, xmmword [r14 + 0x50]
mov rbx, qword [rsp + 0x58]
mov rax, rbp
movups xmmword [rsi], xmm0
jmp 0x1801034cf
movups xmm0, xmmword [rsi - 0x10]
mov rbx, qword [rsp + 0x58]
mov rax, rbp
movups xmm1, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
movups xmmword [rsi - 0x10], xmm1
jmp 0x1801034cf
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801034f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r14
sub rsp, 0x48
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x180103649
test rdx, rdx
je 0x180103649
test r9, r9
je 0x180103649
mov qword [rsp + 0x78], rsi
mov rsi, r8
shr rsi, 4
mov qword [rsp + 0x40], r15
test rsi, rsi
je 0x18010359a
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov rcx, rbp
lea rdx, [rbp + 0x50]
call qword [rbp + 0x20]
mov eax, dword [rsp + 0x20]
xor eax, dword [rbx]
mov dword [rdi], eax
mov eax, dword [rsp + 0x24]
xor eax, dword [rbx + 4]
mov dword [rdi + 4], eax
mov eax, dword [rsp + 0x28]
xor eax, dword [rbx + 8]
mov dword [rdi + 8], eax
mov eax, dword [rsp + 0x2c]
xor eax, dword [rbx + 0xc]
add rbx, 0x10
mov dword [rdi + 0xc], eax
movups xmm0, xmmword [rdi]
add rdi, 0x10
movups xmmword [rbp + 0x50], xmm0
sub rsi, 1
jne 0x180103550
mov rsi, r14
and esi, 0xf
je 0x18010363a
lea r8, [rsp + 0x20]
mov rcx, rbp
lea rdx, [rbp + 0x50]
call qword [rbp + 0x20]
xor edx, edx
test rsi, rsi
je 0x1801035ea
lea rax, [rsp + 0x20]
mov r8, rdi
sub rbx, rax
lea rax, [rsp + 0x20]
sub r8, rax
nop
lea rcx, [rsp + 0x20]
add rcx, rdx
inc rdx
movzx eax, byte [rbx + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
cmp rdx, rsi
jb 0x1801035d0
add rdi, rsi
cmp r14, 0x10
jae 0x180103632
mov ebx, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0x50]
sub rbx, r14
lea rcx, [rbp + 0x50]
mov r8, rbx
add rdx, r14
call fcn.18020b840
sub rdi, r14
lea rcx, [rbp + 0x50]
add rcx, rbx
mov r8, r14
mov rdx, rdi
call fcn.18020b840
mov r15, qword [rsp + 0x40]
mov rax, r14
mov rsi, qword [rsp + 0x78]
jmp 0x18010364b
movups xmm0, xmmword [rdi - 0x10]
movups xmmword [rbp + 0x50], xmm0
mov r15, qword [rsp + 0x40]
mov rax, r14
mov rsi, qword [rsp + 0x78]
jmp 0x18010364b
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x48
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1801039b0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rbp], rax
xor eax, eax
xor edi, edi
mov qword [rsp + 0x40], rdi
xorps xmm0, xmm0
mov qword [rsp + 0x48], rdi
mov rbx, rcx
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x6c], eax
mov byte [rsp + 0x70], al
mov qword [rbp - 0x5f], rax
mov dword [rbp - 0x57], eax
mov word [rbp - 0x53], ax
mov byte [rbp - 0x51], al
mov qword [rbp - 0x50], rdi
movups xmmword [rsp + 0x54], xmm0
movups xmmword [rsp + 0x71], xmm0
movups xmmword [rbp - 0x7f], xmm0
movups xmmword [rbp - 0x6f], xmm0
test rcx, rcx
je 0x180103b38
lea rcx, [rsp + 0x40]
call fcn.180106940
lea r9d, [rdi + 1]
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180103a6f
lea ecx, [rdi + 2]
call fcn.1801165d0
mov rdx, rax
lea rcx, [0x180059178]
call fcn.180117d70
jmp 0x180103aab
mov rcx, qword [rsp + 0x30]
lea r8, [rbp - 0x40]
mov edx, 0x20
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x180103a9e
lea ecx, [rax + 2]
call fcn.1801165d0
mov rdx, rax
lea rcx, [0x180059198]
call fcn.180117d70
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r8d, 0x20
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.180106990
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x180103afd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsp + 0x30]
mov qword [rbp - 0x40], rcx
lea rcx, [rsp + 0x38]
mov dword [rbp - 0x38], eax
call fcn.180115670
mov rax, qword [rsp + 0x38]
mov qword [rbp - 0x34], rax
mov r8d, 0x20
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x40]
call fcn.180106990
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.180106840
mov r8d, 0x20
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.180103b60
mov dword [rbx + 0x24], 1
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.1801e68c0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180105480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm2, xmmword [rcx]
movdqa xmm1, xmm2
movdqu xmmword [rdx], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm3, xmm1
pxor xmm0, xmm2
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 1
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x10], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqa xmm1, xmm2
movdqu xmmword [rdx + 0x20], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm3, xmm1
pxor xmm0, xmm2
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x30], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqa xmm1, xmm2
movdqu xmmword [rdx + 0x40], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm3, xmm1
pxor xmm0, xmm2
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x50], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0x60], xmm2
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqa xmm1, xmm2
movdqu xmmword [rdx + 0x80], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x180106940
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 8
mov rdx, rcx
test rcx, rcx
je 0x180106982
movups xmm0, xmmword [0x1800592f0]
xor eax, eax
mov qword [rsp], rdi
lea rdi, [rcx + 0x30]
movups xmmword [rcx + 0x10], xmm0
movups xmm1, xmmword [0x180059300]
movups xmmword [rcx + 0x20], xmm1
mov ecx, 0x40
rep stosb byte [rdi], al
mov rdi, qword [rsp]
mov qword [rdx + 8], rax
mov qword [rdx], rax
mov qword [rdx + 0x70], rax
add rsp, 8
ret