joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180155660
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rsi, rdx
test r8, r8
jne 0x1801556a6
mov rdi, qword [rdx]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x180155803
nop
lea rdx, [rbx + 0x18]
call fcn.180155810
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x180155690
jmp 0x180155803
mov rdx, r8
lea rcx, [rsp + 0x60]
call fcn.18013a6c0
nop
movabs rdx, 0xcbf29ce484222325
xor r14d, r14d
mov r8d, r14d
mov rax, qword [rsp + 0x60]
or rbp, 0xffffffffffffffff
mov rcx, rbp
inc rcx
cmp byte [rax + rcx], r8b
jne 0x1801556d0
test rcx, rcx
je 0x180155710
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor rdx, rcx
imul rdx, r9
inc r8
mov rcx, rbp
inc rcx
cmp byte [rax + rcx], r14b
jne 0x180155702
cmp r8, rcx
jb 0x1801556f0
mov rcx, rdx
shr rcx, 0x20
xor rdx, rcx
mov r8, qword [rsi + 0x28]
mov rdi, r8
and rdi, rdx
cmp qword [rsi + 0x30], rdi
ja 0x180155736
shr r8, 1
mov rcx, rbp
sub rcx, r8
add rdi, rcx
add rdi, rdi
mov rbx, qword [rsi + 0x10]
mov rbx, qword [rbx + rdi*8]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 0x10]
cmp qword [rdx + rdi*8], rcx
je 0x180155756
mov rcx, qword [rdx + rdi*8 + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x70], rcx
cmp rbx, rcx
je 0x1801557de
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x1801557d3
mov rdx, rax
mov rcx, qword [rbx + 0x10]
call fcn.18017bdf4
test eax, eax
je 0x180155787
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x60]
jmp 0x180155741
mov rdx, qword [rbx + 0x10]
test rdx, rdx
setne r14b
test r14d, r14d
jne 0x1801557a2
mov ecx, 0x80004005
call fcn.180127e80
int3
mov rcx, qword [rsp + 0x60]
call fcn.18017bdf4
test eax, eax
je 0x1801557bf
mov rax, qword [rsi]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x78]
jmp 0x1801557c9
mov qword [rsp + 0x20], rbx
lea rbx, [rsp + 0x20]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x60]
jmp 0x1801557e1
mov ecx, 0x80004005
call fcn.180127e80
int3
mov rbx, qword [rsi]
lea rdx, [rax - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1801557f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp rbx, qword [rsi]
je 0x180155803
lea rdx, [rbx + 0x18]
call fcn.180155810
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180156280
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rbx, r8
xor r14d, r14d
lea rcx, [rax + 0x20]
call fcn.18013a6c0
nop
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x20]
lea rcx, [0x18026e2f8]
call fcn.180141610
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
or rbp, 0xffffffffffffffff
lock add dword [rdx + 0x10], ebp
jg 0x1801562e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x20]
cmp rdi, qword [0x18026e2f8]
je 0x180156457
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.18013a6c0
nop
movabs rdx, 0xcbf29ce484222325
mov r8, r14
mov rax, qword [rsp + 0x70]
mov rcx, rbp
nop dword [rax]
inc rcx
cmp byte [rax + rcx], r8b
jne 0x180156320
test rcx, rcx
je 0x180156360
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor rdx, rcx
imul rdx, r9
inc r8
mov rcx, rbp
inc rcx
cmp byte [rax + rcx], 0
jne 0x180156352
cmp r8, rcx
jb 0x180156340
mov rcx, rdx
shr rcx, 0x20
xor rdx, rcx
mov r8, qword [rdi + 0x40]
mov rsi, r8
and rsi, rdx
cmp qword [rdi + 0x48], rsi
ja 0x180156386
shr r8, 1
mov rcx, rbp
sub rcx, r8
add rsi, rcx
add rsi, rsi
mov rbx, qword [rdi + 0x28]
mov rbx, qword [rbx + rsi*8]
mov rcx, qword [rdi + 0x18]
mov rdx, qword [rdi + 0x28]
cmp qword [rdx + rsi*8], rcx
je 0x1801563a7
mov rcx, qword [rdx + rsi*8 + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
cmp rbx, rcx
je 0x180156435
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
je 0x18015642a
mov rdx, rax
mov rcx, qword [rbx + 0x10]
call fcn.18017bdf4
test eax, eax
je 0x1801563dc
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x70]
jmp 0x180156391
mov rdx, qword [rbx + 0x10]
mov eax, r14d
test rdx, rdx
setne al
test eax, eax
jne 0x1801563f8
mov ecx, 0x80004005
call fcn.180127e80
int3
mov rcx, qword [rsp + 0x70]
call fcn.18017bdf4
test eax, eax
je 0x180156416
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
lea rbx, [rsp + 0x30]
jmp 0x180156420
mov qword [rsp + 0x38], rbx
lea rbx, [rsp + 0x38]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x70]
jmp 0x180156439
mov ecx, 0x80004005
call fcn.180127e80
int3
mov rbx, qword [rdi + 0x18]
lea rdx, [rax - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x18015644d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp rbx, qword [rdi + 0x18]
je 0x180156457
lea r14, [rbx + 0x18]
mov rax, r14
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x180156d00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp r8, qword [rax]
jne 0x180156d40
cmp r9, rax
jne 0x180156d40
call fcn.1801573c0
mov rax, qword [rdi]
mov rcx, qword [rax]
mov rax, rsi
mov qword [rsi], rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
cmp rbx, r9
je 0x180156eb2
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], r14
movabs r14, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop word [rax + rax]
mov rax, qword [rbx]
mov r8, r14
mov qword [rsp + 0x50], rax
mov r9, qword [rbx + 0x10]
or rax, 0xffffffffffffffff
inc rax
cmp byte [r9 + rax], 0
jne 0x180156d83
xor edx, edx
test rax, rax
je 0x180156db4
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx + r9]
inc rdx
xor r8, rcx
imul r8, rbp
cmp rdx, rax
jb 0x180156da0
mov rcx, qword [rdi + 0x28]
mov rdx, r8
shr rdx, 0x20
xor rdx, r8
and rdx, rcx
cmp qword [rdi + 0x30], rdx
ja 0x180156dd8
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rdx, rax
mov rcx, qword [rdi + 0x10]
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], rbx
jne 0x180156e0c
cmp qword [rcx], rbx
jne 0x180156e02
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi + 0x10]
mov rax, qword [rdi]
mov qword [rcx + rdx + 8], rax
jmp 0x180156e17
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
jmp 0x180156e17
cmp qword [rcx], rbx
jne 0x180156e17
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rdi + 8]
mov rdx, qword [rbx + 0x28]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180156e48
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbx + 0x20]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180156e60
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbx + 0x18]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180156e78
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdx, qword [rbx + 0x10]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180156e90
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, rbx
call sym.HPSocket4C_U.dll_SYS_Free
mov rbx, qword [rsp + 0x50]
cmp rbx, qword [rsp + 0x58]
jne 0x180156d70
mov r14, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov qword [rsi], rbx
mov rax, rsi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x180156f90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rsi
push r14
sub rsp, 0x30
mov rax, qword [rcx]
mov rbx, r8
mov r14, rdx
mov rsi, rcx
cmp r8, qword [rax]
jne 0x180156fd2
cmp r9, rax
jne 0x180156fd2
call fcn.180156ba0
mov rax, qword [rsi]
mov rcx, qword [rax]
mov rax, r14
mov qword [r14], rcx
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp rbx, r9
je 0x180157140
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
xor ebp, ebp
movabs r12, 0xcbf29ce484222325
movabs r15, 0x100000001b3
nop word [rax + rax]
mov rax, qword [rbx]
mov r8, r12
mov qword [rsp + 0x60], rax
mov r9, qword [rbx + 0x10]
or rax, 0xffffffffffffffff
inc rax
cmp byte [r9 + rax], bpl
jne 0x180157023
mov rdx, rbp
test rax, rax
je 0x180157054
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx + r9]
inc rdx
xor r8, rcx
imul r8, r15
cmp rdx, rax
jb 0x180157040
mov rcx, qword [rsi + 0x28]
mov rdx, r8
shr rdx, 0x20
xor rdx, r8
and rdx, rcx
cmp qword [rsi + 0x30], rdx
ja 0x180157078
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rdx, rax
mov rcx, qword [rsi + 0x10]
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], rbx
jne 0x1801570ac
cmp qword [rcx], rbx
jne 0x1801570a2
mov rax, qword [rsi]
mov qword [rcx], rax
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsi]
mov qword [rcx + rdx + 8], rax
jmp 0x1801570b7
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
jmp 0x1801570b7
cmp qword [rcx], rbx
jne 0x1801570b7
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 8]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1801570ea
call sym.HPSocket4C_U.dll_SYS_Free
mov qword [rbx + 0x28], rbp
mov qword [rbx + 0x30], rbp
mov qword [rbx + 0x38], rbp
lea rcx, [rbx + 0x18]
call fcn.18014e560
mov rcx, qword [rbx + 0x18]
call sym.HPSocket4C_U.dll_SYS_Free
mov rdx, qword [rbx + 0x10]
sub rdx, 0x18
lock add dword [rdx + 0x10], 0xffffffff
jg 0x180157114
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, rbx
call sym.HPSocket4C_U.dll_SYS_Free
mov rbx, qword [rsp + 0x60]
cmp rbx, qword [rsp + 0x68]
jne 0x180157010
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov qword [r14], rbx
mov rax, r14
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x180157420
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov r10, qword [r8 + 0x10]
mov rdi, rdx
mov rbx, rcx
movzx r9d, byte [r10]
mov r11d, 0x811c9dc5
test r9b, r9b
je 0x180157477
nop dword [rax + rax]
lea eax, [r9 - 0x41]
lea r10, [r10 + 1]
cmp al, 0x19
ja 0x180157460
add r9b, 0x20
imul r11, r11, 0x1000193
movsx rax, r9b
movzx r9d, byte [r10]
xor r11, rax
test r9b, r9b
jne 0x180157450
mov rcx, qword [rcx + 0x28]
mov rdx, rcx
and rdx, r11
cmp qword [rbx + 0x30], rdx
ja 0x180157494
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rdx, rax
mov rcx, qword [rbx + 0x10]
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r8
jne 0x1801574c8
cmp qword [rcx], r8
jne 0x1801574be
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx]
mov qword [rdx + rcx + 8], rax
jmp 0x1801574d3
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x1801574d3
cmp qword [rcx], r8
jne 0x1801574d8
mov rax, qword [r8]
mov qword [rcx], rax
mov r8, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
call fcn.180157660
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x180157cd0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, r9
mov r13, r8
mov r12, rdx
mov r14, rcx
mov r10d, 0x811c9dc5
mov r11, qword [r8]
movzx r9d, byte [r11]
test r9b, r9b
je 0x180157d47
nop dword [rax + rax]
lea r11, [r11 + 1]
lea eax, [r9 - 0x41]
cmp al, 0x19
ja 0x180157d30
add r9b, 0x20
imul r10, r10, 0x1000193
movsx rax, r9b
xor r10, rax
movzx r9d, byte [r11]
test r9b, r9b
jne 0x180157d20
mov rcx, qword [rcx + 0x28]
mov rsi, rcx
and rsi, r10
cmp qword [r14 + 0x30], rsi
ja 0x180157d64
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rsi, rax
mov rbx, qword [r14]
shl rsi, 4
mov rax, qword [r14 + 0x10]
cmp qword [rax + rsi], rbx
je 0x180157d7d
mov rbx, qword [rax + rsi + 8]
mov rbx, qword [rbx]
xor r15d, r15d
mov rax, qword [r14 + 0x10]
cmp rbx, qword [rsi + rax]
je 0x180157e11
mov rbx, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
mov eax, r15d
test rdx, rdx
setne al
test eax, eax
jne 0x180157dad
mov ecx, 0x80004005
call fcn.180127e80
mov rcx, qword [r13]
call fcn.18017bef4
test eax, eax
je 0x180157dc1
mov rdi, qword [rsp + 0x78]
jmp 0x180157d80
mov rdx, qword [r13]
test rdx, rdx
setne r15b
test r15d, r15d
jne 0x180157ddb
mov ecx, 0x80004005
call fcn.180127e80
mov rcx, qword [rbx + 0x10]
call fcn.18017bef4
test eax, eax
je 0x180157df2
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x78]
jmp 0x180157e11
mov rdx, qword [rsp + 0x78]
mov rcx, r14
call fcn.180158330
mov qword [r12], rbx
mov byte [r12 + 8], 0
mov rax, r12
jmp 0x180157ea4
mov rax, qword [rdi]
cmp rbx, rax
je 0x180157e46
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r14 + 0x10]
add rdx, rsi
mov rax, qword [rdx]
cmp rax, qword [r14]
jne 0x180157e63
mov qword [rdx], rdi
mov rax, qword [r14 + 0x10]
mov qword [rsi + rax + 8], rdi
jmp 0x180157e8f
cmp rax, rbx
jne 0x180157e6d
mov qword [rdx], rdi
jmp 0x180157e8f
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180157e8f
mov rdx, qword [r14 + 0x10]
mov rax, qword [rdx + rsi + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi + 8], rcx
mov rcx, r14
call fcn.1801583b0
mov qword [r12], rdi
mov byte [r12 + 8], 1
mov rax, r12
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180159690
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push r15
sub rsp, 0x20
mov rsi, qword [rsp + 0x70]
mov ebp, dword [rsp + 0x68]
mov r15, r9
movzx r9d, r8b
mov r10d, ecx
movsxd rax, ebp
test rsi, rsi
jne 0x180159715
mov rsi, rax
mov qword [rsp + 0x48], rdi
xor edi, edi
test r15, r15
mov eax, edi
mov ecx, edi
setne cl
shl ecx, 8
test r10d, r10d
mov qword [rsp + 0x50], r14
mov r14, qword [rsp + 0x78]
setne al
lea r8d, [rdi + 2]
or ecx, eax
movzx eax, dl
and eax, 7
shl ecx, 3
or ecx, eax
movzx eax, r9b
and eax, 0xf
shl ecx, 4
or ecx, eax
mov dword [r14], ecx
cmp rsi, 0x7e
jae 0x180159730
movzx eax, sil
and eax, 0x7f
shl eax, 8
or eax, ecx
mov dword [r14], eax
jmp 0x180159799
cmp rsi, rax
jae 0x1801596b7
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
cmp rsi, 0xffff
ja 0x18015975c
or ecx, 0x7e00
mov dword [r14], ecx
movzx ecx, si
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, 4
movzx eax, ax
shl eax, 0x10
or dword [r14], eax
jmp 0x180159799
or ecx, 0x7f00
mov qword [rsp + 0x40], rbx
mov dword [r14], ecx
mov rcx, rsi
shr rcx, 0x20
call qword [sym.imp.WS2_32.dll_htonl]
mov ecx, esi
mov ebx, eax
call qword [sym.imp.WS2_32.dll_htonl]
mov r8d, 0xa
mov eax, eax
shl rax, 0x20
or rax, rbx
mov rbx, qword [rsp + 0x40]
mov qword [r14 + 2], rax
mov r9, qword [rsp + 0x60]
test r15, r15
je 0x1801597de
mov eax, dword [r15]
movsxd rcx, r8d
mov dword [rcx + r14], eax
test ebp, ebp
jle 0x1801597da
mov rcx, r9
mov rdx, rbp
nop word [rax + rax]
mov rax, rdi
inc rdi
lea rcx, [rcx + 1]
and eax, 3
movzx eax, byte [rax + r15]
xor byte [rcx - 1], al
dec rdx
jne 0x1801597c0
add r8d, 4
mov rax, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x48]
mov qword [rax + 8], r14
mov r14, qword [rsp + 0x50]
mov dword [rax], r8d
mov qword [rax + 0x18], r9
mov dword [rax + 0x10], ebp
mov eax, 1
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x18015a330
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1c8
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movzx r13d, r9w
mov rax, r8
mov r12, rdx
mov r15, rcx
mov rcx, qword [rsp + 0x230]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x238]
mov qword [rsp + 0x50], rcx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x58], xmm0
xor ebp, ebp
mov esi, ebp
mov qword [rsp + 0x68], rbp
mov r14d, ebp
mov qword [rsp + 0x78], rbp
lea rcx, [rsp + 0xa8]
mov qword [rsp + 0xa0], rcx
lea r8d, [rbp + 3]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.18014e390
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbp + 1]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18015a411
call fcn.180144c30
mov ebx, eax
mov rdi, qword [rsp + 0x58]
test eax, eax
jns 0x18015a416
jmp 0x18015a475
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x44]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp eax, 0xffffffff
jne 0x18015a438
call fcn.180144c30
mov ebx, eax
test eax, eax
js 0x18015a475
mov rax, qword [rsp + 0x40]
lea rcx, [rax - 1]
cmp rcx, 0x3ffffe
ja 0x18015a465
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.18015d1f0
mov ebx, eax
mov r14, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
jmp 0x18015a475
mov ebx, 0x800700df
mov ecx, 0x800703ee
test rax, rax
cmove ebx, ecx
lea rax, [rsp + 0xa8]
mov rcx, qword [rsp + 0xa0]
cmp rcx, rax
je 0x18015a48f
call fcn.180179510
test ebx, ebx
jns 0x18015a4a0
movzx ecx, bx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, ebp
jmp 0x18015a4dd
mov r10, qword [r15]
mov eax, dword [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rsi
mov eax, dword [rsp + 0x240]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
movzx r8d, r13w
mov rdx, r12
mov rcx, r15
call qword [r10 + 0xc0]
mov ebx, eax
test rsi, rsi
je 0x18015a4f6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x18015a4f6
call fcn.180144c30
mov ebp, eax
test r14, r14
je 0x18015a512
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x18015a512
test ebp, ebp
js 0x18015a512
call fcn.180144c30
nop
test rdi, rdi
je 0x18015a520
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.180179370
add rsp, 0x1c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18015af30
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r11, qword [rcx + 0x1d8]
mov rbx, r8
test r11, r11
je 0x18015af96
mov r10d, dword [rcx + 0x1d0]
mov rcx, qword [rcx + 0x218]
lea rax, [rdx - 1]
xor edx, edx
div r10
movzx r8d, byte [rcx + rdx]
cmp rax, r8
jne 0x18015af96
mov rcx, qword [r11 + rdx*8]
xor eax, eax
cmp rcx, 0xf
seta al
cmp eax, 1
jne 0x18015af96
test rcx, rcx
je 0x18015af96
mov rcx, qword [rcx + 0x38]
test rcx, rcx
je 0x18015af96
mov r8, r9
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x18013fd70
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x18015c300
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
xor ebp, ebp
mov rdi, r8
mov rsi, rdx
test rcx, rcx
je 0x18015c35a
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x18015c35a
cmp dword [rsp + 0x70], 0x103
mov eax, ebp
sete al
test eax, eax
je 0x18015c35a
mov ecx, 0x139f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebp
jmp 0x18015c405
mov rcx, qword [rbx + 0x10]
movaps xmmword [rsp + 0x30], xmm6
test rcx, rcx
je 0x18015c387
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [rbx + 8], ebp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
movaps xmm6, xmmword [rdi]
mov ecx, 0x20
call fcn.1801793ec
mov rdi, rax
test rax, rax
je 0x18015c3a9
mov qword [rax], rsi
mov qword [rax + 0x18], rbp
movups xmmword [rax + 8], xmm6
jmp 0x18015c3ac
mov rdi, rbp
movups xmm0, xmmword [rdi]
lea rax, [rbx + 8]
lea r8, [0x18015c960]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
movups xmmword [rbx + 0x18], xmm0
movups xmm1, xmmword [rdi + 0x10]
xor ecx, ecx
mov dword [rsp + 0x20], ebp
movups xmmword [rbx + 0x28], xmm1
call fcn.18017b9a4
mov qword [rbx + 0x10], rax
movaps xmm6, xmmword [rsp + 0x30]
test rax, rax
jne 0x18015c400
mov ecx, 0x65f
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call sym.HPSocket4C_U.dll_SYS_Free
mov eax, ebp
jmp 0x18015c405
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18015c660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
test dword [rcx + 0x34], 0x80000000
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x18015c6d9
cmp dword [rcx + 0xe0], 1
jne 0x18015c6a8
mov rcx, qword [rcx + 0xe8]
mov r8d, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp 0x18014ddb0
mov rdx, qword [rcx + 0x10]
mov r8, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x78]
mov rax, qword [rcx]
mov r8, qword [r8 + 8]
add rdx, 8
mov r9, rsi
mov dword [rsp + 0x20], edi
call qword [rax + 0x18]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r8, rdx
lea rdx, [0x180267230]
mov r9, rdi
add rcx, 0x20
mov qword [rsp + 0x40], rbp
xor ebp, ebp
call fcn.1801280e0
mov r9d, dword [rbx + 0x34]
test r9d, r9d
jns 0x18015c714
mov r9d, eax
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.18015c9a0
mov ebp, eax
jmp 0x18015c753
shr r9d, 0x18
and r9d, 0x7f
je 0x18015c753
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
movsxd rax, r9d
mov rcx, qword [rdx + 0x410]
mov r8, qword [r8 + 8]
lea r11, str.success
mov r10, qword [rcx]
add rax, rax
mov rax, qword [r11 + rax*8]
mov qword [rsp + 0x20], rax
call qword [r10 + 0x50]
mov ebp, 2
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18015c850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
test dword [rcx + 0x34], 0x80000000
movsxd rdi, r8d
mov rsi, rdx
mov rbx, rcx
je 0x18015c8c9
cmp dword [rcx + 0xe0], 1
jne 0x18015c898
mov rcx, qword [rcx + 0xe8]
mov r8d, edi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp 0x18014e0a0
mov rdx, qword [rcx + 0x10]
mov r8, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x78]
mov rax, qword [rcx]
mov r8, qword [r8 + 8]
add rdx, 8
mov r9, rsi
mov dword [rsp + 0x20], edi
call qword [rax + 0x18]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r8, rdx
lea rdx, [0x1802671e0]
mov r9, rdi
add rcx, 0x20
mov qword [rsp + 0x40], rbp
xor ebp, ebp
call fcn.1801280e0
mov r9d, dword [rbx + 0x34]
test r9d, r9d
jns 0x18015c904
mov r9d, eax
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.18015ca80
mov ebp, eax
jmp 0x18015c943
shr r9d, 0x18
and r9d, 0x7f
je 0x18015c943
mov rdx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
movsxd rax, r9d
mov rcx, qword [rdx + 0x690]
mov r8, qword [r8 + 8]
lea r11, str.success
mov r10, qword [rcx]
add rax, rax
mov rax, qword [r11 + rax*8]
mov qword [rsp + 0x20], rax
call qword [r10 + 0x50]
mov ebp, 2
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret