joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180132ba0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x8930]
mov r8d, dword [r9 + r10*4 + 8]
sub r8d, 1
je 0x180132c24
sub r8d, 1
je 0x180132bfb
cmp r8d, 1
jne 0x180132c38
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x180132c1c
cmp ecx, r8d
jne 0x180132c38
xor eax, eax
mov dword [r9 + r10*4 + 8], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x408], eax
mov edx, 0xfb
mov rcx, r11
jmp fcn.180132dc0
mov ecx, dword [r9 + r10*4 + 0x408]
test ecx, ecx
je 0x180132c1c
cmp ecx, 1
jne 0x180132c38
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
mov dword [r9 + r10*4 + 0x408], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 8], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfc
mov dword [r9 + r10*4 + 8], eax
jmp fcn.180132dc0
ret

Function at 0x180132c40
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x8930]
mov r8d, dword [r9 + r10*4 + 0xc08]
test r8d, r8d
je 0x180132ce7
sub r8d, 2
je 0x180132ca0
cmp r8d, 1
jne 0x180132cd9
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x180132c93
cmp ecx, r8d
jne 0x180132cd9
mov dword [r9 + r10*4 + 0xc08], r8d
mov dword [r9 + r10*4 + 0x1008], 0
ret
mov dword [r9 + r10*4 + 0xc08], 0
ret
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x180132cda
cmp ecx, 1
jne 0x180132cd9
mov dword [r9 + r10*4 + 0xc08], 3
mov rcx, r11
mov dword [r9 + r10*4 + 0x1008], 0
mov r8d, edx
mov edx, 0xfe
jmp fcn.180132dc0
ret
mov dword [r9 + r10*4 + 0xc08], 1
ret
cmp dword [r9 + r10*4 + 0x1408], 1
jne 0x180132ccc
mov r8d, edx
mov dword [r9 + r10*4 + 0xc08], 1
mov edx, 0xfd
jmp fcn.180132dc0

Function at 0x180132d10
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
mov r11, rcx
movsxd r10, edx
mov r9, qword [rax + 0x8930]
mov r8d, dword [r9 + r10*4 + 0xc08]
sub r8d, 1
je 0x180132da0
sub r8d, 1
je 0x180132d71
cmp r8d, 1
jne 0x180132db7
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x180132d95
cmp ecx, r8d
jne 0x180132db7
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], 2
mov r8d, edx
mov dword [r9 + r10*4 + 0x1008], eax
mov edx, 0xfd
mov rcx, r11
jmp fcn.180132dc0
mov ecx, dword [r9 + r10*4 + 0x1008]
test ecx, ecx
je 0x180132d95
cmp ecx, 1
jne 0x180132db7
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
mov dword [r9 + r10*4 + 0x1008], eax
ret
xor eax, eax
mov dword [r9 + r10*4 + 0xc08], eax
ret
xor eax, eax
mov r8d, edx
mov edx, 0xfe
mov dword [r9 + r10*4 + 0xc08], eax
jmp fcn.180132dc0
ret

Function at 0x180132dc0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov edi, r8d
mov esi, edx
mov byte [rax + 0x10], 0xff
xor r9d, r9d
mov byte [rax + 0x11], sil
mov rbx, rcx
mov byte [rax + 0x12], dil
mov rcx, qword [rcx + 0x190]
lea rdx, [rax + 0x10]
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x180132e1f
Function at 0x180133120
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
movsxd r11, edx
mov r10, qword [rax + 0x8930]
mov r9d, dword [r10 + r11*4 + 8]
cmp r8d, 1
jne 0x180133176
test r9d, r9d
je 0x180133160
sub r9d, 2
je 0x180133188
cmp r9d, r8d
jne 0x1801331b6
cmp dword [r10 + r11*4 + 0x408], 0
jne 0x1801331b6
mov dword [r10 + r11*4 + 0x408], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 2
mov edx, 0xfb
jmp fcn.180132dc0
sub r9d, 1
je 0x1801331a0
sub r9d, 1
je 0x180133148
cmp r9d, 1
jne 0x1801331b6
cmp dword [r10 + r11*4 + 0x408], 1
jne 0x1801331b6
mov dword [r10 + r11*4 + 0x408], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 8], 3
mov edx, 0xfc
jmp fcn.180132dc0
ret

Function at 0x1801331c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, qword [rcx]
movsxd r11, edx
mov r10, qword [rax + 0x8930]
mov r9d, dword [r10 + r11*4 + 0xc08]
cmp r8d, 1
jne 0x18013321c
test r9d, r9d
je 0x180133203
sub r9d, 2
je 0x18013322e
cmp r9d, r8d
jne 0x18013325f
cmp dword [r10 + r11*4 + 0x1008], 0
jne 0x18013325f
mov dword [r10 + r11*4 + 0x1008], 1
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 2
mov edx, 0xfd
jmp fcn.180132dc0
sub r9d, 1
je 0x180133246
sub r9d, 1
je 0x1801331eb
cmp r9d, 1
jne 0x18013325f
cmp dword [r10 + r11*4 + 0x1008], 1
jne 0x18013325f
mov dword [r10 + r11*4 + 0x1008], 0
ret
mov r8d, edx
mov dword [r10 + r11*4 + 0xc08], 3
mov edx, 0xfe
jmp fcn.180132dc0
ret
Function at 0x180134350
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x180272190]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0x4e0]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], pe_nt_image_headers64
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
lea rsi, [rbx + 0x168]
mov rdx, qword [rsi]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1801343f4
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call fcn.1801547b0
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r9d, dword [rbx + 0x154]
cmp r9d, 4
jge 0x180134443
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.180118930
mov dword [rbx + 0xc], 7
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1801525d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, rsi
call fcn.180133e80
movzx r8d, ax
mov dword [rbx + 0xc], r8d
sub r8d, 3
je 0x1801344d2
sub r8d, 1
je 0x18013453b
sub r8d, 1
je 0x1801344aa
cmp r8d, 1
je 0x18013448a
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x1801e19c8]
call fcn.180118930
jmp 0x18013453b
mov rdx, qword [rsi]
lea r8d, [r9 - 2]
add rdx, 2
mov rcx, rbx
call fcn.180134090
test eax, eax
je 0x18013453b
jmp 0x180134419
mov rcx, rsi
call fcn.180133e60
movzx r8d, ax
lea rdx, [0x1801afb54]
mov dword [rbx + 8], r8d
mov rcx, rdi
mov r8, qword [rsi]
add r8, 4
call fcn.180118a00
jmp 0x18013453b
cmp r9d, 4
jle 0x18013453b
mov rcx, rsi
call fcn.180133e60
movzx ecx, word [rbx + 0x48]
inc ecx
cmp cx, ax
jne 0x18013453b
mov r8, qword [rsi]
lea eax, [r9 - 4]
movsxd r9, eax
add r8, 4
mov edx, 1
mov rcx, r14
call fcn.180118680
mov esi, eax
test eax, eax
je 0x180134520
mov edx, 5
mov rcx, rbx
call fcn.180134da0
mov eax, esi
jmp 0x180134419
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0x50], rax
mov rdx, qword [rdi + 0x50]
call fcn.180120e10
mov rcx, r14
call fcn.180121010
test eax, eax
je 0x180134417
mov edx, 5
mov rcx, rbx
call fcn.180134da0
mov eax, Ordinal_46
jmp 0x180134419
Function at 0x180136030
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x180272190]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.180169cfc
mov byte [rsp + 0x20], 0
test rax, rax
je 0x180136096
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x180136096
lea rcx, [rsp + 0x20]
call qword [case.0x180110b34.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1801525d0
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1801525d0
add rsp, 0x148
ret
jmp 0x180136030

Function at 0x1801360b0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x148
mov rax, qword [0x180272190]
xor rax, rsp
mov qword [rsp + 0x130], rax
call fcn.180169cfc
mov byte [rsp + 0x20], 0
test rax, rax
je 0x180136096
mov r8d, 0x104
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [rsp + 0x20], 0
je 0x180136096
lea rcx, [rsp + 0x20]
call qword [case.0x180110b34.0]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1801525d0
add rsp, 0x148
ret
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1801525d0
add rsp, 0x148
ret
jmp 0x180136030
Function at 0x18013a4b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, r8
mov rcx, qword [rcx]
mov rsi, rdx
cmp dword [rcx + 8], 2
jne 0x18013a4fa
mov rax, qword [rbx + 0x18]
test rax, rax
jne 0x18013a4ea
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rcx, rsi
call rax
jmp 0x18013a546
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x18013a533
mov rcx, qword [rcx + 0x10]
lea rdx, [0x1801de048]
call fcn.180169dd0
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x18013a533
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, rax
mov r8, rdi
mov edx, 1
mov rcx, rsi
call fcn.18016a428
mov rdi, rax
test rax, rax
jne 0x18013a569
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18013a560
call fcn.180169e60
mov qword [rbx + 0x10], rdi
mov rax, qword [rbx]
mov rcx, qword [rax]
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18013c320
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push rbx
sub rsp, 0x30
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
xor edx, edx
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x18013c363
mov rcx, qword [rbx]
lea rax, [rbx + 8]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
add rsp, 0x30
pop rbx
ret
Function at 0x18013d510
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section..data]
mov rdi, rax
test rax, rax
jne 0x18013d552
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x18013d599
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x18013d5f2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x18013d5b0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x18013d633
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1801b7566]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1801b7567]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x18013d600
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x180142230
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x24]
mov rbx, rcx
cmp eax, 0xca
jne 0x180142266
call fcn.180145740
cmp byte [rbx + 0x58], 0
je 0x18014225d
mov dword [rbx + 0x24], Ordinal_211
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
jmp 0x180142271
cmp eax, 0xcb
jne 0x1801422f6
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x20], 0
je 0x1801422dd
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x18014228e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1801422d5
cmp eax, 2
je 0x1801422dd
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x180142280
cmp eax, 3
je 0x1801422b6
cmp eax, 1
jne 0x180142280
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x180142280
mov ecx, dword [rbx + 0x184]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x180142280
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x180142330
cmp eax, 0xcc
je 0x180142318
mov rax, qword [rcx]
mov dword [rax + 0x28], reloc.WS2_32.dll_sendto
mov rcx, qword [rcx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180142330
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp dword [rcx + 0x24], 0xcc
je 0x18014235e
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x180142405
mov ecx, dword [rbx + 0x98]
nop
cmp ecx, dword [rbx + 0x78]
jae 0x1801423d4
mov rax, qword [rbx + 0x10]
mov edi, ecx
test rax, rax
je 0x1801423ac
mov dword [rax + 8], ecx
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov edi, dword [rbx + 0x98]
mov rax, qword [rbx + 0x208]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [rbx + 0x98]
cmp ecx, edi
je 0x18014242d
cmp ecx, dword [rbx + 0x78]
jb 0x180142385
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov ecx, ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], cl
jne 0x180142380
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x180142418
Function at 0x180142330
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x24]
mov rbx, rcx
cmp eax, 0xca
jne 0x180142266
call fcn.180145740
cmp byte [rbx + 0x58], 0
je 0x18014225d
mov dword [rbx + 0x24], Ordinal_211
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
jmp 0x180142271
cmp eax, 0xcb
jne 0x1801422f6
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x20], 0
je 0x1801422dd
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x18014228e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1801422d5
cmp eax, 2
je 0x1801422dd
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x180142280
cmp eax, 3
je 0x1801422b6
cmp eax, 1
jne 0x180142280
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x180142280
mov ecx, dword [rbx + 0x184]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x180142280
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x180142330
cmp eax, 0xcc
je 0x180142318
mov rax, qword [rcx]
mov dword [rax + 0x28], reloc.WS2_32.dll_sendto
mov rcx, qword [rcx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180142330
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp dword [rcx + 0x24], 0xcc
je 0x18014235e
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x180142405
mov ecx, dword [rbx + 0x98]
nop
cmp ecx, dword [rbx + 0x78]
jae 0x1801423d4
mov rax, qword [rbx + 0x10]
mov edi, ecx
test rax, rax
je 0x1801423ac
mov dword [rax + 8], ecx
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov edi, dword [rbx + 0x98]
mov rax, qword [rbx + 0x208]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, dword [rbx + 0x98]
cmp ecx, edi
je 0x18014242d
cmp ecx, dword [rbx + 0x78]
jb 0x180142385
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov ecx, ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], cl
jne 0x180142380
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x180142418
Function at 0x18014b1d0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov r13d, dword [rcx + 0x64]
mov rdi, rcx
mov rsi, qword [rcx + 0x250]
cmp r13d, 1
mov r8d, 0x2fe
mov qword [rsp + 0x50], rsi
sete al
mov edx, 1
mov byte [rsi + 0x38], al
mov rax, qword [rcx + 8]
mov ecx, 0x100
mov r9d, dword [rdi + 0x7c]
cmovne r8d, ecx
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov ebp, dword [rsi + 0x28]
xor ebx, ebx
mov qword [rsi + 0x30], rax
cmp dword [rdi + 0x7c], ebx
jle 0x18014b320
mov qword [rsp + 0x58], r12
lea r12, [rsi + 0x3c]
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
xor r15d, r15d
mov r9d, dword [r12]
mov eax, ebp
cdq
idiv r9d
mov ebp, eax
cmp r13d, 1
jne 0x18014b260
mov rax, qword [rsi + 0x30]
add qword [r15 + rax], 0xff
mov rax, qword [rsi + 0x30]
xor r10d, r10d
dec r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rdi
mov r14, qword [r15 + rax]
call fcn.18014b650
xor r11d, r11d
mov r8d, eax
xor esi, esi
cmp r11d, r8d
jle 0x18014b2a8
nop dword [rax + rax]
inc r10d
mov edx, ebx
mov r8d, r10d
mov rcx, rdi
call fcn.18014b650
mov r8d, eax
cmp r11d, eax
jg 0x18014b290
movzx eax, bpl
inc r11d
movzx ecx, r10b
imul ecx, eax
mov byte [rsi + r14], cl
inc rsi
cmp rsi, 0xff
jle 0x18014b283
cmp r13d, 1
jne 0x18014b2f9
mov ecx, r13d
lea rdx, [r14 - 1]
movzx eax, byte [r14]
mov byte [rdx], al
lea rdx, [rdx - 1]
movzx eax, byte [r14 + 0xff]
mov byte [r14 + rcx + 0xff], al
inc rcx
cmp rcx, 0xff
jle 0x18014b2d3
mov rsi, qword [rsp + 0x50]
inc ebx
add r12, 4
add r15, 8
cmp ebx, dword [rdi + 0x7c]
jl 0x18014b242
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18014b670
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov ebx, edx
mov edx, 1
mov r8d, 0x400
call qword [rax]
shl ebx, 9
lea r11, [0x1801b8340]
add ebx, 0xfffffe00
mov r10, rax
xor ecx, ecx
lea r9, [rax + 8]
movzx edx, byte [rcx + r11]
mov eax, 0xfe01
imul r8d, edx, 0x1fe
sub eax, r8d
cdq
idiv ebx
mov dword [r9 - 8], eax
movzx eax, byte [rcx + r11 + 1]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 4], eax
movzx eax, byte [rcx + r11 + 2]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9], eax
movzx eax, byte [rcx + r11 + 3]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 4], eax
movzx eax, byte [rcx + r11 + 4]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 8], eax
movzx eax, byte [rcx + r11 + 5]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0xc], eax
movzx eax, byte [rcx + r11 + 6]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x10], eax
movzx eax, byte [rcx + r11 + 7]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x14], eax
movzx eax, byte [rcx + r11 + 8]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x18], eax
movzx eax, byte [rcx + r11 + 9]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x1c], eax
movzx eax, byte [rcx + r11 + 0xa]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x20], eax
movzx eax, byte [rcx + r11 + 0xb]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
lea r9, [r9 + 0x40]
idiv ebx
mov dword [r9 - 0x1c], eax
movzx eax, byte [rcx + r11 + 0xc]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0x18], eax
movzx eax, byte [rcx + r11 + 0xd]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0x14], eax
movzx eax, byte [rcx + r11 + 0xe]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0x10], eax
movzx eax, byte [rcx + r11 + 0xf]
add rcx, 0x10
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0xc], eax
cmp rcx, 0x100
jl 0x18014b6a2
mov rax, r10
add rsp, 0x20
pop rbx
ret

Function at 0x180150720
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor eax, eax
mov dword [rsp + 0x20], 0xf0000000
mov qword [r9], rax
mov rsi, r9
mov r14d, r8d
mov qword [r9 + 8], rax
mov r15, rdx
mov rdi, rcx
lea r9d, [rax + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test ebx, ebx
jne 0x1801507d6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
je 0x180150791
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090015
jne 0x1801507b3
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000008
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
Function at 0x180176544
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x180176521
call fcn.18016ad64
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.18015db14
or eax, 0xffffffff
jmp 0x18017653e
sub dword [rcx + 0x10], 1
jns 0x180176530
add rsp, 0x28
jmp fcn.180179c9c
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x180176500