joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800172f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov r15, r8
mov rdi, rdx
mov rbx, rcx
call fcn.18004f030
mov rsi, rax
test rax, rax
jne 0x180017332
mov rax, 0xffffffffffffffff
jmp 0x18001750f
lea r9, [rbx + 0x20]
mov rcx, qword [r9 + 0x10]
mov rdx, qword [rdi + 0x10]
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rcx
cmp rax, rdx
jb 0x180017532
cmp qword [r9 + 0x18], 0xf
jbe 0x180017361
mov r9, qword [r9]
cmp qword [rdi + 0x18], 0xf
jbe 0x18001736b
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x27]
call fcn.18003d910
nop
lea r8, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0xf
cmova r8, qword [rbp + 0x27]
mov edx, 0x2712
mov rcx, rsi
call fcn.1800535a0
lea r8, [0x18000bad0]
mov edx, 0x4e2b
mov rcx, rsi
call fcn.1800535a0
mov r8, r15
mov edx, 0x2711
mov rcx, rsi
call fcn.1800535a0
mov dword [rbp - 9], 0x69704132
mov dword [rbp - 5], 0x3a79654b
mov word [rbp - 1], 0x20
lea rcx, [rbp - 8]
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x1800173e5
mov rcx, qword [rbx + 0x10]
sub r14, rcx
cmp r14, rax
jb 0x180017538
cmp qword [rbx + 0x18], 0xf
jbe 0x180017408
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 8]
lea rcx, [rbp + 7]
call fcn.18003d910
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0xf
cmova rdx, qword [rbp + 7]
xor ecx, ecx
call fcn.18004f400
mov rbx, rax
mov r8, rax
mov edx, 0x2727
mov rcx, rsi
call fcn.1800535a0
mov rcx, rsi
call fcn.18004f0a0
mov r14d, eax
mov dword [rbp + 0x7f], 0
test eax, eax
jne 0x180017473
lea r8, [rbp + 0x7f]
mov edx, 0x200002
mov rcx, rsi
call fcn.18004f000
mov rcx, rbx
call fcn.18004f4a0
mov rcx, rsi
call fcn.18004efd0
test r14d, r14d
cmove edi, dword [rbp + 0x7f]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x1800174c5
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800174c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001753e
call fcn.1800c17e8
movdqa xmm0, xmmword [0x1801fde90]
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 7], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0xf
jbe 0x18001750d
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180017508
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001752c
call fcn.1800c17e8
mov eax, edi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1800e1ef4
int3
call fcn.180006e30
nop
call fcn.180006e30
nop
call fcn.1800e1ef4
int3
Function at 0x180018820
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push r12
mov rbp, rsp
sub rsp, 0x60
call fcn.1800183c0
lea rbx, [0x1802331c0]
mov r12, rax
test rax, rax
je 0x18001885f
mov r9d, 0x2f
mov r8, rax
mov edx, 0x30
mov rcx, rbx
call fcn.1800ce18c
mov byte [0x1802331ef], 0
jmp 0x180018866
mov byte [0x1802331c0], 0
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x180018870
cmp rax, 2
jae 0x1800189f0
mov rax, qword [0x180232fd8]
test rax, rax
jne 0x180018997
mov rax, qword gs:[0x60]
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x58], r14
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x50], r15
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov rdi, r15
nop dword [rax]
nop dword [rax + rax]
mov r11, qword [rdi + 0x30]
movsxd rax, dword [r11 + 0x3c]
mov esi, dword [rax + r11 + 0x88]
add rsi, r11
cmp rsi, r11
je 0x18001895e
mov r10d, dword [rsi + 0x18]
test r10d, r10d
je 0x18001895e
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r10d
mov r9d, 0x4e834959
lea rax, [r14 + r10*4]
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x180018959
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x180018920
cmp r9d, 0x902a41c8
je 0x180018a00
test r10d, r10d
jne 0x180018900
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r15
je 0x180018974
cmp qword [rax + 0x30], 0
jne 0x1800188d0
xor eax, eax
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov qword [0x180232fd8], rax
movdqa xmm0, xmmword [0x1801fe8a0]
lea r8, [rbp + 0x21]
movdqa xmm1, xmmword [0x1801fe2e0]
lea rdx, [rbp - 0x3f]
mov r9d, reloc.WS2_32.dll_recv
mov dword [rbp + 0x20], 0x72724551
xor ecx, ecx
mov dword [rbp + 0x24], 0x2e726f
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x20], 0x6573750a
movdqu xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x1c], 0x75755f72
mov dword [rbp - 0x18], 0x3c206469
mov word [rbp - 0x14], 0x3220
mov byte [rbp - 0x12], 0
call rax
mov rcx, r12
add rsp, 0x60
pop r12
pop rbx
pop rbp
jmp fcn.1800c17e8
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r10*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
jmp 0x180018976
Function at 0x18001d110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rdi, rcx
mov dword [rbp - 0x15], 0x50504129
mov dword [rbp - 0x11], 0x41544144
mov byte [rbp - 0xd], 0
lea rcx, [rbp - 0x14]
call fcn.1800e2258
mov rbx, rax
test rax, rax
jne 0x18001d1a5
movdqa xmm0, xmmword [str._dSSNSe]
movdqu xmmword [rbp + 0x17], xmm0
movdqa xmm1, xmmword [0x1801fe470]
movdqu xmmword [rbp + 0x27], xmm1
movdqa xmm0, xmmword [0x1801fe2a0]
movdqu xmmword [rbp + 0x37], xmm0
mov byte [rbp + 0x47], al
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbp + 0x17]
xor byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 0x2f
jb 0x18001d180
mov byte [rbp + 0x47], 0
lea rdx, [rbp + 0x18]
lea rcx, [0x180230a70]
call fcn.180036f70
lea rdx, [0x1801f15b1]
test rbx, rbx
cmovne rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], 0
mov qword [rbp + 0xf], 0
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x18001d1d4
lea rcx, [rbp - 9]
call fcn.18003a510
nop
movdqa xmm0, xmmword [0x1801fe4d0]
movdqu xmmword [rbp + 0x17], xmm0
movdqa xmm1, xmmword [str.2L_settings.ini]
movdqu xmmword [rbp + 0x27], xmm1
lea rax, [rbp + 0x18]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18001d206
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 7]
sub rax, rcx
cmp rax, rbx
jb 0x18001d2a4
lea r9, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova r9, qword [rbp - 9]
mov qword [rsp + 0x30], rbx
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.18003d910
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x18001d286
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001d281
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001d29e
call fcn.1800c17e8
mov rax, rdi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1800e1ef4
nop
call fcn.180006e30
nop
int3
Function at 0x18001f640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rbx, qword [rsp + 0xd0]
mov ebp, 3
movaps xmmword [rsp + 0x70], xmm6
sub ebp, r8d
movdqa xmm6, xmmword [str.address__0x_X___I___cs2.exe______48_85_C0_74__]
xor r12d, r12d
movaps xmmword [rsp + 0x60], xmm7
mov r14, r9
movdqa xmm7, xmmword [0x1801fe240]
mov rsi, r8
mov r15, rcx
nop dword [rax]
nop word [rax + rax]
mov r8, r15
mov dword [rsp + 0xb8], r12d
mov rdx, r14
mov rcx, rsi
call fcn.180019060
mov rcx, qword [0x180233000]
lea rdi, [rsi + rax]
test rcx, rcx
je 0x18001f6de
lea rdx, [rdi + 3]
mov r9d, 4
lea r8, [rsp + 0xb8]
call qword [sym.imp.kittylib.dll_read_memory_raw]
mov rax, qword [rbx + 0x18]
lea ecx, [rdi + rbp]
mov edi, dword [rsp + 0xb8]
add edi, 4
add edi, ecx
cmp edi, 0x1000
jae 0x18001f74b
mov rdx, rbx
cmp rax, 0xf
jbe 0x18001f705
mov rdx, qword [rbx]
mov r8d, edi
lea rcx, [rsp + 0x32]
movdqu xmmword [rsp + 0x31], xmm7
mov dword [rsp + 0x51], 0x72746572
movdqu xmmword [rsp + 0x41], xmm6
mov dword [rsp + 0x55], 0x676e6979
mov dword [rsp + 0x59], 0xa2e2e2e
mov byte [rsp + 0x5d], r12b
call fcn.180006a20
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18001f6a0
cmp rax, 0xf
jbe 0x18001f754
mov rbx, qword [rbx]
movdqa xmm0, xmmword [0x1801fe130]
lea rcx, [rsp + 0x21]
mov r8d, edi
mov rdx, rbx
movdqu xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], r12b
call fcn.180006a20
movaps xmm6, xmmword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov eax, edi
mov rbp, qword [r11 + 0x40]
movaps xmm7, xmmword [rsp + 0x60]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800279e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rdi, rcx
mov dword [rbp - 5], 0x50504179
mov dword [rbp - 1], 0x41544144
mov byte [rbp + 3], 0
lea rcx, [rbp - 4]
call fcn.1800e2258
mov rbx, rax
test rax, rax
jne 0x180027a75
movdqa xmm0, xmmword [0x1801fe4f0]
movdqu xmmword [rbp + 0x1f], xmm0
movdqa xmm1, xmmword [0x1801fe140]
movdqu xmmword [rbp + 0x2f], xmm1
movdqa xmm0, xmmword [0x1801fea70]
movdqu xmmword [rbp + 0x3f], xmm0
mov byte [rbp + 0x4f], al
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rbp + 0x1f]
xor byte [rbp + rcx + 0x20], al
inc rcx
cmp rcx, 0x2f
jb 0x180027a50
mov byte [rbp + 0x4f], 0
lea rdx, [rbp + 0x20]
lea rcx, [0x180230a70]
call fcn.180036f70
lea rdx, [0x1801f15b1]
test rbx, rbx
cmovne rdx, rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], 0
mov qword [rbp + 0x37], 0
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rdx + r8], 0
jne 0x180027aa4
lea rcx, [rbp + 0x1f]
call fcn.18003a510
nop
movdqa xmm0, xmmword [0x1801fe4c0]
movdqu xmmword [rbp + 4], xmm0
mov dword [rbp + 0x14], 0x5c4c32
lea rax, [rbp + 5]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180027ad0
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x2f]
sub rax, rcx
cmp rax, rbx
jb 0x180027b6e
lea r9, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0xf
cmova r9, qword [rbp + 0x1f]
mov qword [rsp + 0x30], rbx
lea rax, [rbp + 5]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.18003d910
nop
mov rdx, qword [rbp + 0x37]
cmp rdx, 0xf
jbe 0x180027b50
inc rdx
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180027b4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027b68
call fcn.1800c17e8
mov rax, rdi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.1800e1ef4
nop
call fcn.180006e30
nop
int3
Function at 0x18002e570
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x18002e592
xor eax, eax
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
je 0x18002e626
mov rdi, rbp
mov qword [rsp + 0x50], r15
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18002e5f3
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x18002e5f3
cmp rdi, rcx
mov r15, rdi
cmovge r15, rcx
mov rcx, r14
mov r8, r15
call fcn.180189ea0
mov rax, qword [rsi]
sub rdi, r15
sub dword [rax], r15d
mov rcx, qword [rbx + 0x38]
movsxd rax, r15d
add qword [rcx], rax
jmp 0x18002e611
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x18002e619
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov r15d, 1
add r14, r15
test rdi, rdi
jg 0x18002e5b3
mov r15, qword [rsp + 0x50]
sub rbp, rdi
jmp 0x18002e70f
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18002e63d
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18002e63f
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18002e671
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.180189ea0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18002e70c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18002e6ac
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18002e6ed
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1800db898
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18002e70c
cmp rsi, rax
ja 0x18002e6c0
test rsi, rsi
je 0x18002e70c
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1800db898
sub rsi, rax
sub rbp, rsi
mov rsi, qword [rsp + 0x40]
mov rax, rbp
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x1800387e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r13
push r15
sub rsp, 0x30
mov qword [rsp + 0x50], rbx
mov r15, rdx
mov qword [rsp + 0x58], rsi
mov r13, rcx
mov rsi, qword [r8 + 0x10]
mov r9, r8
mov qword [rsp + 0x60], rdi
mov rdi, r8
mov qword [rsp + 0x28], r12
mov r12, qword [r8 + 0x18]
cmp r12, 0xf
jbe 0x18003881b
mov r9, qword [r8]
xor ebp, ebp
movabs r8, 0xcbf29ce484222325
mov ecx, ebp
test rsi, rsi
je 0x180038854
movabs rdx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
xor r8, rax
imul r8, rdx
cmp rcx, rsi
jb 0x180038840
mov rcx, qword [r13 + 0x30]
mov rax, qword [r13 + 0x18]
and rcx, r8
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 8]
je 0x1800388c2
mov qword [rsp + 0x20], r14
mov r14, qword [rax + rcx*8]
nop word [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x180038892
mov rdx, qword [rdx]
mov rcx, rdi
cmp r12, 0xf
jbe 0x18003889e
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x1800388af
mov r8, rsi
call fcn.18018a980
test eax, eax
je 0x1800388ba
cmp rbx, r14
je 0x1800388bd
mov rbx, qword [rbx + 8]
jmp 0x180038880
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
test rbp, rbp
je 0x1800388eb
mov qword [r15], rbp
mov rax, r15
add rsp, 0x30
pop r15
pop r13
pop rbp
ret
mov rax, qword [r13 + 8]
mov qword [r15], rax
mov rax, r15
add rsp, 0x30
pop r15
pop r13
pop rbp
ret
Function at 0x18003e3d0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18003e5ad
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18022c2a8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18022c2b8]
lea rdx, [rdi + rdi]
call fcn.1800354b0
mov rax, qword [0x18022c2a8]
lea r9, [rdi - 1]
mov qword [0x18022c2d0], r9
mov qword [0x18022c2d8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18003e5a2
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18022c2b8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18003e4eb
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18003e563
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18003e528
mov r10, qword [rdx]
cmp r10, rax
je 0x18003e522
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18003e563
cmp r9, rdx
je 0x18003e53f
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18003e577
cmp r9, rdx
jne 0x18003e530
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18003e59d
mov r9, qword [0x18022c2d0]
jmp 0x18003e470
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18003e563
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800bc710
int3
Function at 0x1800573b0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x2b
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x18005748b
xor r14d, r14d
nop dword [rax]
mov edi, 4
lea rdx, [rsp + 0x50]
cmp rsi, rdi
mov r8d, 4
mov rcx, rbp
cmovb rdi, rsi
call fcn.180062640
cmp eax, 4
je 0x180057408
mov edx, eax
jmp 0x180057435
cmp byte [0x18022f354], r14b
jne 0x18005743f
mov r9d, 2
mov dword [rsp + 0x50], r14d
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 2]
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb edx, edx
and edx, 2
mov eax, edx
test eax, eax
jne 0x18005748d
mov eax, dword [rsp + 0x50]
jmp 0x18005745e
imul eax, dword [0x18022f350], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x18022f350], eax
ror eax, 0x10
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x180057482
sub rsi, rdi
nop word [rax + rax]
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x180057470
mov dword [rsp + 0x50], eax
test rsi, rsi
jne 0x1800573e0
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x1800574a0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
sub rdi, 1
je 0x180057543
xor ebp, ebp
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
nop
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180062640
cmp eax, 4
jne 0x18005750f
cmp byte [0x18022f354], bpl
jne 0x18005755b
lea r9d, [rax - 2]
mov dword [rsp + 0x50], ebp
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x180057548
mov ecx, dword [rsp + 0x50]
cmp ecx, 0xfffffffc
jae 0x1800574d0
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx eax, byte [rcx + r14]
mov byte [rsi], al
inc rsi
sub rdi, 1
jne 0x1800574d0
mov byte [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
imul ecx, dword [0x18022f350], 0x41c64e6d
add ecx, 0x3039
mov dword [0x18022f350], ecx
ror ecx, 0x10
mov dword [rsp + 0x50], ecx
jmp 0x180057517
Function at 0x18005d440
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x18005d522
call fcn.18007a290
test al, al
jne 0x18005d522
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x18005d472
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1800826f0
test rax, rax
je 0x18005d4b7
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.1800826f0
mov rsi, rax
test rax, rax
je 0x18005d4b7
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x18005d4eb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.180055200
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x18005d4d0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800622e0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x18022a880]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rdx + 0x10]
mov rbx, rcx
mov rax, qword [rdx + 0x18]
lea rcx, str.SSL_PROXY
cmp qword [rdx], rcx
jne 0x180062327
mov rdi, qword [rax + 0xd8]
mov rsi, qword [rax + 0xe0]
mov ebp, dword [rax + 0xe8]
jmp 0x180062335
mov rdi, qword [rax + 0x50]
mov rsi, qword [rax + 0x58]
mov ebp, dword [rax + 0x764]
mov qword [rsp + 0x80], r15
test rdi, rdi
je 0x18006250b
mov r9, qword [rbx]
test r9, r9
je 0x18006237b
mov r8, r9
mov rax, rdi
sub r8, rdi
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180062373
inc rax
test ecx, ecx
jne 0x180062360
test edx, edx
je 0x18006250b
mov rcx, qword [rbx + 8]
cmp rcx, r9
je 0x18006238a
call qword [fcn.1800db050]
mov rcx, qword [rbx + 0x10]
call qword [fcn.1800db050]
mov rcx, qword [rbx]
call qword [fcn.1800db050]
xor r15d, r15d
mov rcx, rdi
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov dword [rbx + 0x18], r15d
call qword [fcn.1800d0820]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
jne 0x1800623fe
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800623d2
call qword [fcn.1800db050]
mov rcx, qword [rbx + 0x10]
call qword [fcn.1800db050]
mov rcx, qword [rbx]
call qword [fcn.1800db050]
mov eax, 0x1b
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx], r15
mov dword [rbx + 0x18], r15d
jmp 0x180062511
test rsi, rsi
je 0x180062442
mov r8, rsi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rdi]
movzx eax, byte [rdi + r8]
sub edx, eax
jne 0x180062423
inc rdi
test eax, eax
jne 0x180062410
test edx, edx
je 0x180062442
mov rcx, rsi
call qword [fcn.1800d0820]
mov qword [rbx + 8], rax
test rax, rax
jne 0x180062446
cmp qword [rbx], r15
je 0x1800623d2
xor ecx, ecx
jmp 0x1800623cc
mov qword [rbx + 8], rcx
mov rdi, qword [rbx]
mov qword [rbx + 0x10], r15
test rdi, rdi
je 0x18006249a
cmp byte [rdi], r15b
je 0x18006249a
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x18006247a
mov dword [rbx + 0x18], 1
jmp 0x18006250b
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x18006249a
mov dword [rbx + 0x18], 2
jmp 0x18006250b
mov rax, qword [rbx]
mov dword [rbx + 0x18], r15d
cmp byte [rax], r15b
je 0x18006250b
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], r15b
jne 0x1800624b0
test rdi, rdi
je 0x1800624c8
cmp byte [rax + rdi - 1], 0x2e
jne 0x1800624c8
dec rdi
cmp rdi, 0xffff
jae 0x18006250b
lea rdx, [rdi + 1]
mov ecx, 1
call qword [fcn.1800c8670]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1800624f5
mov rcx, qword [rbx + 8]
cmp rcx, qword [rbx]
jmp 0x1800623ca
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, rax
call fcn.180055250
mov rax, qword [rbx + 0x10]
mov byte [rdi + rax], r15b
mov dword [r14 + 0x50], ebp
xor eax, eax
mov r15, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800c24e0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret