joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002a80
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140162be0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140002a9f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002aa8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002ac0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140162be0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002ae0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002ae8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002ae0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002ae0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002b34
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002b40
add rdx, 0x28
cmp rdx, r9
jne 0x140002b20
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002b50
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140162be0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002b72
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002b80
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002b72
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002b72
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002b72
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002bd5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002be8
add rdx, 0x28
cmp r10, rdx
jne 0x140002bc0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002bf7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002c07
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002bde
test ecx, ecx
jg 0x140002bf0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400030f0
Capabilities:
Create directory
Create process on windows
Create process suspended
Query environment variable
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call dbg.__main
call sym.__p__acmdln
mov rbx, qword [rax]
test rbx, rbx
jne 0x14000313b
jmp 0x1400031b1
test cl, cl
je 0x140003168
and esi, 1
je 0x140003150
mov esi, 1
call sym._ismbblead
test eax, eax
je 0x140003137
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x140003118
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x140003126
test cl, cl
je 0x140003168
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x140003168
cmp al, 0x20
jle 0x140003158
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x140003196
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x140162be0]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp sym.WinMain
lea rbx, [0x140162840]
jmp 0x140003168
Function at 0x180001fa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13d0
call fcn.180010980
sub rsp, rax
mov rax, qword [0x180018040]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
call qword [sym.imp.TT_SubSystem.dll_public:_void___cdecl_CEventHandler::constructor_void____ptr64]
nop
lea rax, vtable.ISocketInterfaceShared.0
mov qword [rdi], rax
xor ebp, ebp
mov dword [rdi + 0x10], ebp
mov qword [rdi + 0x18], rbp
mov qword [rdi + 0x20], rbp
lea rcx, [rdi + 0x28]
call qword [sym.imp.TT_SubSystem.dll_public:_void___cdecl_CComposerJson::constructor_void____ptr64]
nop
mov byte [rdi + 0x30], bpl
mov qword [rdi + 0x38], rbp
mov qword [rdi + 0x40], rbp
mov qword [rdi + 0x48], rbp
mov qword [rdi + 0x50], rbp
mov qword [rdi + 0x58], rbp
lea rcx, [rdi + 0x60]
xor edx, edx
call qword [sym.imp.TT_SubSystem.dll_public:_void___cdecl_CLightDynString::constructor_unsigned_long_long_unsigned___int64_____ptr64]
nop
lea rcx, [rdi + 0xf8]
call fcn.180009130
nop
mov qword [rdi + 0x3b8], rbp
mov qword [rdi + 0x3c0], rbp
mov qword [rdi + 0x3c8], rbp
mov byte [rdi + 0x3d0], 1
lea rbx, [rdi + 0x3d8]
mov rcx, rbx
call qword [sym.imp.TT_SubSystem.dll_public:_void___cdecl_uint256_type::constructor_void____ptr64]
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
movabs rax, 0x5555555555555555
mov qword [rsp + 0x13b8], rax
mov qword [rsp + 0x38], rdx
lea ecx, [rbp + 1]
movabs r8, 0x5851f42d4c957f2d
nop word [rax + rax]
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, rcx
mov qword [rsp + rcx*8 + 0x38], rdx
inc rcx
cmp rcx, 0x138
jb 0x180002090
mov dword [rsp + 0x30], 0x138
lea rsi, [rbx + 0x20]
cmp rbx, rsi
je 0x1800020d9
lea rcx, [rsp + 0x30]
call fcn.180006660
mov qword [rbx], rax
add rbx, 8
cmp rbx, rsi
jne 0x1800020c3
lea rax, vtable.ISocketInterfaceBase.0
mov qword [rdi], rax
mov qword [rdi + 0x3f8], rbp
mov dword [rdi + 0x400], ebp
lea rcx, [rdi + 0x408]
call qword [sym.imp.TT_SubSystem.dll_public:_void___cdecl_INwInterfaceSocket::constructor_void____ptr64]
nop
mov dword [rdi + 0x800], 0x1000100
mov rcx, rdi
call qword [sym.imp.TT_SubSystem.dll_public:_void____ptr64___cdecl_CEventHandler::GetEvHandle_void_const___ptr64]
mov qword [rdi + 0x418], rax
lea rcx, [rdi + 0x408]
call qword [sym.imp.TT_SubSystem.dll_public:_void____ptr64___cdecl_CEventHandler::GetEvHandle_void_const___ptr64]
mov qword [rdi + 0x18], rax
mov rax, rdi
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.18000f8d0
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180006660
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1800066c7
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x180006682
mov ecx, dword [r10]
jmp 0x1800067e8
cmp ecx, 0x270
jb 0x1800067e8
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
mov r8, rbx
add rbx, 8
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
mov qword [r8 - 0x9c0], rcx
sub rdi, 1
jne 0x180006700
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 8]
mov rdx, rbx
xor r9, r8
add rbx, 8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rdx - 0xea0]
xor rcx, r9
mov r9, r8
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x180006760
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x14003da00
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003da0d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003da1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003da05
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003da35
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003da22
sub eax, 3
jb 0x14003da4f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003da86
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003da76
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003da74
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003da63
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003d9c2
jmp 0x14003da0d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x23e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003dad2
cmp rsi, rcx
jae 0x14003dada
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003dab9
cmp al, 0x8f
ja 0x14003dab9
cmp byte [rsi - 2], 0xf
je 0x14003dabf
sub al, 0xe8
cmp al, 1
ja 0x14003daa3
cmp rsi, rcx
jae 0x14003dada
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003daa9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003dada
lodsb al, byte [rsi]
jmp 0x14003dab9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3a000]
mov eax, dword [rdi]
or eax, eax
je 0x14003db43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x42060]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003dae7
jns 0x14003db1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003db26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003db3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003db07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003db9b
sub rsp, 0xffffffffffffff80
jmp 0x1400242ac
Function at 0x1400012f0
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x140021560]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x140003f20
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
test r8, r8
je 0x140003f4b
lea r11, [0x140025010]
nop
movzx r9d, byte [rdx + r10]
inc r10
movzx eax, cl
xor r9, rax
shr rcx, 8
xor rcx, qword [r11 + r9*8]
cmp r10, r8
jb 0x140003f30
mov rax, rcx
ret
Function at 0x140005140
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov rbx, rcx
movsxd rdx, edx
mov rcx, qword [rcx + 0x10]
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x1400052e7
mov rcx, qword [rbx + 0x10]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test eax, eax
je 0x1400052e7
mov rcx, qword [rbx + 0x10]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x1400052e7
mov rcx, rax
mov qword [rsp + 0xa0], r14
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
mov r8d, 0x3000
mov r14, rax
mov edx, dword [rax]
xor edx, 0xe497a1b2
lea r9d, [rcx + 4]
mov dword [rsp + 0x98], edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1400052dc
lea r9d, [rsi - 4]
mov rcx, rax
lea r8, [r14 + 4]
lea rdx, [rsp + 0x98]
call fcn.140003ee0
test eax, eax
jne 0x1400052dc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [rbx + 8]
movsd xmm0, qword [rbx]
mov dword [rsp + 0x38], eax
movzx eax, word [rbx + 0xc]
mov word [rsp + 0x3c], ax
mov eax, 0x4d42
movsd qword [rsp + 0x30], xmm0
cmp word [rsp + 0x30], ax
jne 0x1400052b9
movups xmm0, xmmword [rbx + 0xe]
xor eax, eax
lea r9, [rsp + 0x90]
mov dword [rsp + 0x28], eax
lea rdx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
xor r8d, r8d
xor ecx, ecx
movups xmm1, xmmword [rbx + 0x1e]
mov qword [rsp + 0x20], rax
movups xmmword [rsp + 0x50], xmm1
movsd xmm0, qword [rbx + 0x2e]
movsd qword [rsp + 0x60], xmm0
call qword [sym.imp.GDI32.dll_CreateDIBSection]
mov rdi, rax
test rax, rax
je 0x1400052b9
mov r8d, dword [rsp + 0x98]
mov edx, dword [rsp + 0x3a]
mov rcx, qword [rsp + 0x90]
sub r8d, edx
add rdx, rbx
call fcn.140017e10
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r14, qword [rsp + 0xa0]
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r14, qword [rsp + 0xa0]
xor eax, eax
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x1400052ca
xor eax, eax
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x140005d38
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005d82
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005d82
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005d82
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005d82
cmp dword [rcx + 0x84], 0xe
jbe 0x140005d82
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005d84
xor al, al
add rsp, 0x28
ret

Function at 0x14000c9f0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000c7e0
Function at 0x140010a1c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140010aa3
mov rsi, rbx
cmp word [rax], bp
je 0x140010a62
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140010a4c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140010a48
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000d2f8
mov rdi, rax
test rax, rax
je 0x140010a90
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140017e10
mov rbp, rdi
xor ecx, ecx
call fcn.14000d2bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400175c0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400175e8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400175e8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180003730
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, r8
cmp rcx, 2
jne 0x1800037c6
movdqa xmm0, xmmword [rdx]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x180111730]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1800208f0
test rdi, rdi
je 0x180003846
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x18000385f
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x180003957
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1800039d8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r8, r9
and r8, 7
je 0x180003964
xor r10d, r10d
movzx r11d, byte [rcx + r10]
xor rax, r11
imul rax, rdx
inc r10
cmp r8, r10
jne 0x180003820
add r8, rcx
cmp r9, 8
jae 0x18000396d
jmp 0x1800039d8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1800208f0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1800039d8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1800039d8
mov r8, rcx
cmp r9, 8
jb 0x1800039d8
add rcx, r9
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x180003970
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1800208f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x180020932
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x18002093a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x18002094b
jmp 0x180020962
xor r10d, r10d
jmp 0x1800209ed
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x180020962
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x180020979
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x180020999
add r11, r8
jmp 0x180020aca
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x180020a62
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x180020a10
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x180020a80
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x180020a92
jmp 0x180020aac
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x180020aac
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x180020ac6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x180027110
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x180027145
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x18002714a
call fcn.1800d62e0
mov ecx, dword [0x18016cbc4]
mov r8, qword gs:[0x58]
mov rcx, qword [r8 + rcx*8]
mov qword [rcx + 0xa0], 1
mov qword [rcx + 0xa8], rax
mov qword [rcx + 0xb0], rdx
add rsp, 0x38
ret
Function at 0x180037da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x180037e36
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x180111730]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1800208f0
test rdi, rdi
je 0x180037ec5
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x180037ede
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x180037fd6
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x180038058
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x180037fe3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x180037ea0
cmp r9, 8
jae 0x180037fec
jmp 0x180038058
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.1800208f0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x180038058
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x180038058
mov r8, rcx
cmp r9, 8
jb 0x180038058
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x180037ff0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret