joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ae90
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov r8, rdx
mov dword [rsp + 0x20], ebx
mov r9, rdx
mov rsi, rcx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
call fcn.180051d30
test ebx, ebx
jne 0x18004aed4
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
mov rcx, rsi
call fcn.180051d30
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180065c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r12
sub rsp, 0x38
mov rsi, qword [rcx + 0x98]
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
mov r12, qword [rcx]
test rsi, rsi
je 0x180065e6b
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], r13
xor r13d, r13d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x30], r15
nop dword [rax + rax]
movsxd rbp, dword [rsi + 0x10]
movzx eax, byte [rbx + 0x1f]
mov r14d, dword [rsi + 0x14]
shl rbp, 5
add rbp, qword [r12 + 0x20]
test al, al
jne 0x180065cd2
inc dword [rbx + 0x38]
mov r15d, dword [rbx + 0x38]
jmp 0x180065ce2
dec al
movzx eax, al
mov byte [rbx + 0x1f], al
mov r15d, dword [rbx + rax*4 + 0xd4]
movsxd rcx, dword [rdi + 0x90]
lea r8d, [r14 + 2]
lea edx, [rcx + 7]
cmp dword [rdi + 0x94], ecx
jg 0x180065d0f
mov r9d, edx
mov dword [rsp + 0x20], r14d
mov edx, 0x37
mov rcx, rdi
call fcn.1800297f0
jmp 0x180065d3d
lea eax, [rcx + 1]
mov dword [rdi + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r14d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rbp + 0x18]
xor edx, edx
mov r8d, dword [rsi + 0x10]
mov rcx, rbx
mov dword [rsp + 0x20], 0x61
mov r9, qword [r9 + 0x68]
call fcn.180065160
mov eax, dword [rdi + 0x90]
add eax, 5
cmp eax, dword [rdi + 0x94]
jle 0x180065d7c
mov rcx, rdi
call fcn.180029660
test eax, eax
jne 0x180065e57
movsxd rax, dword [rdi + 0x90]
lea rcx, [rax + rax*2]
mov rax, qword [rdi + 0x88]
mov dword [rax + rcx*8 + 8], 2
mov byte [rax + rcx*8], 0x33
mov dword [rax + rcx*8 + 4], r13d
lea rdx, [rax + rcx*8]
mov eax, dword [rdi + 0x90]
mov dword [rdx + 0xc], r13d
lea ecx, [r14 + 1]
mov byte [rdx + 1], r13b
add eax, 2
mov dword [rdx + 8], eax
lea eax, [r14 - 1]
mov qword [rdx + 0x10], r13
mov word [rdx + 2], r13w
mov qword [rdx + 0x18], 0x79
mov qword [rdx + 0x20], r13
mov qword [rdx + 0x28], r13
mov qword [rdx + 0x30], 0x5b
mov qword [rdx + 0x38], 2
mov qword [rdx + 0x40], r13
mov qword [rdx + 0x48], 0x7a
mov qword [rdx + 0x50], r13
mov qword [rdx + 0x58], r13
mov qword [rdx + 0x60], 0x74
mov qword [rdx + 0x68], r13
mov qword [rdx + 0x70], r13
add dword [rdi + 0x90], 5
mov dword [rdx + 0x34], eax
mov eax, 8
mov word [rdx + 0x4a], ax
mov dword [rdx + 4], ecx
mov dword [rdx + 0x20], ecx
mov dword [rdx + 0x3c], r15d
mov dword [rdx + 0x50], r15d
mov dword [rdx + 0x54], ecx
test r15d, r15d
je 0x180065e4b
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x180065e4b
movzx eax, al
mov dword [rbx + rax*4 + 0xd4], r15d
inc byte [rbx + 0x1f]
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180065cb0
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r14, qword [rsp + 0x70]
add rsp, 0x38
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800acf30
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
lea rax, str.SELECT_parentnode_FROM__Q._q_parent_WHERE_nodeno_1
movsxd r15, edx
mov rdi, qword [rcx + r15*8 + 0x28]
lea r14, [rcx + r15*8]
mov qword [rsp + 0x40], rax
lea rax, str.SELECT_nodeno_FROM__Q._q_rowid_WHERE_rowid_1
mov qword [rsp + 0x48], rax
mov rbp, r9
mov rsi, r8
mov rbx, rcx
test rdi, rdi
jne 0x1800acf93
mov r9, qword [rcx + 0x10]
mov r8, qword [rcx + 8]
mov rdx, qword [rsp + r15*8 + 0x40]
call fcn.1800ace20
mov rdi, rax
mov qword [r14 + 0x28], rax
cmp dword [rbx + 0x40], 0
jne 0x1800ad049
mov r8, rsi
mov edx, 1
mov rcx, rdi
call sym.SQLite3.dll_sqlite3_bind_int64
mov rcx, rdi
call sym.SQLite3.dll_sqlite3_step
cmp eax, 0x65
jne 0x1800acfeb
test r15d, r15d
lea rcx, str.__rowid
lea rax, str.__parent
mov r9, rbp
cmovne rax, rcx
lea rdx, str.Mapping___lld_____lld__missing_from__s_table
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov r8, rsi
call fcn.1800aceb0
jmp 0x1800ad038
cmp eax, 0x64
jne 0x1800ad038
xor edx, edx
mov rcx, rdi
call sym.SQLite3.dll_sqlite3_column_int64
mov r9, rax
cmp rax, rbp
je 0x1800ad038
test r15d, r15d
mov qword [rsp + 0x30], rbp
lea rcx, str.__rowid
mov qword [rsp + 0x28], rsi
lea rax, str.__parent
mov r8, rsi
cmovne rax, rcx
lea rdx, str.Found___lld_____lld__in__s_table__expected___lld_____lld_
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.1800aceb0
mov rcx, rdi
call sym.SQLite3.dll_sqlite3_reset
cmp dword [rbx + 0x40], 0
jne 0x1800ad049
mov dword [rbx + 0x40], eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x1800ae6d2
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x20]
mov r8, r14

Function at 0x1800ae7d6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test edx, edx
je 0x1800ae82e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov r9, rcx
mov dword [rbp - 0x10], 0x52693250
xor r8d, r8d
mov dword [rbp - 0xc], 0x30314b54
mov dword [rbp - 8], 0x64615177
mov dword [rbp - 4], 0x4a50424b
Function at 0x180004a40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r10d, 2
mov dword [rcx + 0x200], 1
mov r11d, r10d
mov dword [rcx + 0x204], 1
mov esi, r8d
mov word [rcx + 0x208], 0
mov rbp, rdx
lea r9, [0x1800a6640]
xor dil, dil
mov rax, rcx
nop dword [rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [r9]
lea r9, [r9 + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [r9 - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [r9 - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [r9 - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [r9 - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [r9 - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [r9 - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [r9 - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r11, 1
jne 0x180004a90
mov rbx, rcx
nop
movzx r9d, byte [rbx]
lea rbx, [rbx + 1]
xor edx, edx
mov eax, r11d
div esi
inc r11d
movzx eax, byte [rdx + rbp]
add al, r9b
add dil, al
movzx edx, dil
movzx eax, byte [rdx + rcx]
mov byte [rbx - 1], al
mov byte [rdx + rcx], r9b
cmp r11d, 0x100
jb 0x180004af0
lea rax, [rcx + 0x100]
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub r10, 1
jne 0x180004b30
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x180004ba0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, dword [rcx + 0x204]
mov rdi, rdx
movzx r11d, byte [rcx + 0x209]
sub rdi, r10
sub r8, r10
mov rbx, rcx
lea esi, [r10 + r9]
cmp r10d, esi
jae 0x180004c54
lea r9, [r10 + r8]
sub rdi, r8
nop
movzx edx, r10b
lea r9, [r9 + 1]
inc r10d
movzx r8d, byte [rdx + rbx + 0x100]
add r11b, r8b
movzx ecx, r11b
movzx eax, byte [rcx + rbx + 0x100]
mov byte [rdx + rbx + 0x100], al
mov byte [rcx + rbx + 0x100], r8b
movzx eax, byte [rdx + rbx + 0x100]
add al, r8b
movzx ecx, al
movzx eax, byte [rcx + rbx + 0x100]
xor al, byte [rdi + r9 - 1]
mov byte [r9 - 1], al
cmp r10d, esi
jb 0x180004be0
mov dword [rbx + 0x204], r10d
mov byte [rbx + 0x209], r11b
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [rcx + 0x204], r10d
mov byte [rcx + 0x209], r11b
ret
Function at 0x1800050a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x1c0], rbx
mov rax, qword [0x1800b80b8]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov esi, r8d
mov rdi, rdx
mov edx, r8d
lea rcx, [rsp + 0x50]
call fcn.180004ff0
nop
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x20], bl
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.180003480
mov r15, qword [rsp + 0x30]
lea r14, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae r14, qword [rsp + 0x20]
lea rax, [rsp + 0x70]
mov r8d, 0x100
nop dword [rax + rax]
mov byte [rax], bl
inc bx
lea rax, [rax + 1]
cmp bx, r8w
jl 0x180005140
mov word [rbp + 0x70], 0
xor r11b, r11b
xor r10b, r10b
lea r9, [rsp + 0x70]
movzx edx, byte [r9]
movzx eax, r11b
movzx ecx, byte [rax + r14]
add cl, dl
add r10b, cl
movzx eax, r10b
lea rcx, [rsp + 0x70]
add rcx, rax
movzx eax, byte [rcx]
mov byte [r9], al
mov byte [rcx], dl
movzx eax, r11b
inc eax
cdq
idiv r15d
mov r11d, edx
inc r9
sub r8, 1
jne 0x180005160
movzx r9d, byte [rbp + 0x70]
movzx r10d, byte [rbp + 0x71]
test esi, esi
je 0x1800051f2
mov r11, rsi
nop dword [rax]
inc r9b
movzx eax, r9b
lea rdx, [rsp + 0x70]
add rdx, rax
movzx r8d, byte [rdx]
add r10b, r8b
movzx eax, r10b
lea rcx, [rsp + 0x70]
add rcx, rax
movzx eax, byte [rcx]
mov byte [rdx], al
mov byte [rcx], r8b
add r8b, byte [rdx]
movzx eax, r8b
movzx ecx, byte [rsp + rax + 0x70]
xor byte [rdi], cl
lea rdi, [rdi + 1]
sub r11, 1
jne 0x1800051b0
lea rcx, [rsp + 0x20]
call fcn.180003310
nop
mov rax, qword [rsp + 0x68]
cmp rax, 0x10
jb 0x180005255
inc rax
mov rcx, qword [rsp + 0x50]
cmp rax, 0x1000
jb 0x180005250
test cl, 0x1f
je 0x180005223
call fcn.180063584
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180005232
call fcn.180063584
int3
sub rcx, rax
cmp rcx, 8
jae 0x180005241
call fcn.180063584
int3
cmp rcx, 0x27
jbe 0x18000524d
call fcn.180063584
int3
mov rcx, rax
call fcn.18005c288
mov al, 1
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.18005c430
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x190
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000d3b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1800b80b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, r9d
mov rdi, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov dword [rsp + 0x48], 0x54004e
mov dword [rsp + 0x4c], 0x4c0044
mov dword [rsp + 0x50], 0x2e004c
mov dword [rsp + 0x54], 0x4c0044
mov dword [rsp + 0x58], Ordinal_79
xor ebx, ebx
movdqa xmm0, xmmword [0x1800a8650]
movdqu xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x6d654d6c
mov dword [rsp + 0x74], 0x79726f
mov rax, qword [0x180119cf8]
test rax, rax
jne 0x18000d44e
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180119cf8], rax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x38]
mov rcx, rdi
call rax
mov rcx, rax
mov dword [rsp + 0x30], eax
jmp 0x18000d47b
mov rax, qword [rsp + 0x38]
test ecx, ecx
cmovne rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18005c430
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800160f0
Capabilities:
Encode data using base64

Disassembly:
push rdi
push r14
push r15
mov edi, edx
lea r10d, [rdx*8]
mov r11, rcx
mov eax, 0x2aaaaaab
imul r10d
lea ecx, [rdi*8]
mov r14, r9
mov eax, edx
mov r15, r8
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 2
je 0x180016135
cmp ecx, 4
jne 0x180016138
add edx, 2
jmp 0x180016138
add edx, 3
inc edx
cmp dword [r9], edx
jge 0x18001614d
mov dword [r9], edx
mov eax, 0xfffffff0
pop r15
pop r14
pop rdi
ret
mov qword [rsp + 0x20], rbx
mov eax, 0x55555556
imul edi
xor ebx, ebx
mov qword [rsp + 0x28], rbp
mov eax, edx
mov qword [rsp + 0x38], r12
shr eax, 0x1f
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__bw_n
add edx, eax
mov ebp, ebx
mov rcx, r15
lea edx, [rdx + rdx*2]
test edx, edx
jle 0x18001620d
dec edx
mov qword [rsp + 0x30], rsi
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
mov esi, edx
lea ebp, [rdx + rdx*2]
nop word [rax + rax]
movzx r8d, byte [r11]
movzx r9d, byte [r11 + 1]
mov eax, r8d
movzx r10d, byte [r11 + 2]
mov edx, r9d
sar rax, 2
add r11, 3
and eax, 0x3f
sar edx, 4
shl r8d, 4
add edx, r8d
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + 1], al
mov eax, r10d
sar eax, 6
lea edx, [rax + r9*4]
and edx, 0x3f
movzx eax, byte [rdx + r12]
mov byte [rcx + 2], al
mov eax, r10d
and eax, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx + 3], al
add rcx, 4
sub rsi, 1
jne 0x1800161a0
mov rsi, qword [rsp + 0x30]
cmp ebp, edi
jge 0x18001626d
movzx r8d, byte [r11]
inc ebp
cmp ebp, edi
jge 0x180016220
movzx ebx, byte [r11 + 1]
mov eax, r8d
mov edx, ebx
sar rax, 2
sar edx, 4
and eax, 0x3f
shl r8d, 4
add edx, r8d
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + 1], al
cmp ebp, edi
jge 0x18001625f
and ebx, 0xf
shl ebx, 2
movsxd rax, ebx
movzx eax, byte [rax + r12]
mov byte [rcx + 2], al
jmp 0x180016263
mov byte [rcx + 2], 0x3d
add rcx, 3
mov byte [rcx], 0x3d
inc rcx
mov r12, qword [rsp + 0x38]
mov eax, ecx
mov rbp, qword [rsp + 0x28]
sub eax, r15d
mov rbx, qword [rsp + 0x20]
mov dword [r14], eax
xor eax, eax
mov byte [rcx], 0
pop r15
pop r14
pop rdi
ret
Function at 0x1800189f0
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x1800b80b8]
xor rax, rsp
mov qword [rbp], rax
mov rbx, r9
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x48]
call fcn.180018f30
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.180002300
nop
mov rax, qword [rsp + 0x60]
cmp rax, 0x10
jb 0x180018a98
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, 0x1000
jb 0x180018a93
test cl, 0x1f
je 0x180018a66
call fcn.180063584
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180018a75
call fcn.180063584
int3
sub rcx, rax
cmp rcx, 8
jae 0x180018a84
call fcn.180063584
int3
cmp rcx, 0x27
jbe 0x180018a90
call fcn.180063584
int3
mov rcx, rax
call fcn.18005c288
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x58], rsi
mov byte [rsp + 0x48], 0
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 0x10
cmovae rdx, qword [rsp + 0x70]
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x30], rsi
mov byte [rsp + 0x20], 0
cmp byte [rdx], 0
jne 0x180018ad8
mov r8, rsi
jmp 0x180018aea
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x180018ae0
lea rcx, [rsp + 0x20]
call fcn.180003920
mov byte [rbp - 8], 0
mov qword [rbp - 0x60], rsi
mov dword [rbp - 0x70], 0x67452301
mov dword [rbp - 0x6c], 0xefcdab89
mov dword [rbp - 0x68], 0x98badcfe
mov dword [rbp - 0x64], 0x10325476
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.18000f1d0
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x180018b8f
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, 0x1000
jb 0x180018b8a
test cl, 0x1f
je 0x180018b5d
call fcn.180063584
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180018b6c
call fcn.180063584
int3
sub rcx, rax
cmp rcx, 8
jae 0x180018b7b
call fcn.180063584
int3
cmp rcx, 0x27
jbe 0x180018b87
call fcn.180063584
int3
mov rcx, rax
call fcn.18005c288
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.18000fe80
cmp qword [rdi + 0x18], 0x10
jb 0x180018ba7
mov rcx, qword [rdi]
jmp 0x180018baa
mov rcx, rdi
call qword [sym.imp.USER32.dll_CharUpperA]
nop
mov rax, qword [rbp - 0x78]
cmp rax, 0x10
jb 0x180018c08
inc rax
mov rcx, qword [rsp + 0x70]
cmp rax, 0x1000
jb 0x180018c03
test cl, 0x1f
je 0x180018bd6
call fcn.180063584
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x180018be5
call fcn.180063584
int3
sub rcx, rax
cmp rcx, 8
jae 0x180018bf4
call fcn.180063584
int3
cmp rcx, 0x27
jbe 0x180018c00
call fcn.180063584
int3
mov rcx, rax
call fcn.18005c288
mov rax, rdi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.18005c430
add rsp, 0x118
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180019230
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov rdi, rdx
mov ecx, reloc.WS2_32.dll_WSASetLastError
call fcn.18005c454
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rax
mov rbx, rax
lea r8d, [rdx + 0x70]
call fcn.180061460
mov rcx, rbx
call fcn.180018fd0
mov qword [rsi + 0x98], rax
cmp byte [rdi], 0
jne 0x18001927e
xor r8d, r8d
jmp 0x18001928c
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], 0
jne 0x180019282
lea rcx, [rax + 0x10]
mov rdx, rdi
call fcn.180003920
mov rax, qword [rsi + 0x98]
lea rdx, str.GET_test1
mov r8d, 9
mov dword [rax + 8], 1
mov rcx, qword [rsi + 0x98]
add rcx, 0x48
call fcn.180003920
lea rax, [rsi + 0x20]
mov r9, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x180019320]
xor edx, edx
mov dword [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi + 0x28], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x180019302
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18001ae20
Capabilities:
Get mac address on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x250
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov r14, rcx
xor edi, edi
mov dword [rsp + 0x40], edi
xor bpl, bpl
mov byte [rax + 0x10], bpl
xor ebx, ebx
mov dword [rax + 0x11], ebx
mov byte [rax + 0x15], bl
mov dword [rax + 8], edi
lea rdx, [rax + 8]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov r15d, dword [rsp + 0x280]
mov ecx, r15d
call fcn.18005c490
mov rsi, rax
test rax, rax
je 0x18001ae92
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.180061460
mov byte [rsi], bl
jmp 0x18001ae95
mov rsi, rdi
mov qword [rsp + 0x290], rsi
test rsi, rsi
je 0x18001af06
lea rdx, [rsp + 0x280]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x18001af06
mov rbx, rsi
nop word [rax + rax]
lea rcx, [rbx + 0xc]
call fcn.18001aa00
cmp eax, 1
ja 0x18001aeee
mov ecx, dword [rbx + 0x198]
mov dword [rsp + 0x288], ecx
movzx ecx, word [rbx + 0x19c]
mov word [rsp + 0x28c], cx
test eax, eax
je 0x18001aef6
mov rbx, qword [rbx]
test rbx, rbx
jne 0x18001aec0
movzx ebx, byte [rsp + 0x28d]
movzx ebp, byte [rsp + 0x288]
xor edx, edx
mov r8d, 0x200
lea rcx, [rsp + 0x50]
call fcn.180061460
movzx eax, bl
movzx ecx, byte [rsp + 0x28c]
movzx edx, byte [rsp + 0x28b]
movzx r10d, byte [rsp + 0x28a]
movzx r9d, byte [rsp + 0x289]
movzx r8d, bpl
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r10d
lea rdx, str._02X__02X__02X__02X__02X__02X
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [r14 + 0x18], 7
mov qword [r14 + 0x10], rdi
cmp qword [r14 + 0x18], 8
jb 0x18001af7c
mov rax, qword [r14]
jmp 0x18001af7f
mov rax, r14
mov word [rax], di
cmp word [rsp + 0x50], 0
je 0x18001af9d
lea rax, [rsp + 0x50]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18001af93
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.180002680
nop
test rsi, rsi
je 0x18001afbb
mov rcx, rsi
call fcn.18005c38c
mov rax, r14
mov rbx, qword [rsp + 0x298]
add rsp, 0x250
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001c6d0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov esi, reloc.WS2_32.dll_recv
lea rbx, [rsp]
mov eax, esi
mov r11, rdx
mov rdi, rcx
mov r10d, 2
nop dword [rax]
nop word [rax + rax]
mov ecx, r10d
lea r8d, [r10 - 2]
movzx r8d, byte [r8 + r11]
lea edx, [r10 - 1]
movzx edx, byte [rdx + r11]
lea rbx, [rbx + 4]
shl r8d, 8
or r8d, edx
movzx edx, byte [rcx + r11]
shl r8d, 8
lea ecx, [r10 + 1]
movzx ecx, byte [rcx + r11]
or r8d, edx
shl r8d, 8
add r10d, 4
or r8d, ecx
mov dword [rbx - 4], r8d
sub rsi, 1
jne 0x18001c710
lea r11, [rsp + 0x40]
nop
lea ecx, [rax - 0xf]
mov r9d, dword [rsp + rcx*4]
lea r11, [r11 + 4]
lea ecx, [rax - 2]
mov edx, r9d
mov r8d, dword [rsp + rcx*4]
mov r10d, r8d
rol r10d, 0xf
mov ecx, r8d
rol ecx, 0xd
xor r10d, ecx
rol edx, 0xe
mov ecx, r9d
shr r8d, 0xa
ror ecx, 7
xor r10d, r8d
xor edx, ecx
shr r9d, 3
lea ecx, [rax - 0x10]
xor edx, r9d
add r10d, edx
add r10d, dword [rsp + rcx*4]
lea ecx, [rax - 7]
add r10d, dword [rsp + rcx*4]
inc eax
mov dword [r11 - 4], r10d
cmp eax, 0x40
jb 0x18001c760
mov r9d, dword [rdi + 0x50]
xor r11d, r11d
mov ebx, dword [rdi + 0x54]
mov esi, dword [rdi + 0x58]
mov r12d, dword [rdi + 0x5c]
mov r10d, dword [rdi + 0x60]
lea r15d, [r11 + 0x40]
mov ebp, dword [rdi + 0x64]
mov r14d, dword [rdi + 0x68]
mov r13d, dword [rdi + 0x6c]
lea rdi, [0x1800a6ba0]
nop word [rax + rax]
mov r8d, r10d
lea r11, [r11 + 4]
ror r8d, 0xb
mov eax, r10d
rol eax, 7
mov ecx, r10d
xor r8d, eax
not ecx
and ecx, r14d
mov eax, r10d
ror eax, 6
mov edx, r9d
xor r8d, eax
ror edx, 0xd
mov eax, ebp
and eax, r10d
xor ecx, eax
mov eax, r9d
add r8d, ecx
rol eax, 0xa
add r8d, dword [r11 + rdi - 4]
xor edx, eax
add r8d, dword [rsp + r11 - 4]
mov eax, r9d
ror eax, 2
add r8d, r13d
xor edx, eax
mov ecx, ebx
xor ecx, r9d
mov eax, ebx
and eax, r9d
and ecx, esi
xor ecx, eax
mov r13d, r14d
add edx, ecx
mov r14d, ebp
mov ebp, r10d
lea r10d, [r8 + r12]
mov r12d, esi
mov esi, ebx
mov ebx, r9d
lea r9d, [rdx + r8]
sub r15, 1
jne 0x18001c7f0
mov rdi, qword [rsp + 0x140]
add dword [rdi + 0x54], ebx
add dword [rdi + 0x50], r9d
add dword [rdi + 0x58], esi
add dword [rdi + 0x5c], r12d
add dword [rdi + 0x60], r10d
add dword [rdi + 0x64], ebp
add dword [rdi + 0x68], r14d
add dword [rdi + 0x6c], r13d
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret