joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a8020
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov edi, dword [rcx + 0x188]
mov ebp, 0x10000
mov r12d, dword [rcx + 0x150]
mov r14, rcx
mov r13d, dword [rcx + 0x16c]
cmp rdi, rbp
mov r15, qword [rcx + 0x180]
cmovb ebp, edi
xor ebx, ebx
mov ecx, ebp
call fcn.180001aeb
mov rsi, rax
test rax, rax
je 0x1800a813a
cmp r15, 0xffffffffffffffff
je 0x1800a8095
xor r8d, r8d
mov rdx, r15
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseeki64]
cmp rax, 0xffffffffffffffff
je 0x1800a80e2
test rdi, rdi
je 0x1800a80e7
nop word [rax + rax]
mov r8d, ebp
cmp rdi, rbp
mov rdx, rsi
mov ecx, r12d
cmovb r8d, edi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
test eax, eax
je 0x1800a80e7
cmp eax, 0xffffffff
je 0x1800a80e2
movsxd rcx, eax
mov r8d, eax
sub rdi, rcx
mov rdx, rsi
mov ecx, r13d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__write]
cmp eax, 0xffffffff
je 0x1800a80e2
add ebx, eax
test rdi, rdi
jne 0x1800a80a0
jmp 0x1800a80e7
mov ebx, 0xffffffff
mov rcx, rsi
call fcn.180003bf2
movsxd rax, ebx
mov qword [r14 + 0x88], rax
cmp rax, 0xffffffffffffffff
jne 0x1800a811d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
mov ecx, dword [rax]
mov dword [r14 + 0x14c], ecx
call fcn.180001f37
movsxd rcx, eax
mov qword [r14 + 0x88], rcx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, str.uv__malloc
mov ecx, select
call fcn.180002982
int3
Function at 0x1800a8c90
Capabilities:
Write file on windows

Disassembly:
jmp 0x1800a8c90
push rbx
push rbp
sub rsp, 0x58
mov rbx, rcx
mov ecx, dword [rcx + 0x150]
mov rbp, qword [rbx + 0x180]
cmp ecx, 0xffffffff
jne 0x1800a8cc8
mov dword [rbx + 0x14c], 6
mov qword [rbx + 0x88], 0xfffffffffffff00d
add rsp, 0x58
pop rbp
pop rbx
ret
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1800a8d04
lea ecx, [rax + 7]
mov dword [rbx + 0x14c], 6
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
mov r15, qword [rsp + 0x50]
add rsp, 0x58
pop rbp
pop rbx
ret
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
xor edi, edi
mov qword [rsp + 0x88], r14
cmp rbp, 0xffffffffffffffff
je 0x1800a8d35
xorps xmm0, xmm0
lea r14, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x1800a8d38
mov r14, rdi
mov esi, edi
nop word [rax + rax]
cmp rbp, 0xffffffffffffffff
je 0x1800a8d57
mov eax, esi
add rax, rbp
mov dword [rsp + 0x40], eax
shr rax, 0x20
mov dword [rsp + 0x44], eax
mov rax, qword [rbx + 0x178]
lea r9, [rsp + 0x70]
mov ecx, edi
add rcx, rcx
mov qword [rsp + 0x20], r14
mov r8d, dword [rax + rcx*8]
mov rdx, qword [rax + rcx*8 + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
add esi, dword [rsp + 0x70]
inc edi
test eax, eax
je 0x1800a8dbb
cmp edi, dword [rbx + 0x170]
jb 0x1800a8d40
mov eax, esi
mov qword [rbx + 0x88], rax
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x50]
add rsp, 0x58
pop rbp
pop rbx
ret
test esi, esi
jne 0x1800a8d91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rbx + 0x14c], eax
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
jmp 0x1800a8d9a
Function at 0x1800acd30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x20
mov r12, r8
mov rsi, rdx
mov r14, rcx
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x1800acd53
movsxd rax, edi
mov ebx, edi
lea rcx, [rcx + rax*2]
test ebx, ebx
jle 0x1800acd80
movzx eax, word [rcx - 2]
sub rcx, 2
dec ebx
cmp ax, 0x5c
je 0x1800acd80
cmp ax, 0x2f
jne 0x1800acd66
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], r15
test ebx, ebx
jne 0x1800acddf
test rsi, rsi
je 0x1800acdd0
mov ecx, 0x20a
call fcn.180001aeb
mov qword [rsi], rax
test rax, rax
je 0x1800ace7a
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1800acdd0
mov rcx, qword [rsi]
call fcn.180003bf2
xor ebp, ebp
lea eax, [rbx - 1]
mov qword [rsi], rbp
jmp 0x1800ace5c
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup]
mov qword [r12], rax
jmp 0x1800ace5a
xor ebp, ebp
test rsi, rsi
je 0x1800ace20
lea eax, [rbx + 2]
movsxd rcx, eax
add rcx, rcx
call fcn.180001aeb
mov qword [rsi], rax
test rax, rax
je 0x1800ace7a
lea r15d, [rbx + 1]
mov r8, r14
movsxd rdx, r15d
lea r9, [rbp - 1]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov rax, qword [rsi]
movsxd rcx, ebx
mov word [rax + rcx*2 + 2], bp
jmp 0x1800ace24
lea r15d, [rbx + 1]
sub edi, ebx
movsxd rbx, edi
lea rcx, [rbx + rbx]
call fcn.180001aeb
mov qword [r12], rax
test rax, rax
je 0x1800ace7a
mov rcx, qword [rsi]
mov r9, 0xffffffffffffffff
movsxd rdx, r15d
mov r8, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov rax, qword [r12]
mov word [rax + rbx*2 - 2], bp
xor eax, eax
mov r15, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rdi
ret
lea rdx, str.uv__malloc
mov ecx, select
call fcn.180002982
int3
Function at 0x1800ae0f0
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1800ae0f0
sub rsp, 0x478
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ecx, 0x202
lea rdx, [rsp + 0x2c0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800ae21c
lea r8, [0x18012e070]
xor edx, edx
lea rcx, str.0.0.0.0
call fcn.180003b25
test eax, eax
jne 0x1800ae215
lea r8, [0x18012e040]
xor edx, edx
lea rcx, [0x1800eddd4]
call fcn.180001645
test eax, eax
jne 0x1800ae215
mov qword [rsp + 0x480], rbx
lea ecx, [rax + 2]
mov qword [rsp + 0x470], rdi
xor r8d, r8d
mov edi, 1
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800ae202
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x1800ae22b
mov eax, dword [0x18012e084]
mov rcx, rbx
test dword [rsp + 0x40], 0x20000
cmove eax, edi
mov dword [0x18012e084], eax
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180002752
add rsp, 0x478
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1800ad930
test eax, eax
je 0x1800ae240
jmp 0x1800ae1da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.180002982
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.getsockopt
call fcn.180002982
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.socket
call fcn.180002982
int3
Function at 0x1800af120
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r13, r8
mov r14d, r9d
and r14d, 0x10
mov r15d, r9d
mov eax, r14d
mov rbx, rdx
neg eax
mov r12, rcx
mov eax, r14d
mov rsi, 0xffffffffffffffff
sbb ebp, ebp
and ebp, 0x80000100
neg eax
sbb r8d, r8d
and r8d, 3
and r15d, 0x20
je 0x1800af18c
or r8d, 1
or ebp, 0x40000080
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], 0x40
call fcn.1800017b2
mov edi, eax
test eax, eax
jne 0x1800af247
mov eax, dword [rbx + 0x110]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x40], 0x18
mov qword [rsp + 0x30], rdx
neg eax
mov qword [rsp + 0x48], rdx
mov edx, ebp
sbb ecx, ecx
mov dword [rsp + 0x50], 1
and ecx, 0x40000000
xor r8d, r8d
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800af23f
mov rcx, qword [rbx + 0x118]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x1800af21f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x1800af23f
test r14d, r14d
je 0x1800af22b
or dword [rbx + 0x58], 0x10000
test r15d, r15d
je 0x1800af237
or dword [rbx + 0x58], 0x8000
mov qword [r13], rsi
xor eax, eax
jmp 0x1800af26d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp qword [rbx + 0x118], 0xffffffffffffffff
je 0x1800af25c
mov rdx, rbx
mov rcx, r12
call fcn.180003175
cmp rsi, 0xffffffffffffffff
je 0x1800af26b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180002752
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800afab0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm2, xmmword [rcx + 0x10]
movups xmm0, xmmword [rcx]
xorps xmm5, xmm5
shufps xmm5, xmm0, 0x10
movups xmmword [rdx], xmm0
movaps xmm1, xmm5
xorps xmm1, xmm0
movups xmmword [rdx + 0x10], xmm2
shufps xmm5, xmm1, 0x8c
movaps xmm0, xmm5
shufps xmm5, xmm2, 0x10
xorps xmm0, xmm1
movaps xmm1, xmm5
xorps xmm1, xmm2
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm4, xmm2, 1
shufps xmm4, xmm4, 0xff
xorps xmm4, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm1
shufps xmm5, xmm4, 0x10
movaps xmm1, xmm5
movups xmmword [rdx + 0x20], xmm4
xorps xmm1, xmm4
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm3, xmm4, 1
shufps xmm3, xmm3, 0xaa
xorps xmm3, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm1
shufps xmm5, xmm3, 0x10
movaps xmm1, xmm5
movups xmmword [rdx + 0x30], xmm3
xorps xmm1, xmm3
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm2, xmm3, 2
shufps xmm2, xmm2, 0xff
xorps xmm2, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm1
shufps xmm5, xmm2, 0x10
movaps xmm1, xmm5
movups xmmword [rdx + 0x40], xmm2
xorps xmm1, xmm2
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm4, xmm2, 2
shufps xmm4, xmm4, 0xaa
xorps xmm4, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm1
shufps xmm5, xmm4, 0x10
movaps xmm1, xmm5
movups xmmword [rdx + 0x50], xmm4
xorps xmm1, xmm4
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm3, xmm4, 4
shufps xmm3, xmm3, 0xff
xorps xmm3, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm1
shufps xmm5, xmm3, 0x10
movaps xmm1, xmm5
movups xmmword [rdx + 0x60], xmm3
xorps xmm1, xmm3
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm2, xmm3, 4
shufps xmm2, xmm2, 0xaa
xorps xmm2, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm1
shufps xmm5, xmm2, 0x10
movaps xmm1, xmm5
movups xmmword [rdx + 0x70], xmm2
aeskeygenassist xmm4, xmm2, 8
shufps xmm4, xmm4, 0xff
xorps xmm1, xmm2
xorps xmm4, xmm0
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm3, xmm4, 8
shufps xmm3, xmm3, 0xaa
movups xmmword [rdx + 0x80], xmm4
movaps xmm0, xmm5
shufps xmm5, xmm4, 0x10
xorps xmm0, xmm1
movaps xmm1, xmm5
xorps xmm3, xmm0
xorps xmm1, xmm4
shufps xmm5, xmm1, 0x8c
movaps xmm0, xmm5
movups xmmword [rdx + 0x90], xmm3
xorps xmm0, xmm1
shufps xmm5, xmm3, 0x10
movaps xmm1, xmm5
xorps xmm1, xmm3
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm2, xmm3, 0x10
shufps xmm2, xmm2, 0xff
xorps xmm2, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm1
shufps xmm5, xmm2, 0x10
movaps xmm1, xmm5
movups xmmword [rdx + 0xa0], xmm2
xorps xmm1, xmm2
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm4, xmm2, 0x10
shufps xmm4, xmm4, 0xaa
xorps xmm4, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm1
shufps xmm5, xmm4, 0x10
movaps xmm1, xmm5
movups xmmword [rdx + 0xb0], xmm4
xorps xmm1, xmm4
shufps xmm5, xmm1, 0x8c
aeskeygenassist xmm3, xmm4, 0x20
shufps xmm3, xmm3, 0xff
xorps xmm3, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm1
shufps xmm5, xmm3, 0x10
movups xmmword [rdx + 0xc0], xmm3
aeskeygenassist xmm2, xmm3, 0x20
shufps xmm2, xmm2, 0xaa
xorps xmm2, xmm0
movaps xmm0, xmm5
xorps xmm0, xmm3
movups xmmword [rdx + 0xd0], xmm2
shufps xmm5, xmm0, 0x8c
aeskeygenassist xmm1, xmm2, 0x40
xorps xmm5, xmm0
shufps xmm1, xmm1, 0xff
xorps xmm5, xmm1
movups xmmword [rdx + 0xe0], xmm5
ret
Function at 0x1800afd50
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
jmp 0x1800afd50
sub rsp, 0x28
mov rax, rdx
mov r9, rcx
lea rdx, [rcx + 0x10]
mov rcx, rax
call fcn.1800afab0
movdqu xmm0, xmmword [r9 + 0x10]
lea rax, [r9 + 0x20]
mov edx, reloc.WS2_32.dll_listen
nop word [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rdx, 1
jne 0x1800afd80
aesenclast xmm0, xmmword [r9 + 0xf0]
movdqu xmmword [r9], xmm0
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800b3e40
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x1800b3e40
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, r9
mov rbx, r8
mov rsi, rdx
lea r9, [0x1800eded8]
mov rdi, rcx
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1800027f7
lea r8, [rbx + 0x10]
mov rdx, rsi
lea r9, [rsp + 0x20]
mov rcx, rdi
call fcn.180003972
mov edx, 0x20
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.1800015a0
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800b3f10
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x1800b3f10
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r9
mov rbp, r8
mov r8, qword [rsp + 0xb8]
lea r9, [0x1800edef0]
mov rsi, rdx
mov rdi, rcx
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800027f7
lea rax, [rsp + 0x30]
mov r8, rbp
mov qword [rsp + 0x28], rax
lea r9, [rbx + 0x10]
mov rax, qword [rsp + 0xb0]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180002d7e
mov edx, 0x20
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.1800015a0
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180002752
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800b4570
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x1800b45a0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x1800b45d0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret

Function at 0x1800b4620
Capabilities:
Get system information on windows

Disassembly:
jmp 0x1800b4620
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
mov qword [0x18012d858], rax
cmp rax, 0x10
jb 0x1800b4658
mov edx, select
lea rcx, [0x18012d860]
call fcn.18000179e
xor eax, eax
add rsp, 0x58
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3

Function at 0x1800b5170
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x1800b5170
push rbx
sub rsp, 0x50
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, r8
mov rbx, rcx
mov r8, rdx
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.18000214e
test eax, eax
je 0x1800b51b7
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rbx
ret
lea r9, [0x1800edf08]
mov rcx, rbx
lea r8, [rsp + 0x20]
lea rdx, [0x1800edf18]
call fcn.1800027f7
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rbx
ret
Function at 0x1800b5860
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x1800b5860
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1800b59fc
movzx eax, byte [r8]
mov ecx, 8
movups xmm0, xmmword [r9]
mov byte [rbp - 0x29], al
movzx eax, byte [r8 + 1]
movups xmm1, xmmword [r9 + 0x10]
mov byte [rbp - 0x28], al
movzx eax, byte [r8 + 2]
mov byte [rbp - 0x27], al
movzx eax, byte [r8 + 3]
mov byte [rbp - 0x26], al
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x25], al
movzx eax, byte [r8 + 5]
mov byte [rbp - 0x24], al
movzx eax, byte [r8 + 6]
mov byte [rbp - 0x23], al
movzx eax, byte [r8 + 7]
mov byte [rbp - 0x22], al
mov eax, ecx
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm1
nop dword [rax + rax]
cmp rax, 0x10
jae 0x1800b5a1f
mov byte [rbp + rax - 0x29], 0
inc ecx
inc rax
cmp ecx, 0x10
jb 0x1800b58f0
cmp rbx, 0x40
jb 0x1800b59b5
mov qword [rsp + 0xb8], rsi
mov rsi, rbx
shr rsi, 6
imul rax, rsi, 0xffffffffffffffc0
add rbx, rax
nop dword [rax]
lea r9, [0x1800edf30]
mov rcx, rdi
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x29]
call fcn.18000379c
movzx eax, byte [rbp - 0x20]
add rdi, 0x40
movzx ecx, byte [rbp - 0x21]
inc ecx
mov byte [rbp - 0x21], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1f]
mov byte [rbp - 0x20], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1e]
mov byte [rbp - 0x1f], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1d]
mov byte [rbp - 0x1e], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1c]
mov byte [rbp - 0x1d], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1b]
mov byte [rbp - 0x1c], cl
shr ecx, 8
add ecx, eax
mov byte [rbp - 0x1b], cl
shr ecx, 8
add byte [rbp - 0x1a], cl
sub rsi, 1
jne 0x1800b5930
mov rsi, qword [rsp + 0xb8]
test rbx, rbx
je 0x1800b59e0
lea r9, [0x1800edf30]
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 7]
call fcn.18000379c
test ebx, ebx
je 0x1800b59e0
mov r8d, ebx
lea rdx, [rbp + 7]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov edx, 0x40
lea rcx, [rbp + 7]
call fcn.1800015a0
mov edx, 0x20
lea rcx, [rbp - 0x19]
call fcn.1800015a0
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180002752
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800033be
int3
Function at 0x1800b65a0
Capabilities:
Hash data using sha512

Disassembly:
jmp 0x1800b65a0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
add rcx, 0x40
xor edx, edx
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
movabs rsi, 0x1f83d9abfb41bd6b
movabs rbp, 0x5be0cd19137e2179
mov qword [rdi + 0x30], rsi
movabs rcx, 0x6a09e667f3bcc908
mov qword [rdi + 0x38], rbp
movabs rdx, 0xbb67ae8584caa73b
mov qword [rdi], rcx
movabs r8, 0x3c6ef372fe94f82b
mov qword [rdi + 8], rdx
movabs r9, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x10], r8
movabs r10, 0x510e527fade682d1
mov qword [rdi + 0x18], r9
movabs r11, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x20], r10
mov qword [rdi + 0x28], r11
mov rax, qword [rbx]
xor rax, rcx
mov qword [rdi], rax
mov rax, qword [rbx + 8]
xor rax, rdx
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor rax, r8
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor rax, r9
mov qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor rax, r10
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor rax, r11
mov qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor rax, rsi
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
mov rbx, qword [rsp + 0x30]
xor rax, rbp
mov rbp, qword [rsp + 0x38]
mov qword [rdi + 0x38], rax
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1800b8ec0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r9, rcx
movzx eax, byte [rdx + 2]
movzx r8d, byte [rdx + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 1]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx]
shl r8d, 8
or r8d, eax
mov dword [rcx + 0x10], r8d
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x18], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x1c], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x20], ecx
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x24], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [r9 + 0x28], ecx
movzx ecx, byte [rdx + 0x1f]
movzx eax, byte [rdx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [r9], 0x61707865
mov dword [r9 + 0x2c], ecx
mov dword [r9 + 4], 0x3320646e
mov dword [r9 + 8], 0x79622d32
mov dword [r9 + 0xc], 0x6b206574
ret

Function at 0x1800b90b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.1800b9140
mov eax, 0xffffffff
cmp rbx, rax
ja 0x1800b90dd
mov edx, ebx
mov rcx, rdi
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x1800b90e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400da0f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400da13a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400da13a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400da13a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400da13a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400da13a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400da13c
xor al, al
add rsp, 0x28
ret

Function at 0x1400dd58c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400dd5fb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400dd5fb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400dd5fb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400dd5fb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400dd5fb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400dd5fb
cmp dword [rcx + 0xf8], 0
je 0x1400dd5fb
mov ecx, ebx
call fcn.1400dd6ac
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400dd488
nop
cmp dword [rbp + 0x20], 0
je 0x1400dd649
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400dd654
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400dd58c

Function at 0x1400dd790
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400dd58c