joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180024db0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
mov qword [rsp + 0x20], rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180024ff3
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea r12, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.18001fba0
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x28], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x180024fd2
movabs rax, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax]
mov rsi, qword [rsi]
mov r15, qword [rdi + 0x20]
lea r8, [rdi + 0x10]
mov r9, qword [rdi + 0x28]
cmp r9, 0x10
jb 0x180024e69
mov r8, qword [rdi + 0x10]
mov rcx, rax
xor edx, edx
test r15, r15
je 0x180024e94
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r10
inc rdx
cmp rdx, r15
jb 0x180024e80
and rcx, qword [r13 + 0x30]
shl rcx, 4
mov r13, qword [r12]
add r13, rcx
mov r12, qword [r13]
cmp r12, rbp
jne 0x180024eb9
mov qword [r13], rdi
mov qword [r13 + 8], rdi
jmp 0x180024fb3
mov rbx, qword [r13 + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180024ecf
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x180024edd
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180024f24
mov r8, r15
call fcn.1800f56a0
test eax, eax
jne 0x180024f20
mov rax, qword [rbx]
cmp rax, rdi
je 0x180024f17
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r13 + 8], rdi
jmp 0x180024fa9
mov r9, qword [rdi + 0x28]
cmp r12, rbx
je 0x180024f84
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180024f3f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x180024f4d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180024f24
mov r8, r15
call fcn.1800f56a0
test eax, eax
jne 0x180024f20
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x180024fa9
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r13], rdi
movabs r10, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
mov r13, qword [rsp + 0x20]
lea r12, [r13 + 0x18]
movabs rax, 0xcbf29ce484222325
jne 0x180024e50
mov qword [rsp + 0x28], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800f0448
int3
Function at 0x180025000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
mov qword [rsp + 0x20], rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180025243
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea r12, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.18001fba0
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x28], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x180025222
movabs rax, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax]
mov rsi, qword [rsi]
mov r15, qword [rdi + 0x20]
lea r8, [rdi + 0x10]
mov r9, qword [rdi + 0x28]
cmp r9, 0x10
jb 0x1800250b9
mov r8, qword [rdi + 0x10]
mov rcx, rax
xor edx, edx
test r15, r15
je 0x1800250e4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r10
inc rdx
cmp rdx, r15
jb 0x1800250d0
and rcx, qword [r13 + 0x30]
shl rcx, 4
mov r13, qword [r12]
add r13, rcx
mov r12, qword [r13]
cmp r12, rbp
jne 0x180025109
mov qword [r13], rdi
mov qword [r13 + 8], rdi
jmp 0x180025203
mov rbx, qword [r13 + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x18002511f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x18002512d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180025174
mov r8, r15
call fcn.1800f56a0
test eax, eax
jne 0x180025170
mov rax, qword [rbx]
cmp rax, rdi
je 0x180025167
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r13 + 8], rdi
jmp 0x1800251f9
mov r9, qword [rdi + 0x28]
cmp r12, rbx
je 0x1800251d4
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x18002518f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x18002519d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180025174
mov r8, r15
call fcn.1800f56a0
test eax, eax
jne 0x180025170
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x1800251f9
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r13], rdi
movabs r10, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
mov r13, qword [rsp + 0x20]
lea r12, [r13 + 0x18]
movabs rax, 0xcbf29ce484222325
jne 0x1800250a0
mov qword [rsp + 0x28], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800f0448
int3
Function at 0x180028190
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax], 0
je 0x180028219
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x10]
movzx edx, byte [rax]
call fcn.18000f7c0
movzx ebx, al
call fcn.180045cf0
lea rcx, [rsp + 0x38]
mov byte [rax + 0x509], bl
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f21e0
add rsp, 0x50
pop rbx
ret
mov rax, qword [rcx + 0x18]
mov r8, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x10]
movzx edx, byte [rax]
call fcn.18000f7c0
movzx ebx, al
call fcn.180045cf0
mov byte [rax + 0x509], bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800f21e0
add rsp, 0x50
pop rbx
ret

Function at 0x18002e900
Capabilities:
Check if file exists
Create directory
Encode data using xor
Get hostname

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x470
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x478], rbx
mov qword [rbp + 0x480], rsi
mov qword [rbp + 0x488], rdi
mov rax, qword [0x180189e48]
xor rax, rbp
mov qword [rbp + 0x430], rax
mov r13, rcx
lea rcx, [0x180169b40]
jmp 0x1801a9a4b
Function at 0x180032b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0x170], rax
cmp qword [rcx + 0x7a10], 0
mov rbx, rcx
jne 0x180032c8b
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x208
call fcn.1800f4bb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, 0x14
mov dword [rsp + 0x34], 0x9e00b8
xor r10d, r10d
mov dword [rsp + 0x30], ecx
mov r8d, eax
mov dword [rsp + 0x38], 0x9100ab
mov eax, r10d
mov dword [rsp + 0x3c], 0x930085
mov dword [rsp + 0x40], 0xac00b6
mov r9d, 0xed
mov dword [rsp + 0x44], 0xa500b0
mov dword [rsp + 0x48], 0x99009f
mov dword [rsp + 0x4c], 0x9f008b
mov dword [rsp + 0x50], 0x9900b6
mov dword [rsp + 0x54], 0xa10090
mov dword [rsp + 0x58], 0x16400da
mov dword [rsp + 0x5c], 0x101
nop
mov ecx, eax
lea rdx, [rsp + 0x34]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
mov ecx, dword [rsp + 0x30]
cmp eax, ecx
jb 0x180032bf0
mov word [rsp + rcx*2 + 0x34], r10w
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x60]
call sym.dll.dll__swprintf
xor r9d, r9d
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000018
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x7a10], rax
test rax, rax
je 0x180032cb0
xor r9d, r9d
mov qword [rsp + 0x20], 0x1000018
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x79e8], rax
test rax, rax
je 0x180032cb0
xor edx, edx
mov r8d, 0x1000018
mov rcx, rax
call fcn.1800f4bb0
mov eax, 1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.1800f21e0
mov rbx, qword [rsp + 0x298]
add rsp, 0x280
pop rbp
ret
xor eax, eax
jmp 0x180032c90

Function at 0x180032e50
Capabilities:
Terminate process

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x40
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x40], rdi
mov rax, qword [0x180189e48]
xor rax, rbp
mov qword [rbp], rax
mov r14, rcx
mov r15d, edx
lea rcx, str.WriteExeShareMemory_LoginStata
jmp 0x1801ab774
Function at 0x1800344f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movdqa xmm0, xmmword [0x18016c450]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
lea rax, [rbp - 0x48]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x60], inet_ntoa
mov dword [rbp - 0x5c], 0x948e8181
mov dword [rbp - 0x58], 0xda919b9d
mov dword [rbp - 0x54], 0xf8968399
xor eax, eax
nop word [rax + rax]
mov ecx, eax
lea rdx, [rbp - 0x5c]
add rdx, rcx
lea ecx, [rax - 0x13]
xor byte [rdx], cl
inc eax
mov edx, dword [rbp - 0x60]
cmp eax, edx
jb 0x180034560
mov byte [rbp + rdx - 0x5c], 0
lea rdx, [rbx + 0x4e8]
lea r8, [rbp - 0x5c]
lea rcx, [rbp - 0x48]
call fcn.18002b600
nop
xor r9d, r9d
lea r8, [rbp - 0x28]
mov rdx, rax
mov rcx, rbx
call fcn.180065170
mov ebx, eax
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x1800345dc
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800345d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18003460c
call fcn.1800f2580
movdqa xmm0, xmmword [0x18016c450]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800f21e0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
call fcn.1800f9714
int3

Function at 0x180034620
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [0x18016c450]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov ecx, 0x10
mov dword [rsp + 0x20], ecx
movdqa xmm0, xmmword [0x18016c540]
movdqu xmmword [rsp + 0x24], xmm0
mov byte [rsp + 0x34], 0xfd
xor eax, eax
mov word [rsp + 0x35], ax
mov byte [rsp + 0x37], al
nop word [rax + rax]
mov ecx, eax
lea rdx, [rsp + 0x24]
add rdx, rcx
lea ecx, [rax - 0x13]
xor byte [rdx], cl
inc eax
mov ecx, dword [rsp + 0x20]
cmp eax, ecx
jb 0x1800346a0
mov byte [rsp + rcx + 0x24], 0
lea rdx, [rbx + 0x4e8]
lea r8, [rsp + 0x24]
lea rcx, [rsp + 0x40]
call fcn.18002b600
nop
mov r9, rdi
lea r8, [rsp + 0x60]
mov rdx, rax
mov rcx, rbx
call fcn.180065170
mov ebx, eax
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x180034723
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003471e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180034759
call fcn.1800f2580
movdqa xmm0, xmmword [0x18016c450]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov eax, ebx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800f21e0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
call fcn.1800f9714
int3
Function at 0x180039520
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0x1f8], rax
mov r13, rdx
mov dword [rsp + 0x30], 0
lea rcx, [0x180169cf0]
jmp 0x1801adcda

Function at 0x18003c230
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Hash data using fnv
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0x760], rax
mov qword [rbp - 0x48], rdx
mov r13, rcx
mov qword [rsp + 0x70], rcx
xor r12d, r12d
mov dword [rsp + 0x44], r12d
lea rcx, str.Run_UserEncryptionScript
jmp 0x1801af864
Function at 0x18003f350
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov byte [rcx + 0x7ac8], 0
mov rcx, qword [rcx + 0xd58]
mov edx, 0x1000
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd58]
mov edx, 0x1001
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd58]
mov edx, 0x1002
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd58]
mov edx, 0x1003
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd58]
mov edx, 0x1004
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd58]
mov edx, 0x1005
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd58]
mov edx, 0x1006
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd58]
mov edx, 0x1007
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd58]
mov edx, 0x1008
call qword [sym.imp.USER32.dll_KillTimer]
mov rcx, qword [rbx + 0xd58]
mov edx, 0x1009
call qword [sym.imp.USER32.dll_KillTimer]
cmp byte [0x18018e277], 0
jne 0x18003f43c
xor eax, eax
lea r8, [0x180063290]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov byte [0x18018e276], 0
add rsp, 0x30
pop rbx
ret

Function at 0x180040e40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0x180], rax
cmp qword [rcx + 0x79f0], 0
mov rbx, rcx
jne 0x180040fab
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.1800f4bb0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r10d, r10d
mov dword [rsp + 0x30], 0x19
mov r8d, eax
mov dword [rsp + 0x34], 0x9e00b8
mov eax, r10d
mov dword [rsp + 0x38], 0x9100ab
mov dword [rsp + 0x3c], 0x930085
mov r9d, 0xed
mov dword [rsp + 0x40], 0xac00b6
mov dword [rsp + 0x44], 0xa200b0
mov dword [rsp + 0x48], 0xbc0098
mov dword [rsp + 0x4c], 0x960095
mov dword [rsp + 0x50], 0x9400a8
mov dword [rsp + 0x54], 0x8c009c
mov dword [rsp + 0x58], 0x14d009a
mov dword [rsp + 0x5c], 0x16f0164
mov dword [rsp + 0x60], 0x121015c
mov dword [rsp + 0x64], 0x1060161
nop
mov ecx, eax
lea rdx, [rsp + 0x34]
lea rdx, [rdx + rcx*2]
lea ecx, [r9 + rax]
inc eax
xor word [rdx], cx
mov ecx, dword [rsp + 0x30]
cmp eax, ecx
jb 0x180040f10
mov word [rsp + rcx*2 + 0x34], r10w
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x70]
call sym.dll.dll__swprintf
xor r9d, r9d
lea rax, [rsp + 0x70]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1000018
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rbx + 0x79f0], rax
test rax, rax
je 0x180040fd0
xor r9d, r9d
mov qword [rsp + 0x20], 0x1000018
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x79f8], rax
test rax, rax
je 0x180040fd0
xor edx, edx
mov r8d, 0x1000018
mov rcx, rax
call fcn.1800f4bb0
mov eax, 1
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1800f21e0
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rbp
ret
xor eax, eax
jmp 0x180040fb0
Function at 0x180045520
Capabilities:
Create thread
Encode data using base64
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rsi, rcx
lea rcx, [0x18016a780]
jmp 0x1801b6b8f
Function at 0x180047160
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
xor r11d, r11d
mov r9, rcx
mov edx, r11d
test eax, eax
je 0x180047195
mov r10d, 0xed
nop word [rax + rax]
mov eax, edx
lea ecx, [r10 + rdx]
inc edx
xor word [r9 + rax*2 + 4], cx
mov eax, dword [r9]
cmp edx, eax
jb 0x180047180
mov ecx, eax
lea rax, [r9 + 4]
mov word [r9 + rcx*2 + 4], r11w
ret

Function at 0x180047610
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180047632
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1800476ac
mov rdi, r14
mov rcx, rbx
call fcn.18001f540
test rax, rax
jle 0x180047684
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1800f4f70
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18004769c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1800476a4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180047646
sub r14, rdi
jmp 0x18004778f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1800476c3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800476c5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800476f7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1800f4f70
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18004778c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180047732
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18004776d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18010e8d8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18004778c
cmp rbp, rax
ja 0x180047740
test rbp, rbp
je 0x18004778c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18010e8d8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x180048120
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx]
lea r9, [rcx + 4]
xor edx, edx
test eax, eax
je 0x180048140
nop dword [rax]
lea r8d, [rdx - 0x13]
xor byte [rdx + r9], r8b
inc edx
mov eax, dword [rcx]
cmp edx, eax
jb 0x180048130
mov ecx, eax
mov rax, r9
mov byte [rcx + r9], 0
ret
Function at 0x180049890
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
mov qword [rsp + 0x20], rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180049ad3
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea r12, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.18001fba0
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x28], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x180049ab2
movabs rax, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax]
mov rsi, qword [rsi]
mov r15, qword [rdi + 0x20]
lea r8, [rdi + 0x10]
mov r9, qword [rdi + 0x28]
cmp r9, 0x10
jb 0x180049949
mov r8, qword [rdi + 0x10]
mov rdx, rax
xor ecx, ecx
test r15, r15
je 0x180049974
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r15
jb 0x180049960
mov r13, qword [r13 + 0x30]
and r13, rdx
shl r13, 4
add r13, qword [r12]
mov r12, qword [r13]
cmp r12, rbp
jne 0x180049999
mov qword [r13], rdi
mov qword [r13 + 8], rdi
jmp 0x180049a93
mov rbx, qword [r13 + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1800499af
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x1800499bd
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180049a04
mov r8, r15
call fcn.1800f56a0
test eax, eax
jne 0x180049a00
mov rax, qword [rbx]
cmp rax, rdi
je 0x1800499f7
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r13 + 8], rdi
jmp 0x180049a89
mov r9, qword [rdi + 0x28]
cmp r12, rbx
je 0x180049a64
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180049a1f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x180049a2d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180049a04
mov r8, r15
call fcn.1800f56a0
test eax, eax
jne 0x180049a00
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x180049a89
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r13], rdi
movabs r10, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
mov r13, qword [rsp + 0x20]
lea r12, [r13 + 0x18]
movabs rax, 0xcbf29ce484222325
jne 0x180049930
mov qword [rsp + 0x28], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800f0448
int3