joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180072780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov r14, rdx
mov rbp, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call fcn.180048ba0
mov rdi, rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov r8d, setsockopt
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rsp + 0x30]
call fcn.1800052d0
nop
call fcn.180061ed0
lea rsi, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x180072853
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180072840
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.180049aa0
mov r8, qword [rax + 8]
test r8, r8
je 0x1800728ad
cmp r8, qword [rdi + 8]
je 0x1800728ad
mov rdi, qword [r8 + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x1800728b6
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], gethostbyname
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 8]
call rdi
mov edi, eax
jmp 0x1800728bb
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 0xc0000138
lea rcx, [rsp + 0x30]
call fcn.180005250
test edi, edi
je 0x1800728cd
mov eax, edi
jmp 0x18007290e
mov rax, qword [rsp + 0x68]
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0x70]
mov dword [rbx + 0x10], eax
mov rax, qword [rsp + 0x60]
mov qword [rbx], rax
mov eax, dword [rsp + 0x84]
mov dword [rbx + 0x24], eax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x18], rax
mov eax, dword [rsp + 0x80]
mov dword [rbx + 0x20], eax
mov eax, dword [rsp + 0x88]
mov dword [rbx + 0x28], eax
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18007b140
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180072940
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, rdx
mov rbp, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x40], xmm0
mov dword [r11 - 0x30], r14d
call fcn.180048ba0
mov rbx, rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], r14b
lea r8d, [r14 + 0x19]
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.1800052d0
nop
mov dword [rsp + 0x30], 1
call fcn.180061ed0
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov ecx, r14d
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x180072a23
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180072a10
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.180049aa0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180072a83
cmp rcx, qword [rbx + 8]
je 0x180072a83
mov rbx, qword [rcx + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180072a8c
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, gethostbyname
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [rbp + 8]
call rbx
test eax, eax
js 0x180072a8c
test rsi, rsi
je 0x180072a8c
mov bl, 1
jmp 0x180072a8e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.180005250
test bl, bl
je 0x180072ab9
mov qword [rsp + 0x20], r14
mov r9d, 0x250
mov r8, rsi
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18007b140
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180072b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, r8
mov rbp, rdx
mov r14, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [r11 - 0x50], rax
mov dword [r11 - 0x48], eax
mov dword [r11 - 0x40], r15d
call fcn.180048ba0
mov rbx, rax
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], r15b
lea r8d, [r15 + 0x18]
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.1800052d0
nop
mov dword [rsp + 0x30], 1
call fcn.180061ed0
lea rdi, [rbx + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rdx, qword [rsp + 0x38]
movabs r9, 0xcbf29ce484222325
mov ecx, r15d
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x180072bf3
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180072be0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.180049aa0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180072c52
cmp rcx, qword [rbx + 8]
je 0x180072c52
mov rbx, qword [rcx + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x180072c5b
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x1c
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, rbp
call rbx
test eax, eax
js 0x180072c5b
test rsi, rsi
je 0x180072c5b
mov bl, 1
jmp 0x180072c5d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
lea rcx, [rsp + 0x38]
call fcn.180005250
test bl, bl
je 0x180072c87
mov edx, dword [rsp + 0x6c]
mov qword [rsp + 0x20], r15
mov r9d, 0x1000
mov r8, rsi
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180072cc0
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x68
ret
Function at 0x180072d90
Capabilities:
Get common file path
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], r14
lea rsi, [rcx + 0x20]
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], 7
mov word [rsi], r14w
lea rbx, [rcx + 0x40]
mov qword [rsp + 0x20], rbx
mov dword [rbx], r14d
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
lea ecx, [r14 + 0x38]
call fcn.18007b16c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
lea edx, [r14 + 0x10]
call fcn.18001b0d0
nop
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x60]
call fcn.180211600
mov r8d, 0x104
lea rdx, [rbp + 0x60]
lea rcx, str._NT_SYMBOL_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x180072fae
lea rdx, [rbp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x180072fae
xor edx, edx
mov r8d, 0xf8
lea rcx, [rsp + 0x60]
call fcn.180211600
lea rcx, [rsp + 0x60]
call fcn.180073e40
nop
lea rdx, str.srv
lea rcx, [rsp + 0x70]
call fcn.18003b820
mov rcx, rax
lea rdx, [rbp + 0x60]
call fcn.18003b820
mov rcx, rax
lea rdx, str.Symbolshttp:__msdl.microsoft.com_download_symbols
call fcn.18003b820
nop
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
mov dword [rsp + 0x20], 2
mov rcx, qword [rbp - 0x18]
test cl, 2
jne 0x180072f2b
mov rax, qword [rbp - 0x48]
mov r8, qword [rax]
test r8, r8
je 0x180072f2b
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x20]
cmovb r8, qword [rbp - 0x20]
sub r8, rdx
jmp 0x180072f53
test cl, 4
jne 0x180072f61
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
test rcx, rcx
je 0x180072f61
mov rax, qword [rbp - 0x70]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x38]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x28]
call fcn.18000dc00
nop
lea rax, [rsp + 0x28]
cmp rsi, rax
je 0x180072f98
mov rcx, rsi
call fcn.18000db90
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rsi + 0x10], xmm1
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
lea rcx, [rsp + 0x28]
call fcn.18000db90
nop
lea rcx, [rsp + 0x60]
call fcn.180073070
nop
mov rax, rdi
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.18007b140
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180076800
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800769df
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001b0d0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1800769a8
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x18007691c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180076997
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x180076959
mov r10, qword [rax]
cmp r10, rcx
je 0x180076953
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180076997
mov r8, rax
cmp r10, rax
je 0x180076973
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1800769b9
cmp r10, rax
jne 0x180076961
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1800768a0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x180076997
lea rcx, str.invalid_hash_bucket_count
call fcn.1800777b0
int3
Function at 0x180079f5c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x180079fa0
movzx eax, r14w
jmp 0x18007a0d6
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x180079fdc
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x180079fdc
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x18007a0d6
cmp qword [rcx + 0x80], r14
je 0x18007a0d3
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x18007a01a
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18007a043
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.180229308
cmp ax, di
je 0x18007a0d3
movzx edi, si
jmp 0x18007a0d3
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [0x1802578b8]
test eax, eax
je 0x18007a098
sub eax, 1
je 0x18007a098
cmp eax, 2
jne 0x18007a0d3
movzx ecx, word [rbp + 7]
jmp 0x18007a026
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x18007a0c2
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.18021ddc4
cmp r14, rax
jne 0x18007a0d3
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x18007a0d6
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.18007b140
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800849e0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180084a76
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x180084a76
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x180084a9a
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x30]
call fcn.180004800
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.180084b50
lea rdx, [0x1803689c0]
lea rcx, [rsp + 0x50]
call fcn.180210db4
int3

Function at 0x180084f40
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x18038583c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1803858d0], ecx
jg 0x18008501f
mov eax, ebx
cmp rbx, rax
jne 0x180084fe1
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x180084fe1
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x1803858c8]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x180085062
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.180004800
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180084b50
lea rdx, [0x1803689c0]
lea rcx, [rsp + 0x40]
call fcn.180210db4
nop
lea rcx, [0x1803858d0]
call fcn.18007b370
cmp dword [0x1803858d0], 0xffffffff
jne 0x180084f8c
lea rcx, [0x1803858c8]
call fcn.1800849e0
lea rcx, [0x180256150]
call fcn.18007baa0
nop
lea rcx, [0x1803858d0]
call fcn.18007b310
jmp 0x180084f8c
lea rdx, str.CryptGenRandom
lea rcx, [rsp + 0x20]
call fcn.180004800
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.180084b50
lea rdx, [0x1803689c0]
lea rcx, [rsp + 0x40]
call fcn.180210db4
int3
Function at 0x1800a7af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r11, rdx
mov r9, rcx
mov r10d, ebx
cmp r8, 8
jb 0x1800a7b37
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
add r9, 8
xor rax, qword [r11]
add r11, 8
or r10, rax
sub rcx, 1
jne 0x1800a7b20
mov rdx, r10
shr rdx, 0x20
or edx, r10d
mov eax, edx
mov ecx, edx
shr eax, 8
or eax, edx
shr ecx, 0x10
and eax, 0xff00
or eax, ecx
movzx ecx, dl
shr eax, 8
or eax, ecx
test r8, r8
je 0x1800a7c37
cmp r8, 8
jb 0x1800a7c13
mov rdx, r8
lea r10, [r11 + 4]
and rdx, 0xfffffffffffffff8
mov rcx, r9
sub rcx, r11
xorps xmm4, xmm4
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r10 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r10 - 4]
lea r10, [r10 + 8]
punpcklbw xmm2, xmm0
add rbx, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r10 - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + r10 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rbx, rdx
jb 0x1800a7b90
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or eax, ecx
cmp rbx, r8
jae 0x1800a7c37
sub r9, r11
lea r10, [rbx + r11]
sub r8, rbx
nop dword [rax]
movzx edx, byte [r10 + r9]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
or eax, edx
sub r8, 1
jne 0x1800a7c20
mov rbx, qword [rsp + 8]
test eax, eax
sete al
ret
Function at 0x1800a7c50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1800a7da4
cmp r9, 4
jb 0x1800a7c9a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1800a7c80
xor r11d, r11d
test r9, r9
je 0x1800a7da4
cmp r9, 0x40
jb 0x1800a7d83
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1800a7ccc
cmp rdx, r8
jae 0x1800a7d83
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x1800a7ce1
cmp rdx, r10
jae 0x1800a7d83
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rdi
jb 0x1800a7d10
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
cmp r11, r9
jae 0x1800a7da4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1800a7d90
add rsp, 8
ret

Function at 0x1800a7db0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, rdx
test r8, r8
je 0x1800a7ec1
cmp r8, 4
jb 0x1800a7df3
mov rdx, r8
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r9]
add r9, 4
xor dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1800a7de0
xor r10d, r10d
test r8, r8
je 0x1800a7ec1
cmp r8, 0x40
jb 0x1800a7ea5
lea rdx, [rcx - 1]
lea rax, [r9 - 1]
add rdx, r8
add rax, r8
cmp rcx, rax
ja 0x1800a7e25
cmp rdx, r9
jae 0x1800a7ea5
mov r11, r8
mov qword [rsp], rbx
and r11, 0xffffffffffffffc0
mov rdx, r9
lea rax, [rcx + 0x10]
sub rdx, rcx
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp r10, r11
jb 0x1800a7e40
mov rbx, qword [rsp]
cmp r10, r8
jae 0x1800a7ec1
sub r9, rcx
lea rdx, [r10 + rcx]
sub r8, r10
nop
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x1800a7eb0
add rsp, 8
ret