joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000b620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18000b640
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x18000b680
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18000b6a0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x18000b6e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18000b703
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x18000b760
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18000b783
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x18000b7e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18000b809
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
repz ret
Function at 0x18000b870
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18000b899
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
repz ret

Function at 0x18000b900
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x18000b95f

Function at 0x18000b950
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.18000b950
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x18000b9e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x18000ba3f
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18000ba30
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret
Function at 0x18000bac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x18000bb1a

Function at 0x18000bb3a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18000bb10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret

Function at 0x18000bbd0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x18000bc2a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x18000bc20
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
aesdeclast xmm8, xmm0
aesdeclast xmm9, xmm0
repz ret

Function at 0x18000d760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.18000d7e0
shl edx, 4
test eax, eax
jne 0x18000d7ce
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x18000d78f
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x180011580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1800116a0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1800115e0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1800115e0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1800115e0
Function at 0x18002f220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x18002f254
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x18002f240
ret
Function at 0x180036b50
Capabilities:
Create directory
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x348
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
lea rdx, [rsp + 0x120]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
jbe 0x180036bad
mov r8d, 0x104
lea rdx, [rsp + 0x120]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, rbx
lea rcx, [rsp + 0x120]
call fcn.180037020
xor edx, edx
mov r8d, reloc.WLDAP32.dll_Ordinal_200
lea rcx, [rsp + 0x50]
call fcn.180136140
mov ecx, dword [0x1804a2b54]
mov rax, qword gs:[0x58]
mov edx, 0x76c8
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1804a3cd8], ecx
jle 0x180036c39
lea rcx, [0x1804a3cd8]
call fcn.1801337d8
cmp dword [0x1804a3cd8], 0xffffffff
jne 0x180036c39
mov word [0x1804a3ce1], 0x149
mov dword [0x1804a3cdc], 0xf698fa60
mov byte [0x1804a3ce0], 0
lea rcx, [0x180169fc0]
call fcn.180133c8c
lea rcx, [0x1804a3cd8]
call fcn.180133778
cmp byte [0x1804a3ce2], 0
je 0x180036c73
xor byte [0x1804a3cdc], 0x45
xor byte [0x1804a3cdd], 0x89
xor byte [0x1804a3cde], 0xc7
xor byte [0x1804a3cdf], 0xd3
xor byte [0x1804a3ce0], 0x73
xor byte [0x1804a3ce1], 0x49
mov byte [0x1804a3ce2], 0
mov qword [rsp + 0x20], rbp
mov r9, rsi
lea r8, [0x1804a3cdc]
mov edx, reloc.WLDAP32.dll_Ordinal_200
lea rcx, [rsp + 0x50]
call fcn.180036af0
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.18004c4e8
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.18002e580
cmp qword [rbx + 0x18], 0x10
jb 0x180036ce1
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180036d26
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180036d21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180036d42
call fcn.180133ca4
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.180133630
add rsp, 0x348
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18013a40c
int3
Function at 0x180036d50
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rax, qword gs:[0x58]
mov r14, rcx
mov ecx, dword [0x1804a2b54]
mov edi, 1
movdqa xmm6, xmmword [0x1801dfed0]
movdqa xmm7, xmmword [0x1801dfd70]
mov edx, 0x76c8
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov dword [rbp - 0x31], 0x40
mov dword [rbp - 0x2d], edi
mov eax, dword [rsi]
cmp dword [0x1804a3c9c], eax
jle 0x180036e09
lea rcx, [0x1804a3c9c]
call fcn.1801337d8
cmp dword [0x1804a3c9c], 0xffffffff
jne 0x180036e09
lea rcx, [0x180169ff0]
mov byte [0x1804a3cd0], dil
movups xmmword [0x1804a3cb0], xmm6
movups xmmword [0x1804a3cc0], xmm7
call fcn.180133c8c
lea rcx, [0x1804a3c9c]
call fcn.180133778
xor ebx, ebx
lea rdx, [0x1804a3cb0]
cmp byte [0x1804a3cd0], bl
je 0x180036e6b
mov r10d, ebx
sub rdi, rdx
movabs r11, 0x194db9cd9b4dbd9f
nop word [rax + rax]
lea r9, [r10 + rdx]
movzx ecx, r10b
and cl, 7
mov rax, r11
shl cl, 3
mov r8, r11
shr rax, cl
add r10, 2
xor byte [r9], al
lea ecx, [r9 + rdi]
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + 1], r8b
cmp r10, 0x20
jb 0x180036e30
mov byte [0x1804a3cd0], bl
lea rax, [rbp - 0x49]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [rsi]
mov edi, eax
cmp dword [0x1804a3cd4], ecx
mov dword [rbp - 0x41], 0x23b2c8e4
mov dword [rbp - 0x3d], 0x284ea71c
mov dword [rbp - 0x39], 0x4bb5c0dc
jle 0x180036ef5
lea rcx, [0x1804a3cd4]
call fcn.1801337d8
cmp dword [0x1804a3cd4], 0xffffffff
jne 0x180036ef5
movsd xmm0, qword [rbp - 0x41]
lea rcx, [0x180169fe0]
mov eax, dword [rbp - 0x39]
movsd qword [0x1804a3ca0], xmm0
mov byte [0x1804a3cac], 1
mov dword [0x1804a3ca8], eax
call fcn.180133c8c
lea rcx, [0x1804a3cd4]
call fcn.180133778
cmp byte [0x1804a3cac], bl
lea rdx, [0x1804a3ca0]
je 0x180036f32
movabs r8, 0x6f2bc9754bd1a9a9
nop
movzx ecx, bl
mov rax, r8
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rbx + rdx], al
inc rbx
cmp rbx, 0xc
jb 0x180036f10
mov byte [0x1804a3cac], 0
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x2d]
lea rax, [rbp - 0x29]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test edi, edi
jne 0x180036f86
test eax, eax
jne 0x180036f86
lea rax, [rbp - 0x29]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180036f70
lea rdx, [rbp - 0x29]
mov rcx, r14
call fcn.18002c300
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180133630
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18003a550
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x270
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rsp + 0x260], rax
movsxd rbp, ecx
xor edi, edi
mov r15d, edi
mov qword [rsp + 0x58], rbp
mov dword [rsp + 0x50], 1
call fcn.18002bc20
mov ecx, dword [rax + 0x158]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x44], edi
xor bl, bl
nop word [rax + rax]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
xor edx, edx
lea ecx, [rbp + 1]
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x18003a6e6
cmp eax, 0xffffffff
jne 0x18003a5eb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x18003a65f
mov bl, 1
jmp 0x18003a5b0
test bl, bl
jne 0x18003a5b0
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
jne 0x18003a6e2
lea r9d, [rax + 2]
lea r8d, [rax + 0x34]
lea rdx, str.C:UsersAdministratorDesktopDevelopementJenkinsWorkspaceworkspaceNetshield3rdGen_WindowsNetshield3rdGen_Prod_Windows_x64_Releasehookmyfunction.cpp
lea rcx, [rsp + 0x30]
call fcn.180076e30
nop
mov rcx, rax
call fcn.18007cf90
mov rcx, rax
lea rdx, str.select___returns_unexpected_value__
call fcn.18002e990
mov rcx, rax
mov edx, ebp
call fcn.1800370e0
mov rcx, rax
lea rdx, [0x1801df840]
call fcn.18002e990
nop
lea rcx, [rsp + 0x30]
call fcn.180077220
jmp 0x18003a748
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r15d, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov r9d, 2
lea r8d, [r9 + 0x38]
lea rdx, str.C:UsersAdministratorDesktopDevelopementJenkinsWorkspaceworkspaceNetshield3rdGen_WindowsNetshield3rdGen_Prod_Windows_x64_Releasehookmyfunction.cpp
lea rcx, [rsp + 0x30]
call fcn.180076e30
nop
mov rcx, rax
call fcn.18007cf90
mov rcx, rax
lea rdx, str.select___error:
call fcn.18002e990
mov rcx, rax
mov edx, edi
call fcn.1800370e0
mov rcx, rax
lea rdx, [0x1801df90c]
call fcn.18002e990
mov rcx, rax
mov edx, ebp
call fcn.1800370e0
mov rcx, rax
lea rdx, [0x1801df840]
call fcn.18002e990
nop
lea rcx, [rsp + 0x30]
call fcn.180077220
jmp 0x18003a748
xor eax, eax
jmp 0x18003a75e
mov r9d, 2
lea r8d, [r9 + 0x3c]
lea rdx, str.C:UsersAdministratorDesktopDevelopementJenkinsWorkspaceworkspaceNetshield3rdGen_WindowsNetshield3rdGen_Prod_Windows_x64_Releasehookmyfunction.cpp
lea rcx, [rsp + 0x30]
call fcn.180076e30
nop
mov rcx, rax
call fcn.18007cf90
mov rcx, rax
lea rdx, str.select___timeout__
call fcn.18002e990
mov rcx, rax
mov edx, ebp
call fcn.1800370e0
mov rcx, rax
lea rdx, [0x1801df840]
call fcn.18002e990
nop
lea rcx, [rsp + 0x30]
call fcn.180077220
mov edi, 0x274c
mov r15d, 0x5b4
mov ecx, edi
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180133630
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180040490
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
mov r8, rcx
je 0x1800404d1
xor eax, eax
movabs r9, 0xf14339ed95ff2fcf
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + r8], dl
inc rax
cmp rax, 0x21
jb 0x1800404b0
mov byte [r8 + 0x21], 0
mov rax, r8
ret

Function at 0x180040930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, rcx
xor ebp, ebp
movabs r14, 0x55d5cd91afbf43e9
cmp byte [rdx + 0x1f], bpl
je 0x180040991
mov r9d, ebp
nop dword [rax]
nop word [rax + rax]
movzx ecx, r9b
and cl, 7
shl cl, 3
mov rax, r14
shr rax, cl
xor byte [r9 + rdx], al
inc r9
cmp r9, 0x1f
jb 0x180040970
mov byte [rdx + 0x1f], bpl
mov qword [rsi], rbp
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], bpl
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], bpl
jne 0x1800409b0
mov rcx, rsi
call fcn.18002c300
nop
cmp byte [rdi + 0x19], 0
je 0x1800409ef
mov rdx, rbp
nop dword [rax + rax]
movzx ecx, dl
and cl, 7
shl cl, 3
mov rax, r14
shr rax, cl
xor byte [rdx + rdi], al
inc rdx
cmp rdx, 0x19
jb 0x1800409d0
mov byte [rdi + 0x19], 0
lea rcx, [rsi + 0x20]
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
inc rbx
cmp byte [rdi + rbx], 0
jne 0x180040a05
mov r8, rbx
mov rdx, rdi
call fcn.18002c300
nop
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180040a30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rdx
mov rsi, rcx
cmp byte [rdx + 0x28], 0
je 0x180040aad
lea r10, [rdx + 1]
mov r8, rdx
not r8
movabs r11, 0x55d5cd91afbf43e9
nop dword [rax]
lea ecx, [r10 + r8]
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r10 - 1], dl
movzx ecx, r10b
sub cl, r9b
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r10], dl
add r10, 2
lea rax, [r8 + r10]
cmp rax, 0x28
jb 0x180040a70
mov byte [r9 + 0x28], 0
xor ebp, ebp
mov qword [rsi], rbp
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], bpl
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r9 + r8], bpl
jne 0x180040ad0
mov rdx, r9
mov rcx, rsi
call fcn.18002c300
nop
cmp byte [rdi + 1], 0
je 0x180040af2
xor byte [rdi], 0xe9
mov byte [rdi + 1], 0
lea rcx, [rsi + 0x20]
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x180040b10
mov r8, rbx
mov rdx, rdi
call fcn.18002c300
nop
mov rax, rsi
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret