joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001000
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x230
xor edi, edi
mov qword [rsp + 0x20], 0x238
call fcn.180037c60
lea ecx, [rdi + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180001054
xor eax, eax
jmp 0x1800010a8
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000109d
nop word [rax + rax]
lea rdx, [0x1800a23b0]
lea rcx, [rsp + 0x4c]
call fcn.180033678
test eax, eax
je 0x180001099
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180001070
jmp 0x18000109d
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800334b0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret

Function at 0x1800010d0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
xor eax, eax
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], ax
call fcn.180037c60
xor edx, edx
mov r8d, 0x206
mov rcx, rbx
call fcn.180037c60
lea rcx, [rsp + 0x30]
mov edx, 0x103
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea r11, str.PublisherPolicy.tms
lea r9, [rsp + 0x30]
lea r8, str._sAppPatch_s
mov edx, 0x102
mov rcx, rbx
mov qword [rsp + 0x20], r11
call fcn.180033700
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x250
pop rbx
ret

Function at 0x1800011f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
xor r9d, r9d
mov r8, rcx
mov rdx, rcx
mov eax, r9d
nop dword [rax]
mov byte [rdx], al
inc eax
inc rdx
cmp eax, 0x100
jl 0x180001200
mov word [rcx + 0x100], r9w
xor r11b, r11b
mov r10, rcx
nop dword [rax]
mov eax, r9d
inc r9d
inc r10
cdq
idiv dword [r8 + 0x144]
movsxd rax, edx
movzx ecx, byte [rax + r8 + 0x102]
add cl, byte [r10 - 1]
add r11b, cl
movzx ecx, byte [r10 - 1]
movzx edx, r11b
movzx eax, byte [rdx + r8]
mov byte [r10 - 1], al
mov byte [rdx + r8], cl
cmp r9d, 0x100
jl 0x180001220
repz ret

Function at 0x180001270
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
movsxd r9, r9d
mov rbx, r8
mov r11, rdx
mov r10, rcx
test r9, r9
jle 0x1800012f6
sub r11, rbx
nop dword [rax]
inc byte [r10 + 0x100]
movzx r8d, byte [r10 + 0x100]
inc rbx
movzx eax, byte [r8 + r10]
add byte [r10 + 0x101], al
movzx edx, byte [r10 + 0x101]
movzx ecx, byte [r8 + r10]
movzx eax, byte [rdx + r10]
mov byte [r8 + r10], al
mov byte [rdx + r10], cl
movzx eax, byte [r10 + 0x101]
movzx ecx, byte [r10 + 0x100]
movzx ecx, byte [rcx + r10]
add cl, byte [rax + r10]
movzx eax, cl
movzx ecx, byte [rax + r10]
xor cl, byte [r11 + rbx - 1]
dec r9
mov byte [rbx - 1], cl
jne 0x180001290
mov rbx, qword [rsp + 8]
ret
Function at 0x180002440
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp byte [0x1800b2180], 0
jne 0x180002498
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x180002491
or eax, 0xffffffff
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x1d8
ret
mov byte [0x1800b2180], 1
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x1d8
ret

Function at 0x1800024c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x390]
sub rsp, 0x490
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rbp + 0x380], rax
xor eax, eax
movzx ebx, dx
mov edi, ecx
mov r12d, 2
lea edx, [rax + 1]
xor r13d, r13d
xor r8d, r8d
mov ecx, r12d
mov qword [rsp + 0x52], rax
mov word [rsp + 0x50], r13w
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
call qword [sym.imp.WS2_32.dll_socket]
lea r9, [rsp + 0x38]
lea r8d, [r13 + 4]
mov edx, 0xffff
mov rcx, rax
mov rsi, rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x30]
lea edx, [r13 + 6]
lea r8d, [r13 + 1]
mov rcx, rsi
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rsi
mov dword [rsp + 0x30], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
movzx ecx, bx
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x60], 1
mov qword [rbp + 0x178], rsi
mov dword [rbp + 0x170], 1
mov word [rsp + 0x50], r12w
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [r13 + 0x10]
lea rdx, [rsp + 0x50]
mov rcx, rsi
mov dword [rsp + 0x54], edi
mov word [rsp + 0x52], ax
call qword [sym.imp.WS2_32.dll_connect]
lea rax, [rsp + 0x48]
lea ecx, [rsi + 1]
lea r9, [rbp + 0x170]
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x180002685
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x180002685
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rsi
mov dword [rsp + 0x30], r13d
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea r9, [rsp + 0x30]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rsi
mov dword [rsp + 0x30], 0x1d4c0
mov dword [rsp + 0x40], 0x1d4c0
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x1005
mov rcx, rsi
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rsi
jmp 0x180002692
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
or rax, 0xffffffffffffffff
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1800334b0
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x490
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800027d0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp + 0x20], r9d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r11d, r9d
mov r14d, r8d
mov r13, rdx
mov r12, rcx
mov r15, rdx
test r8d, r8d
jle 0x18000290d
mov ecx, 0x1000
mov esi, r14d
mov edx, 0x4000
cmp r14d, ecx
mov edi, ebp
cmova esi, ecx
mov rbx, qword [r12]
mov rax, qword [rbx + 0x3c8]
test rax, rax
je 0x18000284d
mov edx, 4
mov rcx, rbx
lea r8d, [rdx - 3]
call rax
mov dword [rbx + 0x3d0], 4
mov edx, 0x4000
test r13, r13
je 0x18000287a
test esi, esi
js 0x18000287a
cmp esi, edx
mov r8d, esi
mov rcx, rbx
cmovg r8d, edx
mov rdx, r13
call fcn.180028940
mov r11d, eax
test eax, eax
mov eax, 0xffffffff
cmovs r11d, eax
jmp 0x180002880
mov r11d, 0xffffff53
mov rax, qword [r12]
test r11d, r11d
jle 0x18000288d
mov eax, ebp
jmp 0x1800028c8
test rax, rax
jne 0x180002899
mov eax, 0xffffff53
jmp 0x1800028c8
mov eax, dword [rax + 0x2a8]
cmp eax, 0xfffffebd
jne 0x1800028ad
mov eax, 2
jmp 0x1800028c8
cmp eax, 0xfffffeb9
jne 0x1800028bb
mov eax, 3
jmp 0x1800028c8
cmp eax, 0xfffffea9
mov ecx, 6
cmove eax, ecx
test r11d, r11d
jg 0x1800028ed
cmp eax, 2
je 0x1800028db
cmp eax, 3
jne 0x180002a2f
inc edi
mov edx, 0x4000
cmp edi, 5
jl 0x180002820
jmp 0x1800028f6
movsxd rax, r11d
sub r14d, r11d
add r13, rax
cmp edi, 5
je 0x180002a2f
test r14d, r14d
jg 0x18000280b
mov r11d, dword [rsp + 0x68]
cmp dword [r12 + 0x164], ebp
je 0x180002a10
mov eax, ebp
lea rcx, [r12 + 0x20]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x100
jl 0x180002922
mov word [r12 + 0x120], bp
xor r10b, r10b
lea r8, [r12 + 0x20]
nop word [rax + rax]
mov eax, ebp
inc ebp
inc r8
cdq
idiv dword [r12 + 0x164]
movsxd rax, edx
movzx ecx, byte [rax + r12 + 0x122]
add cl, byte [r8 - 1]
add r10b, cl
movzx ecx, byte [r8 - 1]
movzx edx, r10b
movzx eax, byte [rdx + r12 + 0x20]
mov byte [r8 - 1], al
mov byte [rdx + r12 + 0x20], cl
cmp ebp, 0x100
jl 0x180002950
movsxd r10, r11d
test r11d, r11d
jle 0x180002a10
nop dword [rax + rax]
inc byte [r12 + 0x120]
movzx r8d, byte [r12 + 0x120]
inc r15
movzx eax, byte [r8 + r12 + 0x20]
add byte [r12 + 0x121], al
movzx edx, byte [r12 + 0x121]
movzx ecx, byte [r8 + r12 + 0x20]
movzx eax, byte [rdx + r12 + 0x20]
mov byte [r8 + r12 + 0x20], al
mov byte [rdx + r12 + 0x20], cl
movzx eax, byte [r12 + 0x121]
movzx ecx, byte [r12 + 0x120]
movzx ecx, byte [rcx + r12 + 0x20]
add cl, byte [rax + r12 + 0x20]
movzx eax, cl
movzx ecx, byte [rax + r12 + 0x20]
xor byte [r15 - 1], cl
dec r10
jne 0x1800029a0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
or eax, 0xffffffff
jmp 0x180002a12
Function at 0x180002bb0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov rbx, rcx
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x29], rax
mov qword [rsp + 0x31], rax
mov qword [rsp + 0x39], rax
mov dword [rsp + 0x41], eax
mov word [rsp + 0x45], ax
mov byte [rsp + 0x47], al
cmp rcx, 0xffffffffffffffff
je 0x180002c42
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
mov dword [rsp + 0x20], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_shutdown]
test eax, eax
js 0x180002c39
nop dword [rax + rax]
xor r9d, r9d
lea rdx, [rsp + 0x28]
mov rcx, rbx
lea r8d, [r9 + 0x20]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x180002c20
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0x50
pop rbx
ret
Function at 0x180003aa0
Capabilities:
Set socket configuration

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rdi, rcx
jne 0x180003aba
or rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x58], rbx
xor ebx, ebx
mov rcx, qword [rdi + 8]
mov edx, reloc.WS2_32.dll_WSAGetLastError
lea r8d, [rdx - 0x6e]
test ebx, ebx
je 0x180003ad8
mov r8d, 0xffffffef
call fcn.1800459a0
mov rcx, qword [rdi + 8]
call fcn.180045d20
test eax, eax
je 0x180003b00
inc ebx
cmp ebx, 2
jl 0x180003ac1
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x50]
mov edx, 0x20001d
mov qword [rsp + 0x50], 0
call fcn.180045d50
mov rbx, qword [rsp + 0x50]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov edx, 0x8004667e
mov dword [rsp + 0x40], 0
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rbx
mov dword [rsp + 0x40], 0x1d4c0
mov dword [rsp + 0x48], 0x1d4c0
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1005
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x180003ba0
Capabilities:
Encode data using xor

Disassembly:
movzx eax, cl
or al, dl
sub rdx, rcx
test al, 7
jne 0x180003bd3
mov r8d, 2
nop word [rax + rax]
mov rax, qword [rdx + rcx]
add rcx, 8
xor qword [rcx - 8], rax
dec r8
jne 0x180003bc0
repz ret
mov r8d, 4
nop dword [rax]
movzx eax, byte [rcx + rdx]
add rcx, 4
xor byte [rcx - 4], al
movzx eax, byte [rdx + rcx - 3]
xor byte [rcx - 3], al
movzx eax, byte [rdx + rcx - 2]
xor byte [rcx - 2], al
movzx eax, byte [rdx + rcx - 1]
xor byte [rcx - 1], al
dec r8
jne 0x180003be0
repz ret
Function at 0x1800051d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
mov ebx, r9d
mov r11, rdx
mov r10, rcx
mov r9, r8
test rcx, rcx
je 0x180005265
test rdx, rdx
je 0x180005265
test r8, r8
je 0x180005265
mov qword [rsp + 0x10], rsi
movzx esi, byte [rcx + 1]
mov qword [rsp + 0x18], rdi
movzx edi, byte [rcx]
test ebx, ebx
je 0x180005250
sub r11, r8
nop dword [rax]
movzx r8d, byte [rdi + r10 + 2]
inc r9
lea eax, [r8 + rsi]
movzx esi, al
lea eax, [rdi + 1]
movzx ecx, byte [rsi + r10 + 2]
mov byte [rdi + r10 + 2], cl
movzx edi, al
mov byte [rsi + r10 + 2], r8b
lea eax, [rcx + r8]
movzx ecx, al
movzx eax, byte [rcx + r10 + 2]
xor al, byte [r9 - 1]
dec ebx
mov byte [r11 + r9 - 1], al
jne 0x180005210
mov byte [r10], dil
mov rdi, qword [rsp + 0x18]
mov byte [r10 + 1], sil
mov rsi, qword [rsp + 0x10]
xor eax, eax
pop rbx
ret
mov eax, 0xffffff53
pop rbx
ret
Function at 0x18000a650
Capabilities:
Encrypt data using rc4 prga
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, r8
mov r10d, edx
mov r11, rcx
test rcx, rcx
je 0x18000a6c4
cmp edx, 1
jb 0x18000a6c4
cmp byte [rcx], 0x30
jne 0x18000a6c4
mov edx, edi
cmp r10d, 2
jb 0x18000a6c4
movzx eax, byte [rcx + 1]
lea r9d, [rdi + 2]
cmp al, 0x80
jb 0x18000a6d4
movzx ecx, al
and ecx, 0x7f
lea eax, [rcx + 2]
cmp eax, r10d
ja 0x18000a6c4
cmp ecx, 4
ja 0x18000a6c4
test ecx, ecx
je 0x18000a6d7
lea r8, [r11 + 2]
lea r9d, [rcx + 2]
nop word [rax + rax]
movzx eax, byte [r8]
shl edx, 8
inc r8
or edx, eax
dec ecx
jne 0x18000a6b0
test edx, edx
jns 0x18000a6d7
mov eax, 0xffffff74
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx edx, al
lea eax, [r9 + rdx]
cmp eax, r10d
ja 0x18000a6c4
mov eax, edi
test edx, edx
cmovg eax, edx
js 0x18000a6c4
test eax, eax
js 0x18000a6c4
lea ecx, [r9 + 1]
cmp ecx, r10d
ja 0x18000a6c4
mov eax, r9d
cmp byte [rax + r11], 0x80
je 0x18000a70d
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea r8d, [rcx + 1]
mov edx, edi
cmp r8d, r10d
ja 0x18000a6c4
movzx ecx, byte [rcx + r11]
cmp cl, 0x80
jb 0x18000a76a
movzx ecx, cl
and ecx, 0x7f
lea eax, [rcx + r8]
cmp eax, r10d
ja 0x18000a6c4
cmp ecx, 4
ja 0x18000a6c4
movsxd rax, r8d
test ecx, ecx
je 0x18000a76d
lea r9, [rax + r11]
add r8d, ecx
nop word [rax + rax]
movzx eax, byte [r9]
shl edx, 8
inc r9
or edx, eax
dec ecx
jne 0x18000a750
test edx, edx
js 0x18000a6c4
jmp 0x18000a76d
movzx edx, cl
lea eax, [r8 + rdx]
cmp eax, r10d
ja 0x18000a6c4
test edx, edx
jle 0x18000a6c4
mov ecx, r8d
mov dword [rbx + 0x3a0], edx
add rcx, r11
mov qword [rbx + 0x398], rcx
cmp edx, 0x14
jne 0x18000a7c5
mov rax, qword [rcx]
mov qword [rbx + 0x368], rax
mov rax, qword [rcx + 8]
mov qword [rbx + 0x370], rax
mov eax, dword [rcx + 0x10]
mov dword [rbx + 0x378], eax
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea r8, [rbx + 0x368]
mov rbx, qword [rsp + 0x30]
mov edi, eax
add rsp, 0x20
pop rdi
jmp fcn.18000dbb0
Function at 0x18000c050
Capabilities:
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x90
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r11d, r11d
mov rbx, r8
mov esi, edx
mov r9, rcx
lea rbp, [0x180000000]
mov r8d, r11d
movzx eax, byte [r8 + rbp + 0x9a458]
dec eax
movsxd rdx, eax
mov rax, rdx
and edx, 7
sar rax, 3
movzx ecx, byte [rax + r9]
test byte [rbp + rdx*4 + 0x9b010], cl
setne al
mov byte [rsp + r8], al
movzx eax, byte [r8 + rbp + 0x9a459]
dec eax
movsxd rdx, eax
mov rax, rdx
and edx, 7
sar rax, 3
movzx ecx, byte [rax + r9]
test byte [rbp + rdx*4 + 0x9b010], cl
setne al
mov byte [rsp + r8 + 1], al
movzx eax, byte [r8 + rbp + 0x9a45a]
dec eax
movsxd rdx, eax
mov rax, rdx
and edx, 7
sar rax, 3
movzx ecx, byte [rax + r9]
test byte [rbp + rdx*4 + 0x9b010], cl
setne al
mov byte [rsp + r8 + 2], al
movzx eax, byte [r8 + rbp + 0x9a45b]
dec eax
movsxd rdx, eax
mov rax, rdx
and edx, 7
sar rax, 3
movzx ecx, byte [rax + r9]
test byte [rbp + rdx*4 + 0x9b010], cl
setne al
add r8, 4
mov byte [rsp + r8 - 1], al
cmp r8, 0x38
jl 0x18000c092
mov rdi, r11
mov r12d, 0x1c
lea r13, [0x18009afe0]
nop
movzx edx, byte [rdi + rbp + 0x9ab88]
xor eax, eax
mov r9d, r11d
mov qword [rsp + 0x70], rax
mov r8, r11
nop word [rax + rax]
cmp r9d, r12d
mov eax, gethostname
cmovl eax, r12d
cmp edx, eax
mov eax, edx
jl 0x18000c195
lea eax, [rdx - 0x1c]
cdqe
inc r8
inc r9d
movzx ecx, byte [rsp + rax]
inc edx
mov byte [rsp + r8 + 0x37], cl
cmp r8, 0x38
jl 0x18000c180
mov r9d, r11d
mov r10, r13
movzx eax, byte [r10]
cmp byte [rsp + rax + 0x37], r11b
je 0x18000c1e5
mov eax, 0xaaaaaaab
mul r9d
mov eax, r9d
shr edx, 2
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub eax, ecx
movsxd rcx, eax
mov eax, dword [rbp + rcx*4 + 0x9b010]
sar eax, 2
or byte [rsp + rdx + 0x70], al
inc r9d
inc r10
cmp r9d, 0x30
jl 0x18000c1b4
movzx eax, byte [rsp + 0x72]
movzx ecx, byte [rsp + 0x70]
inc rdi
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x74]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x76]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x73]
mov dword [rbx + rdi*8 - 8], ecx
movzx ecx, byte [rsp + 0x71]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x75]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x77]
shl ecx, 8
or ecx, eax
mov dword [rbx + rdi*8 - 4], ecx
cmp rdi, 0x10
jl 0x18000c160
cmp esi, 1
jne 0x18000c28c
lea rdx, [rbx + 0x7c]
nop word [rax + rax]
mov eax, dword [rdx - 4]
mov ecx, dword [rbx + r11*4]
add r11, 2
mov dword [rbx + r11*4 - 8], eax
mov dword [rdx - 4], ecx
mov eax, dword [rdx]
mov ecx, dword [rbx + r11*4 - 4]
mov dword [rbx + r11*4 - 4], eax
sub rdx, 8
mov dword [rdx + 8], ecx
cmp r11, 0x10
jl 0x18000c260
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1800334b0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000c2c0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r11d, dword [rcx]
mov ebx, dword [rdx]
mov r9, rdx
mov r10, rcx
lea rdi, [r8 + 8]
mov esi, 8
lea rbp, [0x18009b030]
nop
mov eax, ebx
add rdi, 0x10
ror eax, 4
xor eax, dword [rdi - 0x18]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4]
xor edx, dword [rbp + rax*4 + 0x200]
mov eax, r8d
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x400]
mov eax, dword [rdi - 0x14]
xor edx, dword [rbp + r8*4 + 0x600]
xor eax, ebx
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
xor r11d, edx
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x100]
xor edx, dword [rbp + rax*4 + 0x300]
mov eax, r8d
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x500]
xor edx, dword [rbp + r8*4 + 0x700]
xor r11d, edx
mov eax, r11d
ror eax, 4
xor eax, dword [rdi - 0x10]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4]
xor edx, dword [rbp + rax*4 + 0x200]
mov eax, r8d
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x400]
mov eax, dword [rdi - 0xc]
xor edx, dword [rbp + r8*4 + 0x600]
xor eax, r11d
mov r8d, eax
mov ecx, eax
xor ebx, edx
shr rax, 0x10
shr rcx, 0x18
and eax, 0x3f
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x100]
xor edx, dword [rbp + rax*4 + 0x300]
mov eax, r8d
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x500]
xor edx, dword [rbp + r8*4 + 0x700]
xor ebx, edx
dec rsi
jne 0x18000c2f0
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r9], ebx
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret

Function at 0x18000db20
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov rbx, r8
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x6c], 0x67452301
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x70], 0xefcdab89
mov dword [rsp + 0x74], 0x98badcfe
mov dword [rsp + 0x78], 0x10325476
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.1800182d0
test eax, eax
jne 0x18000db92
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.180018470
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0xa0
pop rbx
ret
Function at 0x18000dbb0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov rbx, r8
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x6c], 0x67452301
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x70], 0xefcdab89
mov dword [rsp + 0x74], 0x98badcfe
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.18001da30
test eax, eax
jne 0x18000dc2a
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.18001dd00
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0xa0
pop rbx
ret

Function at 0x18000dc50
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xb0
mov rax, qword [0x1800ac030]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov rbx, r8
xor r8d, r8d
mov qword [r11 - 0x28], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [r11 - 0x80], rax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x38], r8
mov dword [r11 - 0x30], r8d
test rcx, rcx
jne 0x18000dce4
test edx, edx
je 0x18000dcf8
mov eax, 0xffffff53
jmp 0x18000dd05
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.18001e640
test eax, eax
jne 0x18000dd05
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.18001eac0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800334b0
add rsp, 0xb0
pop rbx
ret