joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c73f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov r14, rcx
nop word [rax + rax]
mov r9d, edi
mov r8d, esi
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x1800c3043
call fcn.1801d5f34
cmp dword [rax], 4
je 0x1800c3020
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
push rbx
push rsi
push rdi
push r14
sub rsp, 0x28
mov rdi, qword [rcx + 0x50]
mov eax, 0x7fffffff
cmp r8, rax
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmova rsi, rax
mov rax, qword [rcx + 0x48]
cmp rax, rdi
jae 0x1800c7461
mov rcx, qword [rcx + 0x30]
sub rdi, rax
lea rdx, [rax + rcx]
mov rcx, r14
cmp rsi, rdi
ja 0x1800c7448
mov r8, rsi
call fcn.1802059b0
add qword [rbx + 0x48], rsi
mov rax, rsi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rdi
call fcn.1802059b0
add qword [rbx + 0x48], rdi
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
jne 0x1800c747c
mov rax, 0xffffffffffffffff
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor eax, eax
mov qword [rsp + 0x68], rbp
mov rbp, qword [rbx + 8]
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
cmp rsi, 0x1000
jae 0x1800c7528
mov qword [rsp + 0x20], r15
mov r15, qword [rbx + 0x30]
nop word [rax + rax]
xor r9d, r9d
mov r8d, 0x1000
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdi, eax
test eax, eax
jns 0x1800c74d6
call fcn.1801d5f34
cmp dword [rax], 4
je 0x1800c74b0
mov r15, qword [rsp + 0x20]
test rdi, rdi
jle 0x1800c74f4
mov rdx, qword [rbx + 0x30]
mov rcx, r14
cmp rdi, rsi
jg 0x1800c7506
mov r8, rdi
call fcn.1802059b0
mov rbp, qword [rsp + 0x68]
mov rax, rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
mov r8, rsi
call fcn.1802059b0
mov rbp, qword [rsp + 0x68]
mov rax, rsi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x50], rdi
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
ret
xor r9d, r9d
mov r8, rsi
mov rdx, r14
mov rcx, rbp
mov rbp, qword [rsp + 0x68]
add rsp, 0x28
pop r14
pop rdi
pop rsi
pop rbx
jmp 0x1800c2ff0

Function at 0x1800c7550
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
jne 0x1800c7589
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rdi, qword [rdi + 8]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
test eax, eax
jns 0x1800c75b5
call fcn.1801d5f34
cmp dword [rax], 4
je 0x1800c7592
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800c7650
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x18028ab00]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rcx, qword [rcx + 8]
mov rdi, r8
mov rbx, rdx
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1800c76a9
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.1800c3110
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1801cb9c0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x1800dab60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, eax
and r10d, 7
je 0x1800dab91
cmp eax, r10d
jge 0x1800dab7f
call fcn.1800da2d0
mov eax, dword [rbx + 0x18]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov dword [rbx + 0x18], eax
mov eax, dword [rbx + 0x10]
xor r8d, r8d
mov r9d, eax
test eax, eax
jle 0x1800dabd2
mov ecx, dword [rbx + 0x18]
lea rdx, [rsp + 0x30]
movzx r10d, cl
nop word [rax + rax]
shr ecx, 8
lea eax, [r9 - 8]
mov byte [rdx], r10b
lea rdx, [rdx + 1]
inc r8d
mov dword [rbx + 0x18], ecx
mov r9d, eax
movzx r10d, cl
test eax, eax
jg 0x1800dabb0
mov dword [rbx + 0x10], eax
jns 0x1800dabff
mov rdx, qword gs:[0x58]
mov eax, dword [0x1803907bc]
mov ecx, 0x28
mov rax, qword [rdx + rax*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1800dac32
mov r8, qword [rbx + 8]
nop dword [rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1800dac1c
xor dl, dl
jmp 0x1800dac25
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1800dac10
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1800dabd4
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1800daca7
mov rdx, qword gs:[0x58]
mov eax, dword [0x1803907bc]
mov ecx, 0x28
mov rax, qword [rdx + rax*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x20]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x30]
jbe 0x1800dacc1
mov rcx, rbx
call fcn.1800da410
test eax, eax
je 0x1800dac9a
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x20]
call fcn.1802059b0
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x20], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1800f13f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800f1424
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800f1410
ret
Function at 0x1800fdfb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
sar rdi, 2
test rdi, rdi
je 0x1800fe193
mov qword [rsp + 0x40], rbx
mov rbx, qword [0x1803923e0]
sub rbx, qword [0x1803923d8]
mov qword [rsp + 0x50], r13
sar rbx, 2
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x1800fe003
mov eax, ntohs
jmp 0x1800fe031
cmp rdi, 0x44
jb 0x1800fe010
mov eax, 7
jmp 0x1800fe031
cmp rdi, 0x27
jb 0x1800fe01d
mov eax, 5
jmp 0x1800fe031
cmp rdi, 7
jb 0x1800fe02a
mov eax, 3
jmp 0x1800fe031
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x1800fe04a
mov r15, rdi
mov r8, rdi
mov qword [rsp + 0x48], rbp
shl r8, 2
mov edx, 0x8b8b8b8b
mov rcx, rsi
call fcn.1802061d0
xor ecx, ecx
test r15, r15
je 0x1800fe0fd
nop
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea rbp, [rsi + rdx*4]
mov r8d, r11d
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
xor r8d, dword [rsi + rdx*4]
xor r8d, dword [rbp]
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x1800fe0bd
mov rax, rbx
jmp 0x1800fe0d5
cmp rcx, rbx
ja 0x1800fe0d2
mov rax, qword [0x1803923d8]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x1800fe0d5
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [rbp], r8d
cmp rcx, r15
jb 0x1800fe070
add r15, rdi
cmp rcx, r15
jae 0x1800fe17a
inc r14
lea rbp, [rcx - 1]
inc r13
nop
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, dword [rsi + r9*4]
add ecx, r10d
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x1800fe110
mov rbp, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x180106d80
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x180106e45
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x180106e45
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x180106e5e
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x180106e35
cmp byte [rcx], 0x5c
jne 0x180106e2e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x180106e2e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x180106e1c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x180106e2b
test r8b, 0x10
jne 0x180106e2e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x180106e2e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.1800fd680
test edi, edi
jne 0x180106da0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1800fd670
int3
Function at 0x180109400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r13
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x18028ab00]
xor rax, rsp
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor ebx, ebx
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], bl
jne 0x180109444
mov rdx, rcx
lea rcx, [rbp - 0x30]
call fcn.180009080
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
movabs rdi, 0xcbf29ce484222325
mov r9, rdi
mov rcx, rbx
movabs r13, 0x100000001b3
mov rsi, qword [rbp - 0x20]
test rsi, rsi
je 0x1801094a3
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, rsi
jb 0x180109490
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
lea rcx, [0x1803919f0]
call fcn.1800f54b0
mov rcx, qword [rax + 8]
mov r14, qword [0x1803919f8]
test rcx, rcx
cmovne r14, rcx
cmp r14, qword [0x1803919f8]
jne 0x1801095b8
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rdx, qword [rbp - 0x30]
mov r9, rdi
mov rcx, rbx
test rsi, rsi
je 0x180109503
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r13
inc rcx
cmp rcx, rsi
jb 0x1801094f0
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x40]
lea rcx, [0x180391a30]
call fcn.1800f54b0
mov rcx, qword [rax + 8]
mov r14, qword [0x180391a38]
test rcx, rcx
cmovne r14, rcx
cmp r14, qword [0x180391a38]
jne 0x1801095b8
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
mov r8d, 7
lea rdx, str.Example
lea rcx, [rbp - 0x60]
call fcn.180009080
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
test r8, r8
je 0x180109585
movzx eax, byte [rdx + rbx]
xor rdi, rax
imul rdi, r13
inc rbx
cmp rbx, r8
jb 0x180109572
mov r9, rdi
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x40]
lea rcx, [0x180391a30]
call fcn.1800f54b0
mov rcx, qword [rax + 8]
mov r14, qword [0x180391a38]
test rcx, rcx
cmovne r14, rcx
lea rcx, [rbp - 0x60]
call fcn.180008100
nop
lea rcx, [rbp - 0x30]
call fcn.180008100
lea rax, [r14 + 0x30]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1801cb9c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
Function at 0x180118cd0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
lea rcx, [0x180387190]
call fcn.1801ca284
test eax, eax
jne 0x180118ea0
cmp dword [0x1803871dc], 0x7fffffff
je 0x180118e8b
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x20], rdi
call sub.KERNEL32.dll_GetCurrentThreadId
mov r8, qword [0x180387180]
movabs rdx, 0x100000001b3
mov r9, qword [0x180387168]
xor ebx, ebx
movzx esi, al
mov edi, eax
movabs rax, 0xcbf29ce484222325
xor rsi, rax
mov eax, edi
imul rsi, rdx
shr eax, 8
movzx ecx, al
mov eax, edi
xor rsi, rcx
shr eax, 0x10
imul rsi, rdx
movzx ecx, al
mov eax, edi
xor rsi, rcx
shr rax, 0x18
mov rcx, qword [0x180387158]
imul rsi, rdx
xor rsi, rax
imul rsi, rdx
mov rdx, r8
and rdx, rsi
add rdx, rdx
mov rax, qword [r9 + rdx*8 + 8]
cmp rax, rcx
je 0x180118da0
mov rdx, qword [r9 + rdx*8]
cmp edi, dword [rax + 0x10]
je 0x180118da3
nop word [rax + rax]
cmp rax, rdx
je 0x180118da0
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180118d90
jmp 0x180118da3
mov rax, rbx
test rax, rax
mov rdx, rcx
cmovne rdx, rax
cmp rdx, rcx
je 0x180118e6c
mov rax, qword [rdx + 0x18]
test rax, rax
je 0x180118ddc
mov rcx, rax
call fcn.180118eb0
mov r8, qword [0x180387180]
mov r9, qword [0x180387168]
mov rcx, qword [0x180387158]
and rsi, r8
add rsi, rsi
mov r8, qword [r9 + rsi*8 + 8]
mov rax, r8
cmp r8, rcx
je 0x180118e11
mov rdx, qword [r9 + rsi*8]
cmp edi, dword [r8 + 0x10]
je 0x180118e0e
nop dword [rax]
cmp rax, rdx
je 0x180118e11
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180118e00
mov rbx, rax
test rbx, rbx
je 0x180118e6c
mov rax, qword [r9 + rsi*8]
cmp r8, rbx
jne 0x180118e3a
cmp rax, rbx
jne 0x180118e2f
mov qword [r9 + rsi*8], rcx
mov qword [r9 + rsi*8 + 8], rcx
jmp 0x180118e46
mov rcx, qword [rbx + 8]
mov qword [r9 + rsi*8 + 8], rcx
jmp 0x180118e46
cmp rax, rbx
jne 0x180118e46
mov rax, qword [rbx]
mov qword [r9 + rsi*8], rax
mov rdx, qword [rbx]
mov rcx, rbx
dec qword [0x180387160]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1801cb9e0
lea rcx, [0x180387190]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
jmp fcn.1801ca28c
mov ecx, 6
mov dword [0x1803871dc], 0x7ffffffe
call fcn.1801ca23c
int3
mov ecx, 5
call fcn.1801ca23c
int3
Function at 0x18011adc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18011ade5
cvtsi2ss xmm0, rdx
jmp 0x18011adfa
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1801e2b24
movss xmm1, dword [0x180259764]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18011ae28
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18011ae28
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18011ae5a
cmp rbx, 0x200
jae 0x18011ae57
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18011ae5a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800eb4a0
Function at 0x18011b850
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18011b891
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x18011b800]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18011b891
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x18011b910
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov esi, edx
mov rcx, qword gs:[0x58]
mov eax, dword [0x1803907bc]
mov edx, 8
mov rax, qword [rcx + rax*8]
lea rbp, [0x180396020]
mov eax, dword [rdx + rax]
cmp dword [0x180396014], eax
jle 0x18011b9c7
lea rcx, [0x180396014]
call fcn.1801cba90
cmp dword [0x180396014], 0xffffffff
jne 0x18011b9c7
call fcn.1801caffc
mov dword [0x1803973a4], 0xffffffff
mov dword [0x180396024], eax
mov r8d, 1
nop dword [rax]
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rbp + r8*4 + 4], eax
inc r8
cmp r8, 0x270
jb 0x18011b990
mov dword [0x180396020], 0x270
lea rcx, [0x180396014]
call fcn.1801cba24
btc esi, 0x1f
btc ebx, 0x1f
sub ebx, esi
mov rcx, rbp
cmp ebx, 0xffffffff
jne 0x18011b9e2
call fcn.1800c0d00
mov ecx, eax
jmp 0x18011ba19
inc ebx
call fcn.1800c0d00
mov edi, ebx
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jae 0x18011ba15
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x18011ba15
mov rcx, rbp
call fcn.1800c0d00
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x18011ba03
shr rcx, 0x20
lea eax, [rcx + rsi]
xor eax, 0x80000000
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18011ba40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movaps xmmword [rsp + 0x50], xmm8
mov rax, qword [0x18028ab00]
xor rax, rsp
mov qword [rsp + 0x40], rax
movaps xmm7, xmm2
movaps xmm6, xmm1
xor edx, edx
mov r8d, 0x64
call fcn.18011b910
cmp eax, 0x64
jle 0x18011ba9c
addss xmm6, xmm7
xorps xmm0, xmm0
cvtss2sd xmm0, xmm6
mulsd xmm0, qword [0x180259450]
cvtpd2ps xmm0, xmm0
jmp 0x18011bbd1
mov rcx, qword gs:[0x58]
mov eax, dword [0x1803907bc]
mov edx, 8
mov rax, qword [rcx + rax*8]
lea rbx, [0x1803938f0]
mov eax, dword [rdx + rax]
cmp dword [0x180396018], eax
jle 0x18011bb37
lea rcx, [0x180396018]
call fcn.1801cba90
cmp dword [0x180396018], 0xffffffff
jne 0x18011bb37
call fcn.1801caffc
mov dword [0x180394c74], 0xffffffff
mov dword [0x1803938f4], eax
mov r8d, 1
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rbx + r8*4 + 4], eax
inc r8
cmp r8, 0x270
jb 0x18011bb00
mov dword [0x1803938f0], 0x270
lea rcx, [0x180396018]
call fcn.1801cba24
movdqa xmm0, xmmword [0x18025a210]
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x30], 0
xorps xmm8, xmm8
movsd qword [rsp + 0x38], xmm8
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18011bd30
movaps xmm1, xmm0
movsd xmm2, qword [0x180259498]
minsd xmm1, xmm2
movsd xmm3, qword [0x1802597c8]
comisd xmm1, xmm3
jbe 0x18011bb84
minsd xmm2, xmm0
jmp 0x18011bb87
movaps xmm2, xmm3
subsd xmm2, xmm3
divsd xmm2, qword [0x1802594b8]
xorps xmm0, xmm0
maxsd xmm0, xmm2
movsd xmm3, qword [0x180259468]
comisd xmm0, xmm3
jb 0x18011bbb3
xorps xmm1, xmm1
movaps xmm0, xmm3
call fcn.1801e2a2c
subss xmm7, xmm6
xorps xmm1, xmm1
cvtss2sd xmm1, xmm7
mulsd xmm1, xmm0
xorps xmm0, xmm0
cvtss2sd xmm0, xmm6
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801cb9c0
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x50]
add rsp, 0x80
pop rbx
ret
Function at 0x18011bc00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmm7, xmm2
movaps xmm6, xmm1
xor edx, edx
mov r8d, 0x64
call fcn.18011b910
cmp eax, 0x64
jle 0x18011bc4f
addss xmm6, xmm7
xorps xmm0, xmm0
cvtss2sd xmm0, xmm6
mulsd xmm0, qword [0x180259450]
cvtpd2ps xmm0, xmm0
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret
mov rcx, qword gs:[0x58]
mov eax, dword [0x1803907bc]
mov edx, 8
mov rax, qword [rcx + rax*8]
lea rbx, [0x180394c80]
mov eax, dword [rdx + rax]
cmp dword [0x180396010], eax
jle 0x18011bce7
lea rcx, [0x180396010]
call fcn.1801cba90
cmp dword [0x180396010], 0xffffffff
jne 0x18011bce7
call fcn.1801caffc
mov dword [0x180396004], 0xffffffff
mov dword [0x180394c84], eax
mov r8d, 1
nop dword [rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rbx + r8*4 + 4], eax
inc r8
cmp r8, 0x270
jb 0x18011bcb0
mov dword [0x180394c80], 0x270
lea rcx, [0x180396010]
call fcn.1801cba24
mov rcx, rbx
call fcn.1800c0d00
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
xorps xmm1, xmm1
subss xmm0, xmm1
addss xmm0, xmm1
mulss xmm0, dword [0x180259290]
subss xmm7, xmm6
mulss xmm0, xmm7
addss xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret
Function at 0x18013faf0
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 8], ecx
push rbx
sub rsp, 0x20
mov ebx, ecx
lea rcx, str.Friends
call fcn.180109400
mov rdx, qword [rax]
cmp byte [rdx + 0xc], 0
jne 0x18013fb18
xor al, al
add rsp, 0x20
pop rbx
ret
lea rcx, reloc.WS2_32.dll_bind
call fcn.1801ca284
test eax, eax
jne 0x18013fbea
cmp dword [0x180386c0c], 0x7fffffff
je 0x18013fbd5
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rsp + 0x31]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x32]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x33]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x180391af0]
and rcx, rdx
shl rcx, 4
add rcx, qword [0x180391ad8]
mov rax, qword [rcx + 8]
cmp rax, qword [0x180391ac8]
je 0x18013fbb8
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x18013fbba
cmp rax, rcx
je 0x18013fbb8
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x18013fba8
jmp 0x18013fbba
xor eax, eax
test rax, rax
lea rcx, reloc.WS2_32.dll_bind
setne bl
call fcn.1801ca28c
movzx eax, bl
add rsp, 0x20
pop rbx
ret
mov ecx, 6
mov dword [0x180386c0c], 0x7ffffffe
call fcn.1801ca23c
int3
mov ecx, 5
call fcn.1801ca23c
int3
Function at 0x18013ff90
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18014013e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180391ac8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180391ad8]
lea rdx, [rdi + rdi]
call fcn.1800eb310
mov rax, qword [0x180391ac8]
lea r9, [rdi - 1]
mov qword [0x180391af0], r9
mov qword [0x180391af8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180140133
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180391ad8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18014007f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1801400f4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1801400bc
mov r10, qword [rdx]
cmp r10, rax
je 0x1801400b6
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1801400f4
cmp r9, rdx
je 0x1801400d0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180140108
cmp r9, rdx
jne 0x1801400c1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18014012e
mov r9, qword [0x180391af0]
jmp 0x180140030
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1801400f4
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1801c859c
int3