joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bbd80
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x1800bbdc0
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x180265730]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x1800bbdfe
cmp rsi, r14
jb 0x1800bbdf6
cmp rsi, r15
jae 0x1800bbdf6
cmp qword [rsi + 8], 0
jne 0x1800bbfc7
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800bbde1
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1800bbe92
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800bbe89
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800bbe89
cmp dword [rsp + 0x70], 0x10000
je 0x1800bbf0b
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x1800bbe89
sub rbx, rbp
cmp rbx, r14
jae 0x1800bbe50
test rsi, rsi
jne 0x1800bbf70
cmp rdi, r15
ja 0x1800bbfaf
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800bbfaf
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800bbfaf
cmp dword [rsp + 0x70], 0x10000
je 0x1800bbf41
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800bbec2
jmp 0x1800bbfaf
test rbx, rbx
je 0x1800bbe89
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800bbf70
cmp rbx, r14
jae 0x1800bbe30
jmp 0x1800bbe92
test rdi, rdi
je 0x1800bbfaf
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x1800bbf70
cmp rdi, r15
jbe 0x1800bbea0
jmp 0x1800bbfaf
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x1800bbf80
mov rax, qword [0x180265730]
mov qword [rsi], rax
mov qword [0x180265730], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x1800bfb90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800bfbb8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800bfbb8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1800c382c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x180253040]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x18017d870]
mov rbp, rcx
call fcn.180058050
xor edi, edi
test rax, rax
je 0x1800c3912
mov ebx, edi
call fcn.1800408fc
mov r14d, dword [rax]
call fcn.1800408fc
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.1800c4410
mov rsi, rax
test rax, rax
je 0x1800c38a3
call fcn.1800408fc
mov dword [rax], r14d
jmp 0x1800c38cd
call fcn.1800408fc
cmp dword [rax], 0x22
jne 0x1800c390a
call fcn.1800408fc
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.1800c4410
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1800c390a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1800c38d1
cmp rax, 3
je 0x1800c38ec
mov rcx, rsi
call fcn.1800c3788
test al, al
je 0x1800c38fd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1800c38fd
mov dil, 1
mov rcx, rbx
call fcn.18003db40
mov al, dil
jmp 0x1800c3914
mov rcx, rbx
call fcn.18003db40
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.180030780
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x1800c4700
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800c4720
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180040870
or eax, 0xffffffff
jmp 0x1800c4722
xor eax, eax
add rsp, 0x28
ret

Function at 0x1800c4894
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180253040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1800c48de
call fcn.1800408dc
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.1800408fc
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.180037dd8
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180030780
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1800c48e9
lea eax, [rbx + 1]
jmp 0x1800c48cb
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1800c48c9
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1800c48cb
Function at 0x1800dda20
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov rsi, rdx
test r8, r8
je 0x1800ddb9e
lea r14, [0x1801848e0]
cmp rdx, 2
jbe 0x1800ddae9
lea r10d, [rbx + 4]
nop dword [rax + rax]
movzx edx, byte [rcx + 1]
sub rsi, 3
movzx r11d, byte [rcx]
movzx eax, dl
movzx r9d, byte [rcx + 2]
and dl, 0xf
shr al, 4
movzx r8d, r11b
and r8b, 3
shl dl, 2
shl r8b, 4
add rcx, 3
add r8b, al
movzx eax, r9b
shr al, 6
add dl, al
cmp r10, rbp
ja 0x1800ddb9e
and r9d, 0x3f
mov eax, r11d
shr rax, 2
add r10, 4
movzx eax, byte [rax + r14]
mov byte [rbx + rdi], al
movzx eax, r8b
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 1], al
movzx eax, dl
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 2], al
movzx eax, byte [r9 + r14]
mov byte [rbx + rdi + 3], al
add rbx, 4
cmp rsi, 2
ja 0x1800dda60
test rsi, rsi
je 0x1800ddb91
xor r8b, r8b
mov word [rsp + 0x51], 0
xor r9b, r9b
mov byte [rsp + 0x50], r8b
xor dl, dl
test rsi, rsi
je 0x1800ddb2c
mov rdx, rcx
mov r8, rsi
lea rcx, [rsp + 0x50]
call fcn.180159c90
movzx r9d, byte [rsp + 0x52]
movzx edx, byte [rsp + 0x51]
movzx r8d, byte [rsp + 0x50]
movzx eax, dl
shr r9b, 6
movzx ecx, r8b
shr al, 4
and r8b, 3
shr cl, 2
and dl, 0xf
shl r8b, 4
shl dl, 2
add r8b, al
lea rax, [rbx + 4]
add dl, r9b
cmp rax, rbp
ja 0x1800ddb9e
movzx eax, cl
movzx eax, byte [rax + r14]
mov byte [rbx + rdi], al
movzx eax, r8b
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 1], al
cmp rsi, 1
jne 0x1800ddb7c
mov al, 0x3d
jmp 0x1800ddb84
movzx eax, dl
movzx eax, byte [rax + r14]
mov byte [rbx + rdi + 2], al
mov byte [rbx + rdi + 3], 0x3d
add rbx, 4
cmp rbx, rbp
jae 0x1800ddb9e
mov byte [rbx + rdi], 0
mov eax, ebx
jmp 0x1800ddba3
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1800de030
Capabilities:
Get hostname

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x180253040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rcx
mov qword [rsp + 0x190], rsi
movzx esi, dl
lea rcx, [rsp + 0x40]
xorps xmm0, xmm0
xor edx, edx
mov r8d, 0x118
movups xmmword [rsp + 0x20], xmm0
call fcn.18015a330
lea rcx, [rsp + 0x40]
call fcn.1800df9d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
mov edx, 0x100
mov ecx, eax
shr rcx, 0x10
xor rcx, rax
movzx eax, cx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rax
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x1800de109
call fcn.1800408fc
cmp dword [rax], 0x26
jne 0x1800de0d5
mov ecx, 2
call fcn.1800375c0
mov rcx, rax
lea rdx, str.hostname_exceeds__d_characters__truncating.
mov r8d, 0x100
call fcn.1800d2980
jmp 0x1800de109
mov qword [rsp + 0x188], rbx
call fcn.1800408fc
mov ecx, 2
mov rbx, rax
call fcn.1800375c0
mov r8d, dword [rbx]
lea rdx, str.unable_to_get_hostname:__d
mov rcx, rax
call fcn.1800d2980
mov rbx, qword [rsp + 0x188]
mov byte [rsp + 0x14f], 0
mov eax, 1
lock xadd qword [0x180256570], rax
movaps xmm0, xmmword [rsp + 0x40]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x150], rax
lea r8, [rsp + 0x30]
movq rax, xmm0
lea rcx, [rsp + 0x40]
not rax
mov edx, 0x118
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x38], rax
call fcn.1800de2d0
mov eax, dword [rsp + 0x20]
test sil, sil
mov rsi, qword [rsp + 0x190]
mov dword [rdi + 0x10], eax
movzx eax, byte [rsp + 0x24]
mov byte [rdi + 0x14], al
je 0x1800de18d
mov rax, qword [rsp + 0x28]
mov ecx, eax
and ecx, 0xff0ffff0
and rax, 0xffffffffff0ffff0
mov dword [rdi + 4], ecx
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x18], rax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180030780
add rsp, 0x170
pop rdi
ret
Function at 0x1800de2d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r12
sub rsp, 0x40
mov r10, qword [r8 + 8]
xor eax, eax
mov r11, qword [r8]
mov rbx, rcx
mov qword [rsp + 0x30], rax
mov r8, r11
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov qword [rsp + 0x68], r14
mov rax, rdx
mov r14, rcx
mov qword [rsp + 0x70], r15
and eax, 7
shl rdi, 0x38
sub r14, rax
movabs rcx, 0x7465646279746573
mov rax, r10
mov r15d, edx
xor rax, rcx
add r14, rdx
movabs rcx, 0x6c7967656e657261
and r15d, 7
xor r8, rcx
mov r12, r9
movabs rcx, 0x736f6d6570736575
mov ebp, 2
xor r11, rcx
movabs rcx, 0x646f72616e646f83
xor r10, rcx
cmp rbx, r14
je 0x1800de3d7
mov qword [rsp + 0x60], rsi
nop word [rax + rax]
mov rsi, qword [rbx]
mov r9, rbp
xor rax, rsi
nop dword [rax]
add r8, rax
add r11, r10
ror r10, 0x33
xor r10, r11
ror rax, 0x30
xor rax, r8
ror r11, 0x20
add r8, r10
add r11, rax
mov rdx, r8
ror r10, 0x2f
mov rcx, r8
shr rdx, 0x20
xor r10, r8
ror rax, 0x2b
shl rcx, 0x20
mov r8, rdx
or r8, rcx
xor rax, r11
sub r9, 1
jne 0x1800de380
xor r11, rsi
add rbx, 8
cmp rbx, r14
jne case.default.0x1800de3f6
mov rsi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
lea r9, [0x180000000]
movsxd rcx, r15d
mov r15, qword [rsp + 0x70]
mov edx, dword [r9 + rcx*4 + 0xde5b0]
add rdx, r9
jmp rdx
movzx ecx, byte [rbx + 6]
shl rcx, 0x30
or rdi, rcx
movzx ecx, byte [rbx + 5]
shl rcx, 0x28
or rdi, rcx
movzx ecx, byte [rbx + 4]
shl rcx, 0x20
or rdi, rcx
movzx ecx, byte [rbx + 3]
shl rcx, 0x18
or rdi, rcx
movzx ecx, byte [rbx + 2]
shl rcx, 0x10
or rdi, rcx
movzx ecx, byte [rbx + 1]
shl rcx, 8
or rdi, rcx
movzx ecx, byte [rbx]
or rdi, rcx
xor rax, rdi
add r8, rax
add r11, r10
ror r10, 0x33
xor r10, r11
ror rax, 0x30
xor rax, r8
ror r11, 0x20
add r8, r10
add r11, rax
mov rdx, r8
ror r10, 0x2f
mov rcx, r8
shr rdx, 0x20
xor r10, r8
ror rax, 0x2b
shl rcx, 0x20
mov r8, rdx
or r8, rcx
xor rax, r11
sub rbp, 1
jne 0x1800de443
xor r11, rdi
mov r9d, 4
xor r8, 0xee
mov ebx, r9d
nop dword [rax]
add r8, rax
add r11, r10
ror r10, 0x33
xor r10, r11
ror rax, 0x30
xor rax, r8
ror r11, 0x20
add r8, r10
add r11, rax
mov rdx, r8
ror r10, 0x2f
mov rcx, r8
shr rdx, 0x20
xor r10, r8
ror rax, 0x2b
shl rcx, 0x20
mov r8, rdx
or r8, rcx
xor rax, r11
sub rbx, 1
jne 0x1800de4a0
mov rcx, rax
xor rcx, r8
xor rcx, r10
xor rcx, r11
mov qword [rsp + 0x30], rcx
xor r10, 0xdd
nop
add r8, rax
add r11, r10
ror r10, 0x33
xor r10, r11
ror rax, 0x30
xor rax, r8
ror r11, 0x20
add r8, r10
add r11, rax
mov rdx, r8
ror r10, 0x2f
mov rcx, r8
shr rdx, 0x20
xor r10, r8
ror rax, 0x2b
shl rcx, 0x20
mov r8, rdx
or r8, rcx
xor rax, r11
sub r9, 1
jne 0x1800de500
mov rbx, qword [rsp + 0x78]
xor rax, r8
xor rax, r10
xor rax, r11
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [r12], xmm0
add rsp, 0x40
pop r12
pop rdi
pop rbp
ret
Function at 0x1800f2c70
Capabilities:
Resolve dns

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x90
mov rax, qword [0x180253040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rbp, rdx
mov esi, ecx
test ecx, ecx
je 0x1800f2e13
test rdx, rdx
je 0x1800f2e57
movzx r9d, word [rdx + 0x20e]
lea r8, [0x180192f04]
mov edx, 8
mov qword [rsp + 0x88], rbx
lea rcx, [rsp + 0x68]
call fcn.1800dba40
mov eax, dword [rbp + 0x210]
lea rbx, [rbp + 8]
xorps xmm0, xmm0
mov dword [rsp + 0x3c], eax
xorps xmm1, xmm1
mov qword [rsp + 0x40], 1
mov rcx, rbx
mov dword [rsp + 0x38], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x68]
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x58], xmm1
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x1800f2d3b
mov edx, 2
mov qword [rsp + 0x20], rbx
lea r9, [0x180192f08]
mov rcx, r14
lea r8d, [rdx + 1]
call fcn.1800dcf20
xor eax, eax
jmp 0x1800f2df2
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x80], rdi
test rbx, rbx
je 0x1800f2db9
nop dword [rax]
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call fcn.18011d6c0
mov rdi, rax
test rax, rax
je 0x1800f2d96
call fcn.1800df9b0
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
imul ecx, esi, 0x3e8
movsxd r9, ecx
mov rcx, rdi
add r9, rax
call fcn.18011d320
test eax, eax
je 0x1800f2da4
mov rcx, rdi
call fcn.18011d4e0
xor edi, edi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1800f2d50
test rdi, rdi
je 0x1800f2db9
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rcx, rdi
call fcn.1801267c0
jmp 0x1800f2dea
mov edx, 2
lea rax, [rbp + 0x108]
lea r9, str.Failed_to_connect_to_target_host:__s
mov qword [rsp + 0x20], rax
mov rcx, r14
lea r8d, [rdx + 3]
call fcn.1800dcf20
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
xor eax, eax
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180030780
add rsp, 0x90
pop r14
pop rsi
pop rbp
ret
mov ecx, 2
call fcn.1800375c0
mov rcx, rax
lea r8, str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_client.c
lea rax, str.connecttimeoutms
mov r9d, 0x29b
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str.mongoc_client_connect_tcp
mov qword [rsp + 0x20], rax
call fcn.1800d2980
call fcn.18003e318
int3
mov ecx, 2
call fcn.1800375c0
mov rcx, rax
lea r8, str.C:Usersprocr_vcpkg_buildtreesmongo_c_driver_src1.26.1_690bc2849a.clean_srclibmongoc_srcmongocmongoc_client.c
lea rax, str.host
mov r9d, 0x29c
mov qword [rsp + 0x28], rax
lea rdx, str._s:_d__s__:_precondition_failed:__s_n
lea rax, str.mongoc_client_connect_tcp
mov qword [rsp + 0x20], rax
call fcn.1800d2980
call fcn.18003e318
int3
Function at 0x18010d3a0
Capabilities:
Hash data via bcrypt

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
lea rax, [r11 - 0x34]
mov rbp, r9
mov dword [r11 - 0x50], r12d
mov r14, r8
mov dword [r11 - 0x38], r12d
mov r15, rdx
mov qword [r11 - 0x28], r12
lea r9d, [r12 + 4]
mov dword [r11 - 0x30], r12d
lea r8, [r11 - 0x38]
mov dword [r11 - 0x34], r12d
lea rdx, str.ObjectLength
mov qword [r11 - 0x58], rax
mov rsi, rcx
xor bl, bl
call sub.bcrypt.dll_BCryptGetProperty
test eax, eax
jns 0x18010d41e
lea r8, str.BCryptGetProperty__:_OBJECT_LENGTH__ld
mov r9d, eax
lea rdx, str.mongoc
xor ecx, ecx
call fcn.1800e3570
xor al, al
jmp 0x18010d53c
lea rax, [rsp + 0x44]
mov dword [rsp + 0x28], r12d
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x48]
mov rcx, rsi
lea rdx, str.HashDigestLength
call sub.bcrypt.dll_BCryptGetProperty
test eax, eax
jns 0x18010d454
lea r8, str.BCryptGetProperty__:_HASH_LENGTH__ld
jmp 0x18010d406
mov ecx, dword [rsp + 0x40]
mov qword [rsp + 0x80], rdi
call fcn.1800d9eb0
mov r9d, dword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x30], r12d
mov r8, rax
mov dword [rsp + 0x28], r14d
mov rcx, rsi
mov qword [rsp + 0x20], r15
mov rdi, rax
call sub.bcrypt.dll_BCryptCreateHash
test eax, eax
jns 0x18010d4aa
mov r9d, eax
lea r8, str.BCryptCreateHash__:__ld
lea rdx, str.mongoc
xor ecx, ecx
call fcn.1800e3570
jmp 0x18010d51a
mov r8d, dword [rsp + 0xa0]
xor r9d, r9d
mov rcx, qword [rsp + 0x50]
mov rdx, rbp
call sub.bcrypt.dll_BCryptHashData
test eax, eax
jns 0x18010d4e0
mov r9d, eax
lea r8, str.BCryptHashData__:__ld
lea rdx, str.mongoc
xor ecx, ecx
call fcn.1800e3570
jmp 0x18010d51a
mov r8d, dword [rsp + 0x48]
xor r9d, r9d
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x50]
call sub.bcrypt.dll_BCryptFinishHash
test eax, eax
jns 0x18010d518
mov r9d, eax
lea r8, str.BCryptFinishHash__:__ld
lea rdx, str.mongoc
xor ecx, ecx
call fcn.1800e3570
jmp 0x18010d51a
mov bl, 1
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18010d529
call sub.bcrypt.dll_BCryptDestroyHash
mov rcx, rdi
call fcn.1800d9ea0
mov rdi, qword [rsp + 0x80]
movzx eax, bl
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x1801104d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov rax, qword [0x180253040]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [rcx + 0x7c], 0
lea r15, [rcx + 0x7c]
mov edi, reloc.WS2_32.dll_sendto
lea rsi, [rcx + 0x130]
mov rbx, rcx
mov r14, r9
mov r12d, r8d
mov r13, rdx
lea ecx, [rdi + 0xc]
jne 0x180110561
mov eax, dword [rsi]
test eax, eax
jne 0x180110526
mov r8d, edi
jmp 0x180110530
xor r8d, r8d
cmp eax, 1
cmove r8d, ecx
lea rbp, [rbx + 0x120]
mov qword [rsp + 0x28], r15
mov rcx, rbp
mov dword [rsp + 0x20], 0xa
lea rdx, [rbx + 0xbc]
lea r9, str.Client_Key
call fcn.18013bde0
mov ecx, 0x20
jmp 0x180110568
lea rbp, [rbx + 0x120]
mov eax, dword [rsi]
test eax, eax
jne 0x180110573
mov r8, rdi
jmp 0x18011057d
xor r8d, r8d
cmp eax, 1
cmove r8, rcx
lea r9, [rsp + 0x50]
mov rdx, r15
mov rcx, rbp
call fcn.18013bdd0
mov eax, dword [rsi]
mov r15d, 0x20
test eax, eax
jne 0x18011059e
mov r8d, edi
jmp 0x1801105a8
xor r8d, r8d
cmp eax, 1
cmove r8d, r15d
mov r9, qword [rbx + 0x110]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
mov eax, dword [rbx + 0x11c]
mov rcx, rbp
mov dword [rsp + 0x20], eax
call fcn.18013bde0
mov rcx, rbx
call fcn.180111d70
movsxd r8, eax
test eax, eax
jle 0x18011060b
xor edx, edx
lea rax, [rsp + 0x30]
sub rbx, rax
nop dword [rax]
lea rax, [rsp + 0x30]
add rax, rdx
movzx ecx, byte [rax + rbx + 0x7c]
xor cl, byte [rax]
mov byte [rsp + rdx + 0x70], cl
inc rdx
cmp rdx, r8
jl 0x1801105f0
mov eax, dword [rsi]
test eax, eax
je 0x18011061a
xor edi, edi
cmp eax, 1
cmove rdi, r15
mov r8d, dword [r14]
lea rcx, [rsp + 0x70]
sub r12d, r8d
mov rdx, rdi
mov r9d, r12d
add r8, r13
call fcn.180138490
cmp eax, 0xffffffff
jne 0x18011063c
xor al, al
jmp 0x180110641
add dword [r14], eax
mov al, 1
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180030780
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801106f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x98
mov rax, qword [0x180253040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov ebx, dword [rsp + 0xf0]
lea rdi, [rcx + 0xbc]
mov r14d, r8d
mov rbp, rdx
mov r13, rcx
mov r8d, ebx
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.180159c90
cmp rbx, 0x20
jae 0x18011093d
lea eax, [rbx + 1]
mov byte [rsp + rbx + 0x50], 0
cmp eax, 0x20
jae 0x18011093d
mov byte [rsp + rax + 0x50], 0
lea eax, [rbx + 2]
cmp eax, 0x20
jae 0x18011093d
mov ecx, dword [r13 + 0x130]
mov byte [rsp + rax + 0x50], 0
lea eax, [rbx + 3]
mov qword [rsp + 0x90], r12
xor r12d, r12d
mov byte [rsp + rax + 0x50], 1
lea ebx, [r12 + 0x20]
test ecx, ecx
jne 0x18011078f
lea eax, [rcx + 0x14]
jmp 0x180110798
cmp ecx, 1
mov eax, r12d
cmove eax, ebx
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x50]
mov r8d, r14d
mov dword [rsp + 0x20], eax
mov rdx, rbp
lea rcx, [r13 + 0x120]
call fcn.18013bde0
mov eax, dword [r13 + 0x130]
test eax, eax
jne 0x1801107c9
lea r8d, [rax + 0x14]
jmp 0x1801107d3
cmp eax, 1
mov r8, r12
cmove r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180159c90
mov eax, dword [rsp + 0xf8]
cmp eax, 2
jb 0x180110918
mov qword [rsp + 0x88], r15
lea r15d, [rax - 1]
nop dword [rax]
mov eax, dword [r13 + 0x130]
test eax, eax
jne 0x180110814
mov ebx, reloc.WS2_32.dll_sendto
mov eax, ebx
jmp 0x180110822
cmp eax, 1
jne 0x1801108a1
mov eax, 0x20
lea r10, [rsp + 0x30]
mov r8d, r14d
mov qword [rsp + 0x28], r10
lea r9, [rsp + 0x30]
mov rdx, rbp
mov dword [rsp + 0x20], eax
lea rcx, [r13 + 0x120]
call fcn.18013bde0
mov eax, ebx
lea rdx, [rdi - 1]
add rdx, rax
mov rcx, r12
lea rax, [rsp + rax + 0x2f]
cmp rdi, rax
ja 0x180110867
lea rax, [rsp + 0x30]
cmp rdx, rax
jae 0x1801108cd
mov eax, 0xfffffff8
lea r8, [rsp + 0x30]
mov edx, ebx
and rdx, rax
mov rax, rdi
sub r8, rdi
nop dword [rax]
movq xmm0, qword [rax]
add rcx, 8
movq xmm1, qword [r8 + rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp rcx, rdx
jl 0x180110880
jmp 0x1801108cd
lea rax, [rsp + 0x30]
mov r8d, r14d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
mov rdx, rbp
mov dword [rsp + 0x20], r12d
lea rcx, [r13 + 0x120]
mov ebx, r12d
call fcn.18013bde0
mov rcx, r12
mov edx, ebx
cmp rcx, rdx
jge 0x180110901
lea r8, [rsp + 0x30]
sub r8, rdi
lea rax, [rcx + rdi]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1801108f0
mov ebx, 0x20
sub r15, 1
jne 0x180110800
mov r15, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180030780
add rsp, 0x98
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1800314e4
int3
Function at 0x18011cbd0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x48], 1
call fcn.1800408fc
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov rcx, rbx
mov dword [rax], 0
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18011cc31
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
lea r8, str.WSAGetLastError__:__d
lea rdx, str.socket
lea ecx, [rbx + 3]
call fcn.1800e3570
test ebx, ebx
sete al
add rsp, 0x30
pop rbx
ret