joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000bd80
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x18000bda8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18000bdce
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18000bdd0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18000be29
test ecx, ecx
jle 0x18000be09
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18000be29
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18000be29
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x18000be50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18000be72
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x18000be88
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18000bea4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18000bea6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18000bee2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18000bf7e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18000bf1d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18000bf5e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18000bf7e
cmp rbx, rax
ja 0x18000bf30
test rbx, rbx
je 0x18000bf7e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x18000c3b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x18002d010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000c3dd
xor eax, eax
jmp 0x18000c549
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000c417
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18000c417
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18000c549
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18000c53c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000c45a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18000c485
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000c541
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18000c4f4
sub eax, 1
je 0x18000c4f4
cmp eax, 2
jne 0x18000c53c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000c541
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18000c522
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18000c53c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18000c541
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180020300
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18000d4e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18002d010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18000d5b3
cmp byte [rcx + 0x71], 0
je 0x18000d5b3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000d5af
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18000d574
sub eax, 1
je 0x18000d578
cmp eax, 2
jne 0x18000d5af
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180020300
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18000d5a6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18000d5af
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18000d55c
xor al, al
jmp 0x18000d55c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180020300
add rsp, 0x60
pop rbx
ret

Function at 0x1800207f0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x180036aa4
Capabilities:
Delete file

Disassembly:
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::basic_istream_char__struct_std::char_traits_char__::get_void____ptr64]
mov edx, eax
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
cmp rcx, r8
jae 0x180002958
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp r8, 0x10
jb 0x18000294e
mov rax, qword [rbx]
mov byte [rax + rcx], dl
mov byte [rax + rcx + 1], 0
jmp 0x180002964
movzx r9d, dl
mov rcx, rbx
call fcn.18000f470
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::eof_void_const___ptr64]
test al, al
je 0x180002920
lea rcx, [rbp - 0x80]
call fcn.18000d5d0
test rax, rax
jne 0x1800029ab
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
nop
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x6c], edx
lea rcx, [rbp - 0x80]
call fcn.18000c5b0
lea rcx, [rbp - 0x78]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x20]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x180002a43
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180002a3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002a3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800207b4
movdqa xmm0, xmmword [0x180027480]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180002a98
inc rdx
mov rax, r13
cmp rdx, 0x1000
jb 0x180002a90
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002a90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.1800207b4
mov rax, rbx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.180020300
mov rbx, qword [rsp + 0x330]
add rsp, 0x2e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
not byte [rsp + 0x60]
jge 0x180002925
not word [rsp + 0x60]
mov r9, qword [rsp + 0x30]
xor word [rsp + 0x60], 0x244d
jge 0x180123bbd
call 0x1801b4d2c
movabs al, byte [0x9cb5bde0940d04eb]
jbe 0x180123bcc
push qword [rdx]
cld
xor bh, ah
imul edi, dword [rdx + 0xa], 0xd43b64c4
sbb sil, sil
invalid
Function at 0x18003b550
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x18003b57c
xor al, al
jmp 0x18003b6a0
movdqa xmm0, xmmword [0x18005bae0]
movdqa xmm1, xmmword [0x18005baf0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x18005bb00]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x18005bb10]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x18003b692
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x18003b5f9
mov r11d, 2
jmp 0x18003b61d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x18003b613
mov r11d, 1
jmp 0x18003b61d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x18003b6b5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x18003b65a
mov byte [rcx + 2], 0x3d
jmp 0x18003b66a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x18003b67c
mov byte [rcx], 0x3d
jmp 0x18003b683
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x18003b5e0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x18003b69b

Function at 0x180170d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and rdx, rdx
mov rdx, qword [rsp + 0x20]
movabs rbp, 0x66a1504285416bb
and bpl, 0x94
add qword [rsp + 0x10], 0x7ff0c33e
mov bp, 0x1f00
and bp, bp
mov rbp, qword [rsp + 8]
call fcn.1800bfdae

Function at 0x180170d79
Capabilities:
Resolve function by parsing pe exports

Disassembly:
not dword [rsp + 0x98]
movsx cx, r12w
mov r11, qword [rsp + 0x78]
seta bpl
movzx rbp, r12b
not byte [rsp + 0x98]
add word [rsp + 0x18], 0x3b21
add qword [rsp + 0x30], 0x7fe2219f
sub word [rsp + 0x28], r12w
mov rbp, qword [rsp + 0x60]
sub r13d, dword [rsp + 0xa2]
mov byte [rsp + 0x98], 0x6b
not r8b
jns 0x1801fca67
pop rsi
call fcn.1801b8627
jb 0x180170dde
sbb dword [rbx], ecx
push rbp
sbb dword [rbx + 0x14], edx
add dword [0x18c071ae1], esi
loopne 0x180170dec
or eax, 0x9e00bf0
rol byte [rdi], 1
rol byte [0x18377125c], 0x30
add dl, byte [rax]
add byte [rdx + rsi*8 + 4], bh
add byte [rdx], al
add byte [rax], al
add byte [rbp + rbx*2 + 0x5dcc003b], ch
cmp eax, dword [rax]
ja 0x180170e3e
add ah, cl
pop rbp
cmp eax, dword [rax]
rcr dword [rbp + 0x3b], 1
add ah, bl
pop rbp
cmp eax, dword [rax]
ja 0x180170e4e
add byte [rdi], ch
invalid
mov al, 0xa5
add byte [rax], al
xor al, 0x75
xor dword [rdx + riz*2], ecx
or al, 0x4c
mov esi, dword [rsp + 0x28]
Function at 0x180198b3d
Capabilities:
Encode data using xor

Disassembly:
call fcn.1801eba43
loopne 0x180198b19
pushfq
pop rax
movabs r13, 0x39dc740106c6530b
call fcn.1801d23cc
push rdx
push r8
movabs r8, 0x4c604a3841047b12
call fcn.180034fb8
mov r10, rcx
mov rcx, qword [rsp + 0x20]
lea rdx, [r10 + 0x1978483c]
jbe 0x180130835
xlatb
sti
scasb al, byte [rdi]
adc dword [rbp + 0x6e55a2bc], eax
jo 0x180198aeb
sbb ch, byte [rcx + rdx - 0x56bcb009]
adc esp, ebx
sub edx, dword [rax]
movsb byte [rdi], byte [rsi]
adc dword [rsi + rdi*2], ebx
pop rsi
pop rdi
out dx, al
push 0xffffffffffffffc7
cmpsb byte [rsi], byte [rdi]
xchg ecx, eax
and ah, byte [rbx + 0x5c]
movabs byte [0x350911a71cd76f11], al
sbb dword [rsi + rbp*8 - 2], 0x5c
fst dword [rbx + 0x6e]
and al, 0x6a
cld
pop rsi
outsb dx, byte [rsi]
sbb edi, dword [rdx]
adc ah, byte [rdi - 0x55a7616f]
pop rsi
out dx, al
sub dword [rcx - 0x1911a40d], ecx
add eax, 0x5eee56a0
sbb dh, ch
lodsd eax, dword [rsi]
adc esp, eax
xor esp, edi
push rsp
outsb dx, byte [rsi]
ror byte [rbp - 0x14], 1
push rax
out dx, al
jno 0x180198b8b
lodsb al, byte [rsi]
push rbp
out dx, al
ret

Function at 0x1801e74b4
Capabilities:
Encode data using xor

Disassembly:
sub byte [rsp + 0xa0], 0x3f
call fcn.1801ac480
or eax, 0xb87e324f
mov ch, 0xde
cmc
push rdx
and dword [rdi + 2], esi
invalid
mov rdi, qword [rsp + 0x50]
mov rdi, qword [rdi]
mov r8, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
or r8w, word [rsp + 0x42]
mov qword [rsp + 0x50], r8
push r15
js 0x1801d3588
movsx rbx, si
lea rdi, [rdi + r8 - 0x4068fd68]
add qword [rsp + 0x20], 0x7ffc3e7a
movabs r15, 0x6feb466235c7082b
and r8b, byte [rsp + 0x48]
call fcn.18011a1bf

Function at 0x18025c3de
Capabilities:
Delete file

Disassembly:
call fcn.180119780
sub word [rsp + 0x40], 0x7b62
or sil, byte [rsp + 0x36]
sub si, 0x183d
mov rbx, rcx
mov rbx, qword [rsp + 8]
xchg qword [rsp + 0x58], rbx
jae 0x180036a9f

Function at 0x180834240
Capabilities:
Encode data using xor

Disassembly:
pushfq
add ebp, 0x6f2834f6
test bpl, 0x8e
push r9
mov qword [rsp + 0x18], 0xffffffffa01e49d0
movabs r9, 0x2b875aaa18b160f8
call fcn.1807d5f3b
jrcxz 0x180774750
invalid
lahf
std
invalid
setbe r9b
sub r9w, 0x1d63
jb 0x1807746e7
not r9b
mov r9, qword [rsp + 0x10]
xor bpl, 0x40
jb 0x180834258
or ebp, 0x242f4d8c
or bp, 0x6596
mov rbp, qword [rsp + 0x20]
call fcn.180794c5c
sub al, 0x78
invalid
Function at 0x18000c200
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12d, r9d
mov r15, r8
mov r14, rdx
mov rbp, rcx
test rcx, rcx
je 0x18000c3c6
test rdx, rdx
je 0x18000c3c6
movabs rax, 0x7fffffffffffffff
cmp r8, rax
ja 0x18000c3c6
cmp dword [rcx], 0
mov rsi, qword [rsp + 0x70]
jne 0x18000c26c
mov r8, rsi
mov edx, 0x100
call fcn.18000c130
test al, al
je 0x18000c3d7
movzx eax, byte [r14]
mov rcx, r14
mov edi, 0x1505
test al, al
je 0x18000c295
nop dword [rax]
imul rdi, rdi, 0x21
movzx eax, al
lea rcx, [rcx + 1]
add rdi, rax
movzx eax, byte [rcx]
test al, al
jne 0x18000c280
xor edx, edx
mov eax, edi
div dword [rbp]
mov rax, qword [rbp + 0x10]
mov r13d, edx
mov rbx, qword [rax + rdx*8]
test rbx, rbx
je 0x18000c2e0
nop dword [rax]
cmp dword [rbx + 0x20], edi
jne 0x18000c2d7
mov r8, qword [rbx]
mov rax, r14
sub r8, r14
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18000c2d3
inc rax
test ecx, ecx
jne 0x18000c2c0
test edx, edx
je 0x18000c307
mov rbx, qword [rbx + 0x18]
test rbx, rbx
jne 0x18000c2b0
mov ecx, 0x28
call fcn.1800a411c
mov rbx, rax
test rax, rax
jne 0x18000c334
test rsi, rsi
je 0x18000c3d7
mov qword [rsi], reloc.WS2_32.dll_ntohl
jmp 0x18000c3d7
test r12b, 8
je 0x18000c314
cmp qword [rbx + 8], 0xffffffffffffffff
jne 0x18000c31f
cmp qword [rbx + 0x10], 0xffffffffffffffff
je 0x18000c3b4
test rsi, rsi
je 0x18000c3d7
mov qword [rsi], 0xa
jmp 0x18000c3d7
mov qword [rax], r14
xorps xmm1, xmm1
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + r13*8]
mov qword [rbx + 0x18], rcx
mov rax, qword [rbp + 0x10]
mov qword [rax + r13*8], rbx
mov dword [rbx + 0x20], edi
mov qword [rbx + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rcx, qword [rbp + 8]
mov edx, dword [rbp]
test rcx, rcx
js 0x18000c370
cvtsi2sd xmm1, rcx
jmp 0x18000c385
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1800e1ea8]
comisd xmm1, xmm0
jbe 0x18000c3b4
cmp edx, 0x80000000
jae 0x18000c3b4
add edx, edx
mov r8, rsi
mov rcx, rbp
call fcn.18000c130
test al, al
je 0x18000c3d7
test r12b, 8
je 0x18000c3be
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov al, 1
jmp 0x18000c3d9
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x18000c3d7
mov qword [rax], reloc.WS2_32.dll_select
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000c400
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov r11, rdx
mov rdi, rcx
test rcx, rcx
je 0x18000c555
test rdx, rdx
je 0x18000c555
cmp qword [rcx + 8], 0
jbe 0x18000c4b3
movzx eax, byte [rdx]
mov r8, rdx
mov r10d, 0x1505
test al, al
je 0x18000c466
nop dword [rax]
imul r10, r10, 0x21
movzx eax, al
lea r8, [r8 + 1]
add r10, rax
movzx eax, byte [r8]
test al, al
jne 0x18000c450
mov r14, qword [rcx + 0x10]
xor edx, edx
mov eax, r10d
xor esi, esi
div dword [rcx]
mov ebp, edx
mov r8, qword [r14 + rdx*8]
test r8, r8
je 0x18000c4b3
nop
cmp dword [r8 + 0x20], r10d
jne 0x18000c4a7
mov r9, qword [r8]
mov rax, r11
sub r9, r11
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x18000c4a3
inc rax
test ecx, ecx
jne 0x18000c490
test edx, edx
je 0x18000c4c8
mov rsi, r8
mov r8, qword [r8 + 0x18]
test r8, r8
jne 0x18000c480
test rbx, rbx
je 0x18000c561
mov qword [rbx], 9
jmp 0x18000c561
cmp qword [r8 + 8], 0xffffffffffffffff
jne 0x18000c549
mov rax, qword [r8 + 0x18]
test rsi, rsi
je 0x18000c4de
mov qword [rsi + 0x18], rax
jmp 0x18000c4e2
mov qword [r14 + rbp*8], rax
mov rcx, r8
call fcn.1800a4108
dec qword [rdi + 8]
xorps xmm1, xmm1
mov rcx, qword [rdi + 8]
mov edx, dword [rdi]
test rcx, rcx
js 0x18000c503
cvtsi2sd xmm1, rcx
jmp 0x18000c518
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm0, rdx
mulsd xmm0, qword [0x1800e1ea0]
comisd xmm0, xmm1
jbe 0x18000c551
cmp edx, 0x100
jbe 0x18000c551
shr edx, 1
mov r8, rbx
mov rcx, rdi
call fcn.18000c130
test al, al
jne 0x18000c551
jmp 0x18000c561
mov qword [r8 + 0x10], 0xffffffffffffffff
mov al, 1
jmp 0x18000c563
test rbx, rbx
je 0x18000c561
mov qword [r8], reloc.WS2_32.dll_select
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18000e070
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
test r9, r9
je 0x18000e167
push rbp
push rsi
push rdi
push r15
sub rsp, 0x38
mov rax, qword [0x1800f3188]
xor rax, rsp
mov qword [rsp + 0x28], rax
movzx eax, word [rcx + 0x18]
mov rsi, r8
mov qword [rsp + 0x78], rbx
sub rsi, rdx
mov qword [rsp + 0x30], r14
mov r15, r9
mov r14d, dword [rsp + 0x80]
mov rdi, rdx
mov rbp, rcx
mov rbx, rdx
nop dword [rax]
movzx edx, byte [rsi + rbx]
mov byte [rsp + 0x20], dl
test r14d, r14d
jne 0x18000e0e7
movzx eax, ax
or eax, 2
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor cl, dl
movzx edx, cl
mov byte [rsp + 0x20], cl
test rdi, rdi
je 0x18000e0ee
mov byte [rbx], dl
mov ecx, dword [rbp + 0x10]
lea rdx, [rsp + 0x20]
not ecx
mov r8d, 1
call fcn.18000f120
not eax
lea rdx, [rsp + 0x20]
mov dword [rbp + 0x10], eax
mov r8d, 1
movzx eax, al
add eax, dword [rbp + 0x14]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbp + 0x14], ecx
shr ecx, 0x18
mov byte [rsp + 0x20], cl
mov ecx, dword [rbp + 0x18]
not ecx
call fcn.18000f120
inc rbx
not eax
mov dword [rbp + 0x18], eax
sub r15, 1
jne 0x18000e0c0
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a1bf0
add rsp, 0x38
pop r15
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e6e0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
test rcx, rcx
je 0x18000e83e
test rdx, rdx
je 0x18000e83e
test r8d, 0x1003
je 0x18000e798
test bpl, 1
lea r15, [0x1800b3250]
lea rax, [fcn.1800b2998]
cmovne r15, rax
xor ebx, ebx
cmp qword [rcx + 0x48], rbx
jbe 0x18000e83e
nop
xor r9d, r9d
mov r8d, ebp
mov rdx, rbx
mov rcx, rsi
call fcn.18000efe0
mov rdi, rax
test rax, rax
je 0x18000e782
test bpl, 2
je 0x18000e775
mov edx, gethostbyaddr
mov rcx, rax
call fcn.1800a32d0
test rax, rax
je 0x18000e775
lea rdi, [rax + 1]
mov rdx, rdi
mov rcx, r14
call r15
test eax, eax
je 0x18000e790
inc rbx
cmp rbx, qword [rsi + 0x48]
jb 0x18000e740
jmp 0x18000e83e
mov rax, rbx
jmp 0x18000e845
mov r8, qword [rcx + 0x70]
test r8, r8
je 0x18000e83e
cmp qword [r8 + 8], 0
jbe 0x18000e83e
movzx ecx, byte [rdx]
mov eax, 0x1505
test cl, cl
je 0x18000e7d5
nop dword [rax]
imul rax, rax, 0x21
movzx ecx, cl
lea rdx, [rdx + 1]
add rax, rcx
movzx ecx, byte [rdx]
test cl, cl
jne 0x18000e7c0
xor edx, edx
div dword [r8]
mov rax, qword [r8 + 0x10]
mov r9, qword [rax + rdx*8]
test r9, r9
je 0x18000e83e
nop word [rax + rax]
mov r8, qword [r9]
mov rax, r14
sub r8, r14
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18000e813
inc rax
test ecx, ecx
jne 0x18000e800
test edx, edx
je 0x18000e822
mov r9, qword [r9 + 0x18]
test r9, r9
jne 0x18000e7f0
jmp 0x18000e83e
test bpl, 8
je 0x18000e834
mov rax, qword [r9 + 8]
cmp rax, 0xffffffffffffffff
je 0x18000e83e
jmp 0x18000e845
mov rax, qword [r9 + 0x10]
cmp rax, 0xffffffffffffffff
jne 0x18000e845
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret