joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp + 0x3f], rax
movdqa xmm0, xmmword [0x180044c80]
xor edi, edi
mov rbx, qword [0x18004fe98]
mov r15, rcx
mov ecx, 0x1000
mov qword [rbp - 0x51], rdi
mov dword [rbp - 0x55], edi
movdqu xmmword [rbp + 0x27], xmm0
mov byte [rbp + 0x39], dil
mov dword [rbp - 0x59], 1
mov word [rbp + 0x37], 0x73
call fcn.180004d80
test rax, rax
jne 0x1800077b2
mov ebx, edi
jmp 0x1800077be
lea rdx, [rbp + 0x27]
mov rcx, rax
call rbx
mov rbx, rax
movdqa xmm0, xmmword [0x180044c20]
mov ecx, 0x1007
mov rsi, qword [0x18004fe98]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x6e65
call fcn.180004d80
test rax, rax
jne 0x1800077ed
mov rsi, rdi
jmp 0x1800077f9
lea rdx, [rbp + 0xf]
mov rcx, rax
call rsi
mov rsi, rax
call rbx
mov rcx, rax
lea r8, [rbp - 0x51]
mov edx, 8
call rsi
mov ebx, eax
test eax, eax
js 0x1800078b1
movdqa xmm0, xmmword [0x180044c10]
mov ecx, 0x1007
mov rbx, qword [0x18004fe98]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x6f546e6f
mov dword [rbp - 0x15], 0x6e656b
mov byte [rbp - 0x11], dil
call fcn.180004d80
test rax, rax
jne 0x18000784d
mov rax, rdi
jmp 0x180007856
lea rdx, [rbp - 0x29]
mov rcx, rax
call rbx
mov r9d, 4
lea rcx, [rbp - 0x55]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x59]
mov rcx, qword [rbp - 0x51]
lea edx, [r9 + 0xe]
call rax
mov rsi, qword [0x18004fe98]
mov ecx, 0x1007
mov ebx, eax
mov dword [rbp - 0x49], 0x6c43744e
mov dword [rbp - 0x45], 0x65736f
mov byte [rbp - 0x41], dil
call fcn.180004d80
test rax, rax
jne 0x1800078a2
mov rax, rdi
jmp 0x1800078ab
lea rdx, [rbp - 0x49]
mov rcx, rax
call rsi
mov rcx, qword [rbp - 0x51]
call rax
movdqa xmm0, xmmword [0x180044c90]
mov ecx, 0x1007
mov rsi, qword [0x18004fe98]
movdqu xmmword [rbp - 9], xmm0
mov dword [rbp + 7], 0x6f727245
mov word [rbp + 0xb], 0x72
mov byte [rbp + 0xd], dil
call fcn.180004d80
test rax, rax
jne 0x1800078ea
mov rsi, rdi
jmp 0x1800078f6
lea rdx, [rbp - 9]
mov rcx, rax
call rsi
mov rsi, rax
mov r14, qword [0x18004fe98]
mov ecx, 0x1000
mov dword [rbp - 0x39], 0x4c746553
mov dword [rbp - 0x35], 0x45747361
mov dword [rbp - 0x31], 0x726f7272
mov word [rbp - 0x2d], di
call fcn.180004d80
test rax, rax
je 0x180007932
lea rdx, [rbp - 0x39]
mov rcx, rax
call r14
mov rdi, rax
mov ecx, ebx
call rsi
mov ecx, eax
call rdi
test r15, r15
je 0x180007945
mov eax, dword [rbp - 0x59]
mov dword [r15], eax
not ebx
shr ebx, 0x1f
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.180011e00
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180007a60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp + 0x37], rax
movdqa xmm0, xmmword [0x180044ca0]
lea rdi, [rbp - 0x41]
mov rbx, qword [0x18004fe98]
xor eax, eax
mov ecx, 0x10
mov dword [rbp + 0x17], 0x676e6972
rep stosb byte [rdi], al
mov ecx, 0x1007
mov word [rbp + 0x1b], ax
mov rsi, rdx
movdqu xmmword [rbp + 7], xmm0
call fcn.180004d80
xor edi, edi
test rax, rax
jne 0x180007ac6
mov eax, edi
jmp 0x180007acf
lea rdx, [rbp + 7]
mov rcx, rax
call rbx
lea rdx, str._temp__
lea rcx, [rbp - 0x41]
call rax
movdqa xmm0, xmmword [0x180044c60]
mov ecx, 0x1007
mov rbx, qword [0x18004fe98]
movdqu xmmword [rbp - 0x31], xmm0
mov qword [rbp - 0x49], rsi
mov dword [rbp - 0x51], 0x2080000
mov dword [rbp - 0x59], edi
mov dword [rbp - 0x21], 0x746e656d
mov dword [rbp - 0x1d], 0x69727453
mov dword [rbp - 0x19], 0x5f73676e
mov word [rbp - 0x15], 0x55
mov byte [rbp - 0x13], dil
call fcn.180004d80
test rax, rax
jne 0x180007b31
mov rax, rdi
jmp 0x180007b3a
lea rdx, [rbp - 0x31]
mov rcx, rax
call rbx
lea r9, [rbp - 0x59]
xor ecx, ecx
lea r8, [rbp - 0x51]
lea rdx, [rbp - 0x41]
call rax
mov ebx, eax
mov eax, 0x80000000
lea ecx, [rbx + rax]
test eax, ecx
jne 0x180007c04
cmp ebx, 0xc0000023
je 0x180007c04
movdqa xmm0, xmmword [0x180044c90]
mov ecx, 0x1007
mov rsi, qword [0x18004fe98]
movdqu xmmword [rbp - 0x11], xmm0
mov qword [rsp + 0xe0], r14
mov dword [rbp - 1], 0x6f727245
mov word [rbp + 3], 0x72
mov byte [rbp + 5], dil
call fcn.180004d80
test rax, rax
jne 0x180007ba9
mov rsi, rdi
jmp 0x180007bb5
lea rdx, [rbp - 0x11]
mov rcx, rax
call rsi
mov rsi, rax
movdqa xmm0, xmmword [0x180044bd0]
mov ecx, 0x1007
mov r14, qword [0x18004fe98]
movdqu xmmword [rbp + 0x1f], xmm0
mov dword [rbp + 0x2f], 0x726f7272
mov word [rbp + 0x33], di
call fcn.180004d80
test rax, rax
je 0x180007bf0
lea rdx, [rbp + 0x1f]
mov rcx, rax
call r14
mov rdi, rax
mov ecx, ebx
call rsi
mov ecx, eax
call rdi
mov r14, qword [rsp + 0xe0]
xor eax, eax
jmp 0x180007c0a
mov eax, dword [rbp - 0x59]
shr rax, 1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180011e00
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180007ff0
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14, rcx
lea rdi, [rsp + 0x40]
xor eax, eax
xor ebx, ebx
mov ecx, 0x410
mov edx, 0x7ffe0030
rep stosb byte [rdi], al
lea rdi, [rsp + 0x40]
mov ebp, ebx
sub rdi, rdx
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rdx]
mov word [rdi + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x180008040
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x180008060
movups xmm0, xmmword [str._system32_ntoskrnl.exe]
mov eax, dword [0x180044638]
xor edx, edx
movups xmm1, xmmword [0x180044620]
movups xmmword [rcx], xmm0
lea r8d, [rdx + 1]
movsd xmm0, qword [0x180044630]
movups xmmword [rcx + 0x10], xmm1
movsd qword [rcx + 0x20], xmm0
mov dword [rcx + 0x28], eax
movzx eax, word [0x18004463c]
mov word [rcx + 0x2c], ax
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x180008162
movdqa xmm0, xmmword [0x180044b70]
mov ecx, 0x1000
mov qword [rsp + 0x488], rsi
mov rsi, qword [0x18004fe98]
movdqu xmmword [rsp + 0x30], xmm0
call fcn.180004d80
test rax, rax
jne 0x1800080ee
mov rax, rbx
jmp 0x1800080f8
lea rdx, [rsp + 0x30]
mov rcx, rax
call rsi
lea rdx, str.NtBuildNumber
mov rcx, rdi
call rax
test rax, rax
je 0x180008114
movzx eax, word [rax]
mov ebp, 1
mov dword [r14], eax
mov rsi, qword [0x18004fe98]
mov ecx, 0x1000
mov dword [rsp + 0x20], 0x65657246
mov dword [rsp + 0x24], 0x7262694c
mov dword [rsp + 0x28], 0x797261
mov byte [rsp + 0x2c], bl
call fcn.180004d80
test rax, rax
je 0x180008153
lea rdx, [rsp + 0x20]
mov rcx, rax
call rsi
mov rbx, rax
mov rcx, rdi
call rbx
mov rsi, qword [rsp + 0x488]
mov eax, ebp
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180011e00
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop rdi
pop rbp
ret
Function at 0x180008190
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword gs:[0x30]
xor ebx, ebx
movdqa xmm0, xmmword [0x180044bf0]
mov ecx, 0x1007
mov rdi, qword [0x18004fe98]
mov rsi, qword [rax + 0x60]
mov qword [0x180050938], rbx
mov qword [rbp - 0x59], 0x1000
movdqu xmmword [rbp - 0x31], xmm0
mov dword [rbp - 0x21], 0x6d654d6c
mov dword [rbp - 0x1d], 0x79726f
mov byte [rbp - 0x19], bl
call fcn.180004d80
test rax, rax
jne 0x180008210
mov eax, ebx
jmp 0x180008219
lea rdx, [rbp - 0x31]
mov rcx, rax
call rdi
mov dword [rsp + 0x28], 4
lea r9, [rbp - 0x59]
xor r8d, r8d
mov dword [rsp + 0x20], 0x3000
lea rdx, [0x180050938]
or rcx, 0xffffffffffffffff
call rax
test eax, eax
js 0x1800083dd
mov rcx, qword [0x180050938]
test rcx, rcx
je 0x1800083dd
lea rdx, [0x18004fef4]
nop dword [rax]
movzx eax, word [rdx]
lea rdx, [rdx + 2]
mov word [rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180008260
mov rcx, qword [0x180050938]
sub rcx, 2
nop
cmp word [rcx + 2], bx
lea rcx, [rcx + 2]
jne 0x180008280
movups xmm0, xmmword [0x180044650]
mov rdi, qword [0x18004fe98]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x180044660]
movdqa xmm0, xmmword [0x180044c40]
movsd qword [rcx + 0x10], xmm1
movzx eax, word [0x180044668]
mov word [rcx + 0x18], ax
mov ecx, 0x1007
movdqu xmmword [rbp - 0x11], xmm0
mov dword [rbp - 1], 0x74636553
mov dword [rbp + 3], 0x6e6f69
mov byte [rbp + 7], bl
call fcn.180004d80
test rax, rax
jne 0x1800082e5
mov rax, rbx
jmp 0x1800082ee
lea rdx, [rbp - 0x11]
mov rcx, rax
call rdi
mov rcx, qword [rsi + 0x38]
call rax
movdqa xmm0, xmmword [0x180044ca0]
mov ecx, 0x1007
mov rdi, qword [0x18004fe98]
movdqu xmmword [rbp + 0x2f], xmm0
mov dword [rbp + 0x3f], 0x676e6972
mov word [rbp + 0x43], bx
call fcn.180004d80
test rax, rax
jne 0x180008327
mov rax, rbx
jmp 0x180008330
lea rdx, [rbp + 0x2f]
mov rcx, rax
call rdi
mov rcx, qword [rsi + 0x20]
mov rdx, qword [0x180050938]
add rcx, 0x60
call rax
movdqa xmm0, xmmword [0x180044c30]
mov ecx, 0x1007
mov rdi, qword [0x18004fe98]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x74636553
mov dword [rbp + 0x23], 0x6e6f69
mov byte [rbp + 0x27], bl
call fcn.180004d80
test rax, rax
jne 0x18000837a
mov rax, rbx
jmp 0x180008383
lea rdx, [rbp + 0xf]
mov rcx, rax
call rdi
mov rcx, qword [rsi + 0x38]
call rax
movdqa xmm0, xmmword [0x180044c00]
mov ecx, 0x1007
mov rdi, qword [0x18004fe98]
movdqu xmmword [rbp - 0x51], xmm0
mov dword [rbp - 0x41], 0x6f4d6465
mov dword [rbp - 0x3d], 0x656c7564
mov word [rbp - 0x39], 0x73
mov byte [rbp - 0x37], bl
call fcn.180004d80
test rax, rax
je 0x1800083cf
lea rdx, [rbp - 0x51]
mov rcx, rax
call rdi
mov rbx, rax
mov r8, rsi
lea rdx, [0x180007680]
xor ecx, ecx
call rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180011e00
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180008660
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x480
mov rax, qword [0x18004c178]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor ebx, ebx
cmp byte [0x18004fe80], bl
jne 0x1800086b2
mov byte [0x18004fe80], 1
lea rax, str.configdata_1
mov ecx, ebx
nop dword [rax]
xor word [rax], 0x17
lea rax, [rax + 2]
inc ecx
cmp ecx, 0x5dc
jb 0x1800086a0
xor edx, edx
lea rcx, [rsp + 0x260]
mov r8d, 0x208
call fcn.180015430
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.180015430
movdqa xmm0, xmmword [0x180044c50]
mov ecx, 0x1000
mov rdi, qword [0x18004fe98]
movdqu xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x48], 0x5765
call fcn.180004d80
test rax, rax
jne 0x18000870a
mov rax, rbx
jmp 0x180008714
lea rdx, [rsp + 0x38]
mov rcx, rax
call rdi
mov edi, 0x104
lea rdx, [rsp + 0x260]
mov r8d, edi
xor ecx, ecx
call rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test rax, rax
je 0x180008842
cmp dword [rsp + 0x30], 3
jl 0x180008842
mov rdx, qword [rax + 0x10]
lea rcx, [rsp + 0x50]
nop dword [rax]
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x180008785
movzx eax, word [rdx]
test ax, ax
je 0x180008785
mov word [rcx], ax
add rdx, 2
add rcx, 2
sub rdi, 1
jne 0x180008760
lea rax, [rcx - 2]
test rdi, rdi
cmovne rax, rcx
mov word [rax], bx
call fcn.1800052b0
cmp eax, 1
jne 0x1800087e5
mov qword [rsp + 0x28], rbx
lea ecx, [rax + 1]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov qword [0x180050930], rbx
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlCreateHeap]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [0x180050930], rax
lea edx, [r9 + 1]
call qword [sym.imp.ntdll.dll_RtlSetHeapInformation]
lea rcx, [rsp + 0x50]
call fcn.180006390
jmp 0x180008842
call fcn.180005040
mov edi, eax
call fcn.180005520
lea rdx, [0x180050512]
nop dword [rax + rax]
movzx ecx, word [rsp + rbx + 0x50]
mov word [rbx + rdx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x180008800
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], 0
jne 0x180008816
inc eax
mov dword [0x18004fef0], eax
call fcn.180005b20
test edi, edi
je 0x180008836
call fcn.180004f40
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.180006d70
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.180011e00
mov rbx, qword [rsp + 0x490]
add rsp, 0x480
pop rdi
ret
Function at 0x1800119b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x180011bc0
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov ecx, dword [0x18004c168]
cmp ecx, 0xffffffff
jne 0x180011be8
xor esi, esi
jmp 0x180011bf1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x180011ce3
nop
mov rbx, qword [rsi + 0x18]
cmp qword [rsi + 0x30], 0
jne 0x180011c16
test rbx, rbx
je 0x180011cbc
jmp 0x180011c20
test rbx, rbx
je 0x180011c74
nop dword [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x180011c57
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x180011c20
cmp qword [rsi + 0x30], 0
je 0x180011c00
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x180011c9f
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x180011c9f
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.180011490
cmp qword [rsi + 0x30], 0
jne 0x180011c80
jmp 0x180011c00
lea rdx, [0x180011450]
lea rcx, [0x18004ead0]
call fcn.180011060
mov ecx, dword [0x18004c168]
cmp ecx, 0xffffffff
je 0x180011ce3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x180011d14
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x180011d14
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180011bc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x180011bc0
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov ecx, dword [0x18004c168]
cmp ecx, 0xffffffff
jne 0x180011be8
xor esi, esi
jmp 0x180011bf1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov qword [rsp + 0x40], rsi
test rsi, rsi
je 0x180011ce3
nop
mov rbx, qword [rsi + 0x18]
cmp qword [rsi + 0x30], 0
jne 0x180011c16
test rbx, rbx
je 0x180011cbc
jmp 0x180011c20
test rbx, rbx
je 0x180011c74
nop dword [rax + rax]
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x180011c57
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rdi, qword [rbx]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
jne 0x180011c20
cmp qword [rsi + 0x30], 0
je 0x180011c00
nop dword [rax + rax]
mov rbx, qword [rsi + 0x28]
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x180011c9f
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x180011c9f
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r8, rbx
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.180011490
cmp qword [rsi + 0x30], 0
jne 0x180011c80
jmp 0x180011c00
lea rdx, [0x180011450]
lea rcx, [0x18004ead0]
call fcn.180011060
mov ecx, dword [0x18004c168]
cmp ecx, 0xffffffff
je 0x180011ce3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test rsi, rsi
je 0x180011d14
or eax, 0xffffffff
lock xadd dword [rsi + 8], eax
cmp eax, 1
jne 0x180011d14
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180002a20
Capabilities:
Connect to http server
Create http request

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor edi, edi
mov qword [rcx + 0x18], 0xf
mov qword [rcx], rdi
lea rdx, str.shiki.stringempty.xyz
mov rbx, rcx
mov qword [rcx + 0x10], rdi
mov byte [rcx], dil
lea r8d, [rdi + 0x15]
call fcn.180004ef0
xor r9d, r9d
mov dword [rbx + 0x20], 0x50
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
lea rcx, str.Dice.Driver
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rbx + 0x28], rax
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180002a82
mov rdx, qword [rbx]
movzx r8d, word [rbx + 0x20]
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov rcx, rax
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rbx + 0x30], rax
mov rax, rbx
mov qword [rbx + 0x38], rdi
mov byte [rbx + 0x40], dil
mov dword [rbx + 0x44], edi
mov qword [rbx + 0x48], rdi
mov byte [rbx + 0x48], dil
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], 0xf
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800063d0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800065b0
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180068988]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180068998]
lea rdx, [rdi + rdi]
call fcn.1800050d0
mov rcx, qword [0x180068988]
lea r9, [rdi - 1]
mov qword [0x1800689b0], r9
mov qword [0x1800689b8], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1800065a5
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180068998]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1800064eb
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180006566
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x180006528
mov r10, qword [rax]
cmp r10, rcx
je 0x180006522
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180006566
mov r8, rax
cmp r10, rax
je 0x180006542
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x18000657a
cmp r10, rax
jne 0x180006530
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1800065a0
mov r9, qword [0x1800689b0]
jmp 0x180006470
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x180006566
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.180027dc4
int3
Function at 0x1800065c0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800067a0
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800689c8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800689d8]
lea rdx, [rdi + rdi]
call fcn.1800050d0
mov rcx, qword [0x1800689c8]
lea r9, [rdi - 1]
mov qword [0x1800689f0], r9
mov qword [0x1800689f8], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180006795
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800689d8]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1800066db
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180006756
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x180006718
mov r10, qword [rax]
cmp r10, rcx
je 0x180006712
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180006756
mov r8, rax
cmp r10, rax
je 0x180006732
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x18000676a
cmp r10, rax
jne 0x180006720
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x180006790
mov r9, qword [0x1800689f0]
jmp 0x180006660
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x180006756
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.180027dc4
int3