joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800011a0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rbp, rdx
mov rbx, rcx
mov rcx, rbp
lea rdx, [rsp + 0x40]
mov esi, 1
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x1b0], rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800013ca
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x1b8]
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor edx, edx
mov rcx, rbp
call fcn.180001410
lea r8, [0x180000000]
nop dword [rax + rax]
xor r9d, r9d
mov edx, r9d
nop word [rax + rax]
movzx eax, byte [rsp + rdx + 0x6c]
movzx ecx, byte [rdx + r8 + 0x65460]
lea rdx, [rdx + 1]
cmp al, cl
jb 0x180001249
ja 0x180001249
test al, al
je 0x1800013a0
cmp al, cl
je 0x180001220
jmp 0x1800013a0
mov rdx, r9
nop dword [rax]
movzx eax, byte [rsp + rdx + 0x6c]
movzx ecx, byte [rdx + r8 + 0x65464]
lea rdx, [rdx + 1]
cmp al, cl
jb 0x180001279
ja 0x180001279
test al, al
je 0x1800013a0
cmp al, cl
je 0x180001250
jmp 0x1800013a0
mov rax, qword [rsp + 0x1b8]
mov byte [rax], r9b
test byte [rsp + 0x40], 0x10
je 0x18000135b
test byte [rbx + 0x10], 1
je 0x1800012c9
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1800012c9
xor r8d, r8d
mov qword [rsp + 0x20], r9
lea rdx, [rsp + 0x6c]
call fcn.180009590
test eax, eax
je 0x1800012c9
inc dword [rbx + 0x28]
lea r8, [rsp + 0x40]
mov rdx, rbp
mov rcx, rbx
call section..text
mov esi, eax
test esi, esi
je 0x180001395
test byte [rbx + 0x10], 4
je 0x180001395
xor r8d, r8d
lea rdx, [rsp + 0x6c]
mov rcx, rbp
call fcn.180001620
mov rcx, qword [rbx]
xor edx, edx
lea r8d, [rax + 3]
lea r9d, [rdx + 1]
call fcn.1800023f0
mov rdi, rax
test rax, rax
je 0x18000134f
mov r8, rax
lea rdx, [rsp + 0x6c]
mov rcx, rbp
call fcn.180001620
mov r8, rdi
lea rdx, [0x180065468]
mov rcx, rdi
call fcn.180001620
mov rdx, rdi
mov rcx, rbx
call fcn.1800011a0
mov rcx, qword [rbx]
mov r8d, 1
mov rdx, rdi
mov esi, eax
call fcn.1800026f0
mov rdi, qword [rsp + 0x1b0]
jmp 0x180001395
mov rdi, qword [rsp + 0x1b0]
xor esi, esi
jmp 0x180001395
test byte [rbx + 0x10], 2
je 0x180001395
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001395
xor r8d, r8d
mov qword [rsp + 0x20], r9
lea rdx, [rsp + 0x6c]
call fcn.180009590
test eax, eax
je 0x180001395
inc dword [rbx + 0x2c]
lea r8, [rsp + 0x40]
mov rdx, rbp
mov rcx, rbx
call section..text
mov esi, eax
mov rax, qword [rsp + 0x1b8]
mov byte [rax], 0x2a
test esi, esi
je 0x1800013c1
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
lea r8, [0x180000000]
test eax, eax
jne 0x180001210
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x180001740
Capabilities:
Create directory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov edi, 1
mov rax, rdx
test rdx, rdx
je 0x180001928
mov qword [rsp + 0x50], rbp
xor ebp, ebp
mov edx, ebp
cmp byte [rax], dl
je 0x180001919
lea rax, [rax + 1]
inc edx
cmp byte [rax], bpl
jne 0x180001770
test edx, edx
je 0x180001919
lea rax, [rdx + 1]
mov qword [rsp + 0x28], r14
mov ecx, 0xffffffff
mov qword [rsp + 0x20], r15
mov r15d, edx
cmp rax, rcx
ja 0x1800018f9
mov r9d, edi
mov r8d, eax
xor edx, edx
mov rcx, rsi
call fcn.1800023f0
mov r14, rax
test rax, rax
je 0x180001912
mov qword [rsp + 0x58], r12
mov rcx, rax
mov qword [rsp + 0x60], r13
nop dword [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800017d0
lea r12, [r15 + r14]
mov rdx, rbp
mov rbx, r14
lea r13, [0x180000000]
cmp rbx, r12
jae 0x18000186f
movsx r15, byte [rbx]
mov rax, r15
cmp r15d, 0x7c
ja case.0x180001818.3
movzx eax, byte [rax + r13 + 0x1944]
mov ecx, dword [r13 + rax*4 + 0x1934]
add rcx, r13
jmp rcx
test rdx, rdx
je 0x18000182d
lea rax, [r14 - 1]
cmp rdx, rax
jb 0x18000182d
mov rdx, rbp
jmp 0x180001864
mov edi, ebp
jmp 0x180001864
test rdx, rdx
je 0x180001858
xor edx, edx
mov byte [rbx], bpl
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x180001855
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne case.0x180001818.0
mov byte [rbx], r15b
mov rdx, rbp
jmp 0x180001864
test rdx, rdx
cmove rdx, rbx
inc rbx
test edi, edi
jne 0x1800017f2
jmp 0x18000186f
mov edi, ebp
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
test rsi, rsi
jne 0x1800018ab
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov r14, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov ebx, dword [rsi + 0x30]
and ebx, 1
je 0x1800018bb
mov ebp, dword [r14 - 8]
add r14, 0xfffffffffffffff8
mov rcx, qword [rsi + 0x28]
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebx, ebx
je 0x180001892
test byte [rsi + 0x30], 2
je 0x1800018dd
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add qword [rsi + 0x60], 0xfffffffffffffff8
mov eax, ebp
sub qword [rsi + 0x58], rax
test byte [rsi + 0x30], 2
je 0x180001892
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x180001892
test byte [rsi + 0x30], 4
je 0x180001912
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov ecx, 0xc0000017
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, ebp
jmp 0x180001894
mov eax, edi
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x180001b20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
mov eax, ebx
test rcx, rcx
je 0x180001b4b
cmp byte [rcx], al
sete al
test eax, eax
jne 0x180001b49
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov ecx, 1
cmovne ebx, ecx
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180001e20
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, r8d
cmp rcx, 0xffffffffffffffff
je 0x180001e58
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180001e58
cmp ebx, dword [rsp + 0x40]
jne 0x180001e58
mov eax, 1
add rsp, 0x30
pop rbx
ret
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x180001e80
Capabilities:
Allocate or change rwx memory
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r9
mov rbx, r8
mov rax, rdx
mov rdi, rcx
test rdx, rdx
je 0x180002000
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
je 0x180002000
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180001fef
mov rcx, qword [rsp + 0x40]
mov edx, 0xfffffffe
lea rax, [rcx - 1]
cmp rax, rdx
ja 0x180001fef
test ecx, ecx
je 0x180001fef
test rsi, rsi
je 0x180001f1d
mov dword [rsi], ecx
test rdi, rdi
je 0x180001f2f
mov r8, rcx
mov rcx, rdi
call fcn.1800024d0
jmp 0x180001f51
mov eax, 0xffffffff
cmp rcx, rax
ja 0x180001fe8
mov edx, ecx
mov r8d, 0x3000
xor ecx, ecx
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx], rax
mov rdx, rax
test rax, rax
je 0x180001fef
mov r8d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
call fcn.180001e20
test eax, eax
je 0x180001fc3
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x180001f9d
mov rax, qword [rsp + 0x68]
mov qword [rcx], rax
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x180001fae
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
test rdi, rdi
je 0x180001fd5
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.180002670
jmp 0x180001fef
mov rcx, qword [rbx]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x180001fef
mov qword [rbx], 0
mov rcx, qword [rsp + 0x68]
cmp rcx, 0xffffffffffffffff
je 0x180002000
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180002240
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov ebx, r9d
xor r8d, r8d
lea r9, [rsp + 0x30]
mov rdi, rdx
lea edx, [r8 + 4]
call fcn.180001d30
test eax, eax
je 0x18000232d
test rdi, rdi
je 0x18000229c
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x18000232d
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x18000231c
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x18000232d
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18000231c
cmp ebx, dword [rsp + 0x78]
jne 0x18000231c
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1800022f6
mov rax, qword [rsp + 0x30]
mov qword [rcx], rax
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x180002307
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rsp + 0x30]
cmp rcx, 0xffffffffffffffff
je 0x18000232d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180002ab0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x80
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x180002bab
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, dword [rsp + 0x54]
xor edx, edx
mov rax, rbx
div r8
lea ecx, [r8 - 1]
mov eax, r8d
not rcx
and rdi, rcx
sub eax, edx
je 0x180002b05
cmp eax, r8d
je 0x180002b05
add rbx, rax
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180002bab
mov r8, qword [rsp + 0x20]
mov rax, r8
sub rax, rdi
add rax, rbx
cmp rax, 0x7fffffff
jg 0x180002bab
cmp rax, 0xffffffff80000000
jl 0x180002bab
cmp dword [rsp + 0x40], 0x10000
jne 0x180002b89
mov ecx, dword [rsp + 0x78]
xor edx, edx
mov rax, r8
div rcx
sub rcx, rdx
mov rdx, qword [rsp + 0x38]
add rcx, r8
add rdx, r8
lea rax, [rcx + rbx]
cmp rax, rdx
ja 0x180002b89
mov r9d, esi
mov r8d, 0x3000
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x180002bad
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x20]
add rcx, r8
mov r8d, 0x30
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002b22
xor eax, eax
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180005a60
Capabilities:
Allocate or change rwx memory
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
cmp dword [rsp + 0x70], 0
mov rsi, r8
mov ebx, r9d
mov rdi, rcx
mov r14d, edx
je 0x180005aa2
mov edx, ebx
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180005b0b
cmp rdi, 0xffffffffffffffff
je 0x180005b0b
mov rdx, r14
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x180005b0b
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], 0
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180005b0b
cmp ebx, dword [rsp + 0x34]
jne 0x180005b0b
cmp dword [rsp + 0x70], 0
jne 0x180005af3
mov eax, 1
jmp 0x180005b0d
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180005b0d
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x1800064a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x38
movabs rax, 0xb5026f5aa96619e9
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
mov r9, rcx
mov eax, dword [rcx]
cmp eax, 0x138
jl 0x1800065ad
cmp eax, 0x139
jne 0x1800064d8
call fcn.180006630
lea r8, [rcx + 8]
mov r10d, 0x9c
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 + 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 8]
mov rax, rdx
shr rdx, 1
and eax, 1
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, rdx
xor rcx, qword [r8 + 0x4d8]
mov qword [r8 - 8], rcx
sub r10, 1
jne 0x1800064f0
lea r8, [r9 + 0x4e8]
mov r10d, 0x9b
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 + 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 8]
mov rax, rdx
shr rdx, 1
and eax, 1
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, rdx
xor rcx, qword [r8 - 0x4e8]
mov qword [r8 - 8], rcx
sub r10, 1
jne 0x180006540
mov edx, dword [r9 + 0x9c0]
xor edx, dword [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 + 0x9c0]
mov rax, rdx
shr rdx, 1
and eax, 1
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, rdx
xor rcx, qword [r9 + 0x4e0]
mov qword [r9 + 0x9c0], rcx
mov dword [r9], r10d
movsxd rcx, dword [r9]
mov rdx, qword [r9 + rcx*8 + 8]
lea eax, [rcx + 1]
mov dword [r9], eax
movabs rcx, 0x555555555
mov rax, rdx
shr rax, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 0x38
ret

Function at 0x180006630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
movabs r10, 0x5851f42d4c957f2d
mov qword [rsp + 0x10], 0x1571
mov qword [rcx + 8], 0x1571
mov dword [rcx], 1
nop word [rax + rax]
movsxd r8, dword [rcx]
lea eax, [r8 - 1]
movsxd rdx, eax
mov rax, qword [rcx + rdx*8 + 8]
mov rdx, rax
shr rdx, 0x3e
xor rdx, rax
imul rdx, r10
add rdx, r8
mov qword [rcx + r8*8 + 8], rdx
inc dword [rcx]
cmp dword [rcx], 0x138
jl 0x180006660
ret
Function at 0x180006690
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x20]
mov rbx, rcx
mov byte [rax + rcx + 0x24], 0x80
inc dword [rcx + 0x20]
mov ecx, dword [rcx + 0x20]
cmp ecx, 0x38
jbe 0x1800066cd
mov eax, ecx
mov r8d, 0x40
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.180048fb0
mov rcx, rbx
call fcn.180006750
mov ecx, dword [rbx + 0x20]
cmp ecx, 0x38
jae 0x1800066ee
mov eax, ecx
mov r8d, 0x38
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.180048fb0
movzx eax, byte [rbx + 0x1f]
mov rcx, rbx
mov byte [rbx + 0x5c], al
movzx eax, byte [rbx + 0x1e]
mov byte [rbx + 0x5d], al
mov rax, qword [rbx + 0x18]
shr rax, 0x28
mov byte [rbx + 0x5e], al
mov rax, qword [rbx + 0x18]
shr rax, 0x20
mov byte [rbx + 0x5f], al
mov eax, dword [rbx + 0x18]
shr rax, 0x18
mov byte [rbx + 0x60], al
mov eax, dword [rbx + 0x18]
shr rax, 0x10
mov byte [rbx + 0x61], al
mov eax, dword [rbx + 0x18]
shr rax, 8
mov byte [rbx + 0x62], al
movzx eax, byte [rbx + 0x18]
mov byte [rbx + 0x63], al
add rsp, 0x20
pop rbx
jmp fcn.180006750
Function at 0x180006750
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r10, rcx
lea rbx, [rsp]
xor r11d, r11d
nop dword [rax]
lea r8d, [r11*4]
inc r11d
movzx r9d, byte [r8 + rcx + 0x24]
lea eax, [r8 + 1]
movzx eax, byte [rax + rcx + 0x24]
lea rbx, [rbx + 4]
shl r9d, 8
or r9d, eax
lea eax, [r8 + 2]
shl r9d, 8
movzx eax, byte [rax + rcx + 0x24]
or r9d, eax
lea eax, [r8 + 3]
shl r9d, 8
movzx eax, byte [rax + rcx + 0x24]
or r9d, eax
mov dword [rbx - 4], r9d
cmp r11d, 0x10
jb 0x180006780
lea rdx, [rsp + 0x40]
mov r8d, 0x40
lea rax, [rsp + 8]
nop
mov ecx, dword [rax + 0x2c]
lea rdx, [rdx + 4]
xor ecx, dword [rax + 0x18]
xor ecx, dword [rax - 8]
xor ecx, dword [rax]
lea rax, [rax + 4]
rol ecx, 1
mov dword [rdx - 4], ecx
sub r8, 1
jne 0x1800067e0
mov r12d, dword [r10]
lea rbp, [rsp]
mov r13d, dword [r10 + 4]
mov r14d, 0x14
mov r9d, dword [r10 + 8]
mov r15d, r14d
mov ebx, dword [r10 + 0xc]
mov edi, r12d
mov esi, dword [r10 + 0x10]
mov r11d, r13d
nop dword [rax]
nop dword [rax + rax]
mov eax, r9d
lea r8d, [rsi + 0x5a827999]
and eax, r11d
lea rbp, [rbp + 4]
mov ecx, r11d
mov edx, edi
rol edx, 5
not ecx
and ecx, ebx
mov esi, ebx
or ecx, eax
mov ebx, r9d
add edx, ecx
mov r9d, r11d
add edx, dword [rbp - 4]
mov r11d, edi
add r8d, edx
ror r9d, 2
mov edi, r8d
sub r15, 1
jne 0x180006830
lea rdx, [rsp + 0x50]
mov rbp, r14
nop word [rax + rax]
rol r8d, 5
lea rdx, [rdx + 4]
mov ecx, ebx
xor ecx, r9d
xor ecx, r11d
lea eax, [rsi + r8]
mov r8d, dword [rdx - 4]
add r8d, 0x6ed9eba1
add ecx, eax
add r8d, ecx
mov esi, ebx
mov ebx, r9d
mov r9d, r11d
ror r9d, 2
mov r11d, edi
mov edi, r8d
sub rbp, 1
jne 0x180006880
lea rdx, [rsp + 0xa0]
mov rbp, r14
nop word [rax + rax]
mov ecx, r9d
rol r8d, 5
or ecx, r11d
lea rdx, [rdx + 4]
and ecx, ebx
mov eax, r9d
add esi, 0x8f1bbcdc
and eax, r11d
add r8d, esi
or ecx, eax
add ecx, dword [rdx - 4]
mov esi, ebx
mov ebx, r9d
add r8d, ecx
mov r9d, r11d
mov r11d, edi
ror r9d, 2
mov edi, r8d
sub rbp, 1
jne 0x1800068d0
lea rcx, [rsp + 0xf0]
nop word [rax + rax]
rol r8d, 5
lea rcx, [rcx + 4]
add esi, 0xca62c1d6
mov eax, ebx
xor eax, r9d
add r8d, esi
xor eax, r11d
mov esi, ebx
add eax, dword [rcx - 4]
mov ebx, r9d
mov r9d, r11d
add r8d, eax
ror r9d, 2
mov r11d, edi
mov edi, r8d
sub r14, 1
jne 0x180006920
add dword [r10 + 0xc], ebx
lea eax, [r12 + r8]
add dword [r10 + 8], r9d
add dword [r10 + 0x10], esi
mov dword [r10], eax
lea eax, [r11 + r13]
lea r11, [rsp + 0x140]
mov dword [r10 + 4], eax
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r10 + 0x20], r14d
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180007280
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov r11d, r8d
mov rdi, rdx
mov rsi, rcx
mov ebx, ebp
mov rax, rdx
test rdx, rdx
je 0x1800074ad
movzx r9d, byte [rdx]
mov r10d, ebp
test r9b, r9b
je 0x1800074ad
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x1800072c3
test r10d, r10d
je 0x1800074ad
mov rcx, rdi
mov r8d, 0x811c9dc5
lea eax, [r9 - 0x41]
cmp al, 0x19
movsx eax, r9b
ja 0x1800072ef
add eax, 0x20
movzx r9d, byte [rcx + 1]
inc rcx
movzx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
test r9b, r9b
jne 0x1800072e0
mov eax, 0xba2e8ba3
mul r8d
shr edx, 3
imul eax, edx, 0xb
sub r8d, eax
lea r14, [r8 + r8*2]
add r14, r14
mov rax, qword [rsi + r14*8 + 0x48]
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x180007391
nop
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x180007385
cmp rdi, r8
je 0x1800074ad
mov r9, rdi
sub r9, r8
nop dword [rax + rax]
movzx eax, byte [r9 + r8]
movzx edx, byte [r8]
lea r8, [r8 + 1]
cmp al, dl
je 0x18000737c
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x18000736b
add al, 0xe0
lea ecx, [rdx - 0x61]
cmp cl, 0x19
ja 0x180007376
add dl, 0xe0
cmp al, dl
jb 0x180007385
ja 0x180007385
test al, al
jne 0x180007350
jmp 0x1800074ad
mov rax, qword [rbx]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180007330
test r11d, r11d
je 0x1800074ad
mov rcx, qword [rsi]
xor edx, edx
mov r8d, 0x25c0
lea r9d, [rdx + 1]
call fcn.1800023f0
mov rbx, rax
test rax, rax
je 0x1800074ad
mov edx, ebp
mov rax, rdi
cmp byte [rdi], dl
je 0x1800073ce
lea rax, [rax + 1]
inc edx
cmp byte [rax], bpl
jne 0x1800073c3
mov rcx, qword [rsi]
lea eax, [rdx + 1]
mov r8d, eax
mov rdx, rdi
mov r9d, eax
call fcn.180002540
mov qword [rbx + 0x38], rax
test rax, rax
je 0x180007499
mov qword [rbx], rbp
lea rcx, [rbx + 0x40]
mov qword [rbx + 8], rbp
lea r8, [rbx + 0x18]
mov qword [rbx + 0x10], rbx
lea rax, [rcx + 0x18]
mov qword [r8], rbp
mov edx, 0xc7
mov qword [r8 + 8], rbp
mov qword [r8 + 0x10], rbx
mov qword [rbx + 0x30], rsi
mov qword [rcx], rax
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x20], rcx
mov qword [rcx + 0x28], rbp
lea rcx, [rbx + 0x70]
mov qword [rax], rbp
nop dword [rax]
nop dword [rax + rax]
lea rax, [rcx + 0x18]
mov qword [rcx + 8], rbp
mov qword [rcx], rax
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x20], rcx
mov qword [rcx + 0x28], rbp
add rcx, 0x30
mov qword [rax], rbp
add edx, 0xffffffff
jne 0x180007440
mov rcx, qword [rsi + r14*8 + 0x68]
mov rax, qword [rcx]
mov qword [rax + 8], rbx
mov rax, qword [rcx]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov rcx, qword [rsi + 0x38]
mov rax, qword [rcx]
mov qword [rax + 8], r8
mov rax, qword [rcx]
mov qword [r8], rax
mov qword [r8 + 8], rcx
mov qword [rcx], r8
inc dword [rsi + 8]
jmp 0x1800074ad
mov rcx, qword [rsi]
mov r8d, 1
mov rdx, rbx
call fcn.1800026f0
mov rbx, rbp
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800074d0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov r11d, r8d
mov rdi, rdx
mov rbp, rcx
mov ebx, r15d
mov rax, rdx
test rdx, rdx
je 0x1800076a9
movzx r9d, byte [rdx]
mov r10d, r15d
test r9b, r9b
je 0x1800076a9
lea rax, [rax + 1]
inc r10d
cmp byte [rax], bl
jne 0x180007513
test r10d, r10d
je 0x1800076a9
mov rsi, qword [rcx + 0x30]
mov r8d, 0x811c9dc5
mov rcx, rdi
lea eax, [r9 - 0x41]
cmp al, 0x19
movsx eax, r9b
ja 0x180007543
add eax, 0x20
movzx r9d, byte [rcx + 1]
inc rcx
movzx eax, al
xor eax, r8d
imul r8d, eax, 0x1000193
test r9b, r9b
jne 0x180007534
mov eax, 0x5254e78f
mul r8d
shr edx, 6
imul eax, edx, 0xc7
sub r8d, eax
lea r14, [r8 + r8*2]
add r14, r14
mov rax, qword [rbp + r14*8 + 0x70]
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x1800075e1
mov r8, qword [rbx + 0x38]
test r8, r8
je 0x1800075d5
cmp rdi, r8
je 0x1800076a9
mov r9, rdi
sub r9, r8
nop
movzx eax, byte [r9 + r8]
movzx edx, byte [r8]
lea r8, [r8 + 1]
cmp al, dl
je 0x1800075cc
lea ecx, [rax - 0x61]
cmp cl, 0x19
ja 0x1800075bb
add al, 0xe0
lea ecx, [rdx - 0x61]
cmp cl, 0x19
ja 0x1800075c6
add dl, 0xe0
cmp al, dl
jb 0x1800075d5
ja 0x1800075d5
test al, al
jne 0x1800075a0
jmp 0x1800076a9
mov rax, qword [rbx]
mov rbx, qword [rax + 0x10]
test rbx, rbx
jne 0x180007586
test r11d, r11d
je 0x1800076a9
mov rcx, qword [rsi]
xor edx, edx
lea r9d, [rdx + 1]
lea r8d, [rdx + 0x48]
call fcn.1800023f0
mov rbx, rax
test rax, rax
je 0x1800076a9
mov edx, r15d
mov rax, rdi
cmp byte [rdi], dl
je 0x18000761d
lea rax, [rax + 1]
inc edx
cmp byte [rax], r15b
jne 0x180007612
mov rcx, qword [rsi]
lea eax, [rdx + 1]
mov r8d, eax
mov rdx, rdi
mov r9d, eax
call fcn.180002540
mov qword [rbx + 0x38], rax
test rax, rax
je 0x180007695
mov qword [rbx], r15
lea rdx, [rbx + 0x18]
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], rbx
mov qword [rdx], r15
mov qword [rdx + 8], r15
mov qword [rdx + 0x10], rbx
mov qword [rbx + 0x30], rbp
mov qword [rbx + 0x40], r15
mov rcx, qword [rbp + r14*8 + 0x90]
mov rax, qword [rcx]
mov qword [rax + 8], rbx
mov rax, qword [rcx]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov rcx, qword [rbp + 0x60]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
mov rax, qword [rcx]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov qword [rcx], rdx
inc dword [rsi + 8]
jmp 0x1800076a9
mov rcx, qword [rsi]
mov r8d, 1
mov rdx, rbx
call fcn.1800026f0
mov rbx, r15
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret