joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802c7050
Capabilities:
Hash data using tiger

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x1804b8c99]
call fcn.1801a9330
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
mov rax, qword [rax]
xor rax, rcx
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
shr rax, 0
movzx eax, al
lea rcx, [0x1803f33e0]
lea rdx, [0x1803f33e0]
mov r8, qword [rsp + 0x20]
shr r8, 0x10
movzx r8d, r8b
mov rdx, qword [rdx + r8*8 + 0x800]
mov rax, qword [rcx + rax*8]
xor rax, rdx
lea rcx, [0x1803f33e0]
mov rdx, qword [rsp + 0x20]
shr rdx, 0x20
movzx edx, dl
xor rax, qword [rcx + rdx*8 + 0x1000]
lea rcx, [0x1803f33e0]
mov rdx, qword [rsp + 0x20]
shr rdx, 0x30
movzx edx, dl
xor rax, qword [rcx + rdx*8 + 0x1800]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
lea rax, [0x1803f33e0]
mov rcx, qword [rsp + 0x20]
shr rcx, 8
movzx ecx, cl
lea rdx, [0x1803f33e0]
mov r8, qword [rsp + 0x20]
shr r8, 0x18
movzx r8d, r8b
mov rdx, qword [rdx + r8*8 + 0x1000]
mov rax, qword [rax + rcx*8 + 0x1800]
xor rax, rdx
lea rcx, [0x1803f33e0]
mov rdx, qword [rsp + 0x20]
shr rdx, 0x28
movzx edx, dl
xor rax, qword [rcx + rdx*8 + 0x800]
mov rcx, qword [rsp + 0x20]
shr rcx, 0x38
movzx ecx, cl
lea rdx, [0x1803f33e0]
xor rax, qword [rdx + rcx*8]
mov rcx, qword [rsp + 0x48]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 5
je 0x1802c71c4
cmp dword [rsp + 0x28], 7
je 0x1802c71dc
cmp dword [rsp + 0x28], 9
je 0x1802c71f4
jmp 0x1802c720a
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
lea rax, [rax + rcx*4]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
jmp 0x1802c720a
mov rax, qword [rsp + 0x20]
shl rax, 3
sub rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
jmp 0x1802c720a
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x20]
lea rax, [rax + rcx*8]
mov rcx, qword [rsp + 0x48]
mov qword [rcx], rax
add rsp, 0x30
pop rdi
ret
Function at 0x1802d60b0
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x30]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
lea rcx, [0x1804b9528]
call fcn.1801a9330
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0xf0000020
mov r9d, 1
lea r8, [0x180464ad0]
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1802d613e
mov dword [rsp + 0x20], 0xf0000028
mov r9d, 1
lea r8, [0x180464b00]
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1802d613e
xor eax, eax
jmp 0x1802d617b
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp eax, 1
jne 0x1802d616c
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [rsp + 0x68]
jmp 0x1802d617b
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180404e00]
call fcn.1801a9100
mov rax, rdi
add rsp, 0x50
pop rdi
ret
Function at 0x1802db700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
lea rcx, [0x1804b9963]
call fcn.1801a9330
cmp dword [rsp + 0x60], 0
je 0x1802db8ea
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x68]
mov ecx, dword [rcx + 4]
cmp dword [rax + 8], ecx
jne 0x1802db888
mov rax, qword [rsp + 0x68]
cmp dword [rax + 0xc], 0
jne 0x1802db7b0
mov dword [rsp + 0x20], 0
jmp 0x1802db765
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x10]
cmp dword [rsp + 0x20], eax
jge 0x1802db7ae
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax + 0x14]
inc eax
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x68]
mov byte [rdx + rcx + 0x14], al
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax + 0x14]
test eax, eax
je 0x1802db7ac
jmp 0x1802db7ae
jmp 0x1802db75b
jmp 0x1802db813
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 4]
dec eax
mov dword [rsp + 0x20], eax
jmp 0x1802db7ca
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 0x10]
cmp dword [rsp + 0x20], eax
jl 0x1802db813
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax + 0x14]
inc eax
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x68]
mov byte [rdx + rcx + 0x14], al
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
movzx eax, byte [rcx + rax + 0x14]
test eax, eax
je 0x1802db811
jmp 0x1802db813
jmp 0x1802db7c0
mov rax, qword [rsp + 0x68]
add rax, 0x138
mov rcx, qword [rsp + 0x68]
add rcx, 0xa4
mov rdx, qword [rsp + 0x68]
add rdx, 0x14
mov qword [rsp + 0x28], rdx
mov r8, qword [rsp + 0x68]
movsxd r8, dword [r8]
imul r8, r8, 0xc0
mov qword [rsp + 0x30], r8
lea r9, [0x18047bec0]
mov r8, rax
mov rdx, rcx
mov rax, qword [rsp + 0x28]
mov rcx, rax
mov rax, qword [rsp + 0x30]
call qword [r9 + rax + 0x28]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x1802db87c
mov eax, dword [rsp + 0x24]
jmp 0x1802db8ec
mov rax, qword [rsp + 0x68]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0x68]
movsxd rcx, dword [rcx + 8]
mov rdx, qword [rsp + 0x68]
movzx ecx, byte [rdx + rcx + 0xa4]
xor eax, ecx
mov rcx, qword [rsp + 0x58]
mov byte [rcx], al
mov rax, qword [rsp + 0x58]
inc rax
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax + 8]
inc eax
mov rcx, qword [rsp + 0x68]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x60]
dec eax
mov dword [rsp + 0x60], eax
jmp 0x1802db725
xor eax, eax
add rsp, 0x40
pop rdi
ret
Function at 0x1802ed6d0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x80
lea rdi, [rsp + 0x20]
mov ecx, 0x18
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x90]
mov rax, qword [0x18045c280]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [0x1804ba79e]
call fcn.1801a9330
mov dword [rsp + 0x20], 0
xor edx, edx
mov ecx, 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
je 0x1802ed92e
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1802ed923
mov dword [rsp + 0x20], 1
mov eax, dword [rsp + 0x38]
cmp rax, 0x10
jb 0x1802ed8ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x44], eax
jne 0x1802ed8ac
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x40], eax
je 0x1802ed8ac
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
jne 0x1802ed7f4
mov rax, qword [rsp + 0x90]
mov dword [rax + 8], 0x80
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x18047f3e8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
jne 0x1802ed7ef
mov dword [rsp + 0x20], 0
jmp 0x1802ed8cb
jmp 0x1802ed877
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x1802ed877
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 8], eax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 8]
shl rax, 2
mov r9, rax
mov rax, qword [rsp + 0x90]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18047f3e8]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0
jne 0x1802ed867
mov dword [rsp + 0x20], 0
jmp 0x1802ed8cb
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x68]
mov qword [rax], rcx
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx]
mov edx, dword [rsp + 0x40]
mov dword [rcx + rax*4], edx
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rsp + 0x90]
mov dword [rcx + 0xc], eax
mov dword [rsp + 0x38], 0x1c
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1802ed75d
cmp dword [rsp + 0x20], 0
je 0x1802ed8e5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1802ed8e5
mov dword [rsp + 0x20], 0
cmp dword [rsp + 0x20], 0
jne 0x1802ed923
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
je 0x1802ed923
mov rax, qword [rsp + 0x90]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18047f3e8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x90]
mov qword [rax], 0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov edi, eax
mov rcx, rsp
lea rdx, [0x180409190]
call fcn.1801a9100
mov eax, edi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1801a9570
add rsp, 0x80
pop rdi
ret
Function at 0x1802ed970
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x1804ba79e]
call fcn.1801a9330
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x40]
mov qword [rax], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 8], 0
mov rax, qword [rsp + 0x40]
mov dword [rax + 0xc], 0
mov rcx, qword [rsp + 0x40]
call fcn.1802ed6d0
test eax, eax
jne 0x1802ed9d6
mov dword [rsp + 0x20], 9
jmp 0x1802eda58
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1802eda58
mov dword [rsp + 0x24], 0
jmp 0x1802ed9f5
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x24], eax
jae 0x1802eda58
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1802eda56
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rsp + 0x50]
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
call fcn.1802ed4a0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1802ed9eb
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret

Function at 0x1802eda70
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x1804ba79e]
call fcn.1801a9330
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
je 0x1802edb0c
mov dword [rsp + 0x20], 0
jmp 0x1802edaa5
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0xc]
cmp dword [rsp + 0x20], eax
jae 0x1802edaf5
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1802edaf3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1802eda9b
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x18047f3e8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rsp, 0x30
pop rdi
ret
Function at 0x1802edb20
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_sendto
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x80]
lea rcx, [0x1804ba79e]
call fcn.1801a9330
mov eax, dword [rsp + 0x80]
imul rax, rax, 0x38
mov rcx, qword [0x18047f420]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], 5
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1802edbb2
mov rax, qword [rsp + 0x50]
sub rax, 5
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
add rax, 2
mov qword [rsp + 0x48], rax
lea r9, [rsp + 0x34]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1802edbdb
mov eax, 0xa
jmp 0x1802edd15
cmp dword [rsp + 0x88], 0
je 0x1802edc49
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov byte [rax], 0xe9
mov rax, qword [rsp + 0x50]
add rax, 5
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov dword [rcx + 1], eax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1802edc47
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov byte [rax], 0xeb
mov rax, qword [rsp + 0x60]
mov byte [rax + 1], 0xf9
jmp 0x1802edc95
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1802edc79
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.1801ace30
jmp 0x1802edc95
mov rax, qword [rsp + 0x20]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.1801ace30
lea r9, [rsp + 0x34]
mov r8d, dword [rsp + 0x34]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 1
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
movzx eax, byte [rsp + 0x88]
and al, 1
shl al, 2
mov rcx, qword [rsp + 0x20]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rsp + 0x20]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1804091f0]
call fcn.1801a9100
mov rax, rdi
add rsp, 0x70
pop rdi
ret
Function at 0x1802ef2a0
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x1804ba8f2]
call fcn.1801a9330
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x1802ef306
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x1802ef306
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x1802ef306
xor eax, eax
jmp 0x1802ef352
mov dword [rsp + 0x20], 1
jmp 0x1802ef31a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x48]
cmp dword [rsp + 0x20], eax
jae 0x1802ef34d
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x40]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x1802ef34b
xor eax, eax
jmp 0x1802ef352
jmp 0x1802ef310
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x1802f2c40
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x1804ba9b2]
call fcn.1801a9330
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x50]
mov eax, dword [rax]
xor eax, ecx
and eax, 0xff
cdqe
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx]
shr ecx, 8
mov rdx, qword [rsp + 0x48]
mov eax, dword [rdx + rax*4]
xor eax, ecx
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
and eax, 0xff
mov rcx, qword [rsp + 0x40]
add eax, dword [rcx + 4]
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x40]
imul eax, dword [rax + 4], 0x8088405
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 4]
shr eax, 0x18
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x20]
mov eax, dword [rax + 8]
xor eax, ecx
and eax, 0xff
cdqe
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx + 8]
shr ecx, 8
mov rdx, qword [rsp + 0x48]
mov eax, dword [rdx + rax*4]
xor eax, ecx
mov rcx, qword [rsp + 0x40]
mov dword [rcx + 8], eax
mov eax, dword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1802fe170
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
lea rcx, [0x1804ba9fd]
call fcn.1801a9330
mov rax, qword [rsp + 0x30]
lea rcx, [0x18040aa00]
mov qword [rax + 0x60], rcx
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x70], 9
mov rax, qword [rsp + 0x30]
lea rcx, [0x18040b200]
mov qword [rax + 0x68], rcx
mov rax, qword [rsp + 0x30]
mov dword [rax + 0x74], 5
add rsp, 0x20
pop rdi
ret
Function at 0x1803064a0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
lea rcx, [0x1804baa39]
call fcn.1801a9330
lea rax, [0x18040b550]
add rsp, 0x20
pop rdi
ret

Function at 0x180306610
Capabilities:
Encrypt data using rc4 prga
Hash data with crc32

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
lea rcx, [0x1804baa39]
call fcn.1801a9330
mov dword [rsp + 0x20], 0
jmp 0x180306639
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 4
jge 0x180306663
mov eax, dword [rsp + 0x40]
shr eax, 8
mov ecx, dword [rsp + 0x40]
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x18040b550]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x40], eax
jmp 0x18030662f
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180306680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x30
lea rcx, [0x1804baa39]
call fcn.1801a9330
mov dword [rsp + 0x20], 0
jmp 0x1803066a9
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 4
jge 0x1803066d6
mov eax, dword [rsp + 0x40]
shl eax, 8
mov ecx, dword [rsp + 0x40]
shr ecx, 0x18
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x18040b950]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x40], eax
jmp 0x18030669f
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18031bba0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x30]
mov ecx, 8
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
lea rcx, [0x1804bb2d2]
call fcn.1801a9330
cmp qword [0x18047f408], 0
jne 0x18031bc43
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0xf0000020
mov r9d, 1
lea r8, [0x180470f40]
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18031bc37
mov dword [rsp + 0x20], 0xf0000028
mov r9d, 1
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18031bc37
mov eax, 0xffffffff
jmp 0x18031bc74
mov rax, qword [rsp + 0x38]
mov qword [0x18047f408], rax
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
mov rcx, qword [0x18047f408]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
cmp eax, 1
jne 0x18031bc68
mov dword [rsp + 0x44], 0
jmp 0x18031bc70
mov dword [rsp + 0x44], 0xffffffff
mov eax, dword [rsp + 0x44]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x180411900]
call fcn.1801a9100
mov rax, rdi
add rsp, 0x50
pop rdi
ret
Function at 0x14000631c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140010960], rbx
je 0x140006383
cmp rax, rbx
jne 0x140006376
mov ebx, 1
mov esi, ebx
jmp 0x140006388
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000635b
mov ebx, 1
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x1400063a0
mov edi, 0x1f
mov ecx, edi
call fcn.1401b0000
jmp 0x14000640c
mov eax, dword [0x140010968]
test eax, eax
jne 0x140006401
mov dword [0x140010968], ebx
lea r15, [0x1400089c8]
lea rdi, [0x1400089b0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400063f3
test eax, eax
jne 0x1400063f7
cmp qword [rdi], r14
je 0x1400063e8
mov rax, qword [rdi]
mov rcx, qword [0x140008930]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400063ca
test eax, eax
je 0x140006407
mov eax, 0xff
jmp 0x140006562
mov dword [0x14000e3e4], ebx
mov edi, 0x1f
mov eax, dword [0x140010968]
cmp eax, ebx
jne 0x140006433
lea rdx, [0x1400089a8]
lea rcx, [0x140008938]
call sub.msvcrt.dll__initterm
mov dword [0x140010968], 2
test esi, esi
jne 0x140006441
mov rax, r14
xchg qword [0x140010960], rax
cmp qword [0x140010970], r14
je 0x140006474
lea rcx, [0x140010970]
call fcn.140006730
test eax, eax
je 0x140006474
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140010970]
mov r9, qword [0x140008930]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000648d
mov eax, 0xff
jmp 0x140006562
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140006513
test ax, ax
je 0x1400064a8
test edx, edx
jne 0x140006513
sub ax, bx
cmp ax, di
ja 0x1400064be
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400064a8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001394
mov dword [0x14000e3e0], eax
cmp dword [0x14000e400], r14d
jne 0x1400064fc
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000e3e4], r14d
jne 0x140006511
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000e3e0]
jmp 0x140006562
cmp ax, 0x22
jne 0x140006527
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140006496
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400067b0
add rsp, 0x28
jmp 0x14000631c