joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a33d0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x1400a3578
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x1400a3435
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x1400a3435
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x1400a3435
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x1400a346c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x1400a34c2
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400a34c2
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400a34c2
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400a34c2
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x1400a34c2
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1400a2e80
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400a3524
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14007f230
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.1400a3250
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1400a3570
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14007f230
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400a4ce0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140125080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x1400a4d75
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400a4dd6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.14007f230
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400b8800
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400a4e91
sub ecx, 1
je 0x1400a4f04
sub ecx, 1
je 0x1400a4e40
cmp ecx, 1
je 0x1400a4e23
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x14010c5c4]
call fcn.14007f230
jmp 0x1400a4f04
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.1400a4a10
test eax, eax
je 0x1400a4f04
jmp 0x1400a4daa
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400a4f04
sub rax, rsi
cmp rax, rbp
jae 0x1400a4f04
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.14007f3b0
jmp 0x1400a4f04
cmp r8d, 4
jle 0x1400a4f04
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x1400a4f04
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14007f150
mov esi, eax
test eax, eax
je 0x1400a4ee3
mov edx, 5
mov rcx, rbx
call fcn.1400a59d0
mov eax, esi
jmp 0x1400a4daa
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14008dc30
mov rcx, r14
call fcn.14008df10
test eax, eax
je 0x1400a4da8
mov edx, 5
mov rcx, rbx
call fcn.1400a59d0
mov eax, Ordinal_46
jmp 0x1400a4daa
Function at 0x1400b7ca0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400b7ce2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400b7d29
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400b7d82
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
sub rbp, 1
jne 0x1400b7d40
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400b7dc3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400cc522]
mov r8d, 1
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400cc523]
mov r8d, 1
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400b7d90
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400b7ddc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400b7e16
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400b7e1b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400b7e64
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400b7e64
dec r8
sub rdx, 1
jne 0x1400b7e4a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400b9884
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b98ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b98ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b98ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b98ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b98ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b98d0
xor al, al
add rsp, 0x28
ret
Function at 0x1806c29ad
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
inc r8d
mov qword [rsp + rcx - 0x372fb6b7], 0xffffffff85330103
div ebx
mov qword [rsp + rcx - 0x372fb6af], r10
lea r10, [r9 - 0x4bcb4c67]
xor dword [rsp + rcx*2 - 0x6e5f6d66], r8d
shl cl, 0x65
mov r10, qword [rsp + rax - 0x5d3c1703]
movsxd r8, r8d
mov edi, edx
adc dx, bx
add r11, r8
mov rsi, qword [rsi + rcx - 0x372fb6d8]
or word [rsp + rcx - 0x372fb6dd], bx
pop rdi
pop rdx
jl fcn.1806c4df4

Function at 0x1806ce685
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
call fcn.1807116d6
sub rbp, 4
mov edx, 0xcda624b7
movsx ebx, dl
mov ecx, dword [rbp + riz]
xor ecx, r10d
movzx eax, bx
xor ecx, 0xab1f10bc
rol ecx, 1
bt rbx, rbx
movzx r9d, ax
shl ax, 0x24
dec ecx
sub r9d, r9d
cwde
bswap ecx
lea rdi, [rbx - 0x7bfefbd5]
jnp 0x18070e4a2
btr dx, ax
push r10
mul r9b
movzx r10d, bx
movsx r8d, bl
xor dword [rsp + r9], ecx
pop r10
add dl, dh
inc r9d
sub r8w, r9w
movsxd rcx, ecx
adc r11, rcx
or bl, r8b
neg edx
and r8d, r9d
mov esi, dword [rsi + rdx*2 - 0x64b3b64c]
btr r9w, bx
jae fcn.1806c4df4
pushfq
push rsi
mov ebp, dword [rsp + r8 - 0x17511dd2]
movzx esi, bx
bt dx, dx
mov qword [rsp + rcx*8], rdx
neg bl
shl byte [rsp + rcx*2 + 1], 0xe3
xadd qword [rsp + rcx*4], r8
sub rax, qword [rsp + rcx*2]
dec bl
and dx, 0x541f
div di
add dx, 0x2999
xor r10b, bl
lea rbx, [rsp + rbx + 8]
or byte [rsp + rcx*2], 0x2e
mov dx, word [rbx + rcx]
lea rsi, [rsi + rcx - 2]
mov word [rsi + rcx*2], dx
Function at 0x1806d1379
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov r10, qword [rsp + rax*2 - 0x59ca166]
sar ax, 0x41
movsxd rdi, edi
sal cl, 0x25
add cl, bh
adc r11, rdi
mov qword [rsp + rax*4 - 0xb38a16c], rbx
btr r9w, r8w
mov r8w, word [rsi + rax*2 - 0x59c50b6]
mov di, word [rax + rsi - 0x2ce2859]
xor bx, bx
bts r9w, 0x25
lea rsi, [rsi + rax*2 - 0x59c50b2]
or r8w, di
xadd dword [rsp + rdx*4 + 4], r9d
sbb ax, cx
mov qword [rsp + r9*2 + 8], rdx
not r8w
pop rcx
mov ax, r8w
adc byte [rsp + r9], cl
sbb word [rsp + r9 + 6], 0x64ae
xor cl, 0x82
or dl, byte [rbp + r9 - 5]
lea rbp, [rbp + r9*4 - 5]
not bx
push rcx
xor dl, r10b
imul ecx, dword [rsp + r9*2 + 4]
jb 0x18071412a
pop rbx
pop rdx
pop rdx
jae fcn.1806c4df4
jl 0x1806e3b42
mov eax, 0xea1a8016
mov edi, dword [rbp + riz - 4]
xor edi, r10d
not edi
mov r8d, eax
dec edi
bt r8, rax
rol al, 0xe2
rol edi, 1
jmp 0x1806e5854
adc r11, rbx
mul cx
mov qword [rsp + r8*8 - 0x3c4270b0], rax
movzx cx, byte [r8 + rsi - 0x7884e17]
dec rdx
movzx ebx, r8b
mov r9, qword [rsi + riz + 8]
push 0xffffffffb6319d34
jnp 0x1807071fb
sub rbp, 4
mov r8d, 0x7884e17
movzx eax, r8b
mov ebx, dword [rbp + r8 - 0x7884e17]
xor ebx, r10d
cqo
rol ebx, 1
mov ecx, r8d
movzx edi, r8b
lea ebx, [rbx + r8 - 0xf7fc82]
lea r9, [rdx + rcx + 0xa164e07]
xor ebx, 0xb34d096
rol r9b, 4
cwde
setae r9b
adc ebx, edx
mul rdi
rol ebx, 1
rol dl, 0xa1
btr ecx, eax
push r10
xor dword [rsp + r8 - 0x7884e17], ebx
push rax
mov r10, qword [rsp + r8 - 0x7884e0f]
movsxd rbx, ebx
or word [rsp + r8*2 - 0xf109c28], dx
jp 0x1806da015
mov r8d, 0xe82b5b5
mov r9, qword [rsi + r8*8 - 0x7415ada8]
lea rbx, [r8 + r8 + 0x138ab6a5]
btr rbx, r8
mov rbx, qword [r8 + rsi - 0xe82b5ad]
movzx eax, r8w
mov cl, byte [rsi + r8*2 - 0x1d056b5a]
lea rsi, [rsi + r8*8 - 0x7415ad9e]
lea rdi, [rax*4 - 0x5b47d7d7]
setb r8b
shrd r9, rbx, cl
call fcn.1806e16a3
call fcn.18070b9fb
lea edi, [rdi + r8 - 0x3f0eab8f]
movsx ecx, al
mov ebx, ecx
movsx edx, cx
push r10
shl r8, cl
xor dword [rsp + rcx - 0x58], edi
imul ecx
lea r9, [rbx + r8*8 - 0x1ace1264]
inc r8d
pop r10
and r8b, dl
movsxd rdi, edi
cqo
btr ebx, eax
inc bx
adc r11, rdi
xor rdx, qword [rsi + rax - 0x791c1e40]
cwde
cbw
lea rcx, [rcx*4 - 0x7b7e3747]
mov al, byte [rax + rbp - 0x45]
movzx edi, cl
xor al, r10b
or r8w, r9w
shr bx, 0xa1
not r9
not al
dec dil
xchg r9, rbx
inc al
xadd rbx, r8
shr r9d, 0xcf
setnp cl
xor al, bl
sub al, 6
push rcx
jmp 0x1807106a3
call fcn.1806f7eb8
neg dl
xor dl, bl
rol byte [rsp + r9 + 7], 0x26
xchg dword [rsp + r9*2 + 7], ecx
movzx edi, r9b
ror dl, 1
neg r9d
pop rcx
neg dl
and qword [rsp + r9*2], rdi
and qword [rsp + r9*2], rdi
neg rcx
xor r10b, dl
sar r9b, 0x21
push rdi
lea r8, [r9*2 - 0x507eddc6]
lea rdx, [rsp + rdx + 0x10]
lea r8, [rcx + rbx*4 + 0x1a3abc34]
rol byte [rsp + r9 + 9], 0x21
ror dword [rsp + r9 + 0xc], 0xa9
mov byte [rdx + r9*2], al
pop rbx
shr edi, cl
lea rcx, [rdi + r9 + 0x4bdb513]
adc qword [rsp + r9], r11
ret
Function at 0x1806d81f2
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror r8b, 0x21
dec r8d
mov dword [rsi + r9*2 + 0x27cbec46], eax
sets r8b
neg r9b
mov dword [rsi + rbx*4 - 0x2000000], edx
jg fcn.1806c4df4
mov edi, dword [rbx + rsi - 0x60d3bbb6]
movsx r9d, bx
shr bx, 0x23
not ecx
jae 0x1806ed2cc
mov eax, 0xba3fbaad
lea r9, [rax + rax*2 + 0x37bd839c]
sub rbp, 4
dec r9
mov eax, dword [rbp + riz]
lea rbx, [r9 + r9*8 - 0x7146a06d]
jns 0x18071252e
mov ecx, 0xe711ce1c
sub rbp, 4
mov ebx, dword [rbp + riz]
mov edi, ecx
bswap ecx
mov qword [rsp + rdi - 0x2db6373b], 0xffffffff9b0726ad
imul r9, r8
mov qword [rsp + rdi*2 - 0x5b6c6e76], r10
bswap rbx
xor dword [rsp + rdi - 0x2db6373b], ecx
pop r10
bts r8d, 0xaf
ror r8, 0x5d
movsxd rcx, ecx
sbb rdi, r9
neg r8w
ror bx, 0x6b
adc r11, rcx
mov edi, dword [rbp + r9*2 - 0x17e4c648]
jmp 0x18070d2d3
dec eax
bt rbx, rbx
or edx, r9d
sar ebx, cl
not eax
rol ebx, cl
push r10
btr edx, r8d
xor dword [rsp + rbx - 0x800000], eax
mov r10d, edi
pop r10
not di
movsxd rax, eax
inc r9
add r11, rax
rdtsc
dec rcx
lea rsi, [rsi + rbx*2 - 0x1000008]
jns 0x1806c9f9a
mov qword [rsi + riz], rdx
rol rax, cl
pop rdx
pop r9
pop r8
jmp r11
movzx eax, r9b
not edi
lea rdx, [rbx*8 - 0x79ec37d2]
adc eax, r9d
and ecx, edi
jmp 0x1806c5643
lea rbp, [rbp + r9*8 - 0x5f931908]
and r8w, 0x312f
bswap r9
dec rbx
xor edi, r10d
call fcn.1806ed0cc
sub bl, r9b
shl ebx, 0x91
neg eax
jmp 0x1806e4aa0

Function at 0x1806dba10
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
idiv rax
mov qword [rsp + rdx*2], r10
add r9b, 0x98
bts r9, 0x3c
xor dword [rsp + rdx*2], ecx
shl rdx, 0xae
movsx r10d, r8w
pop r10
neg r9d
bts rax, rbx
call fcn.18070bc4c
call fcn.1806cc6df

Function at 0x1806e515b
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov qword [rsp + rcx*2 - 0x200000], 0x5820fe23
add r11, rdx
mul edi
cwde
mov r8w, word [rsi + r8*2 - 0x1dc]
xadd dx, r9w
lea rsi, [rsi + rcx*2 - 0x1ffffc]
pop rcx
xchg byte [rsp + r9*2 + 0x58a7d957], dil
movzx ebx, byte [rcx + rbp - 0x5820fe28]
lea rbp, [rbp + r9*2 + 0x58a7d94b]
adc di, ax
not cx
btc rcx, 0xa
xor bl, r10b
mul edx
and cx, dx
neg bl
neg dword [rsp + rdx - 0x6596c7b5]
cwd
adc bl, 0x15
call fcn.1806ff424
Function at 0x1806ed137
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov qword [rsp + r8 - 0x17511e42], 0x273e3330
movzx edx, bl
mov qword [rsp + r8*4 - 0x5d447908], r13
movsx ecx, r8w
lea r11, [rcx*8 - 0x28c80467]
jmp 0x1806ce70c

Function at 0x1806f8130
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov eax, 0xcb936e84
shl al, 0xa3
mov rax, qword [rbp + rbx*8 + 0x20]
push 0xffffffffbe8dea21
push 0xffffffff86b38c8c
call fcn.180702e05
lea rsp, [rsp + 8]
jne 0x1806d135d
call fcn.1806eb04e
mov ecx, 0xb735552d
call fcn.18070fb5b
Function at 0x1806f8537
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
add r11, rdi
or cl, 0x8a
ror ax, cl
cdqe
movzx r8d, byte [rax + rbp + 0x3ff27645]
btr edx, r9d
jb 0x1806ea893
mov ebx, 0x8cadfa95
lea rdx, [rbx + rbx*2 + 0x4b3c2a33]
movsx r9d, bx
mov rcx, qword [rsi + riz]
push rbx
mov edx, dword ss:[rcx + riz]
movzx eax, r9w
sub byte [rsp + rax*2 - 0x1f529], r9b
dec r9b
lea rsi, [rax + rsi - 0xfa91]
call fcn.1807009ba
mov r9d, 0x6a0b1832
mov r9w, word [rsi + r9 - 0x6a0b1832]
mov ebx, 0x48a86d11
mov cx, word [rsi + rbx - 0x48a86d0f]
mov edi, ebx
movzx edx, dil
mov r8d, edx
or r9w, cx
movsx ecx, bl
not r9w
mov word [rsi + rdx - 0xf], r9w
xor bx, 0xaa8e
lea rax, [rbx + rbx + 0x21a39215]
mov edx, dword [rdi + rbp - 0x48a86d15]
xor edx, r10d
lea r9, [rdi + rcx*2 - 0x1c548f4c]
sub edx, 0xd9aa5c98
not r9
dec rcx
sar bx, 0xeb
neg edx
xadd edi, ebx
bts rcx, r9
jae 0x1806db9e8
jmp 0x1806d57fe
add r11, rbx
rol cl, 0x81
pop rax
pop rbx
jb fcn.1806c4df4
dec edx
ror edx, 1
xor ebx, 0x8fbc0325
shl ecx, cl
neg r9b
push r10
or r9, r9
xor dword [rsp + r8 - 0x11], edx
neg r9w
pop r10
sub ax, 0x739d
call fcn.18071455e
lea rbp, [rbp + rdi*2 - 0x14]
shl r8w, 0xc8
dec r8
mov r8d, dword [r8 + rbp - 0x6c9831ff]
xor r8d, r10d
sub r8d, 0xd9aa5c98
btr r9d, 0xae
neg r8d
cwde
and byte [rsp + r9 - 0x7667a606], r9b
cdq
adc r8d, edx
ror r8d, 1
shr edi, 0x91
mov qword [rsp + rdi*2], r10
sub al, 0x90
sar rdx, 2
shl di, 0x6f
xor dword [rsp + rdi*4], r8d
ror r9, 0x4b
btr edi, 0x39
call fcn.1806cfd2a
lea rbp, [rbp + rax + 0x3ff27645]
xor r8b, r10b
neg r8b
rol r8b, 1
movsx edi, dx
xor dil, dil
and dil, 0x8f
xor r8b, 0xb2
and rbx, rdx
not r8b
xor r10b, r8b
sal bl, 0xa1
call fcn.1806fc115
call fcn.1806e66f6
mov ecx, 0xa990b4b5
movzx edi, cx
lea rax, [rdi + rcx*8 - 0x6ee18e5d]
mov edx, dword [rsi + rdi - 0xb4b5]
lea rbx, [rcx*4 - 0x5df4ec5]
movzx r8d, dil
xor r8b, cl
mov ecx, dword [rsi + rdi*2 - 0x16966]
or edx, ecx
bts r8, rdi
movsx r9d, r8b
neg edi
not edx
sub rbx, 0x1704d700
setbe r9b
cdqe
mov dword [rsi + rax*2 + 0x44b66804], edx
movsx ecx, dil
shr di, cl
add r8, rax
mov edi, dword [rbp + rax + 0x225b33fc]
inc cl
adc bl, 0x35
xor edi, r10d
ror eax, cl
push rbx
lea edi, [rdi + r9*8 + 0x7139483]
xchg dword [rsp + rcx - 0x48], ecx
jae 0x1806e81ac
bswap edi
movsx edx, cx
xor r8b, 0x14
ror cl, 0xe2
xor edi, 0x6e9363a3
btr r8w, 9
rol edi, 1
btr ecx, eax
inc dword [rsp + r9*4 + 3]
dec edi
cqo
xchg dword [rsp + r9 + 2], ebx
mov qword [rsp + rbx - 0x4c8a5e], r10
xor dword [rsp + rbx*2 - 0x9914bc], edi
ror al, 1
pop r10
cdq
bt rbx, r8
bt rcx, 0xb5
movsxd rdi, edi
rol r8w, 2
jb 0x1806c732a
Function at 0x1806fff84
Capabilities:
Authenticate hmac

Disassembly:
mov rax, qword [rsi + r8*4 + 8]
shr r9d, 0x5c
lea rsi, [rsi + r9 + 0xc]
setp r9b
jbe 0x1806f2800
dec r9d
sal ebx, 0x64
ja 0x1807088c2
rol r9d, 1
sal rbx, 0x8a
lea r9d, [rdx + r9 - 0x42f49439]
neg ax
adc rcx, rdx
mov qword [rsp + rdi*2], r10
ror di, 0x82
push r10
xor dword [rsp + r8 - 0x7d7f7377], eax
neg r8d
add bl, dh
or rbx, r8
pop r10
lea rdi, [rbx*2 + 0x7e0e8713]
sar r8, 0x2d
sbb r9, rdi
movsxd rax, eax
adc r11, rax
shl edi, 0xfd
mov rcx, qword [rdx + rsi - 0x7d806dc5]
neg edx
jle 0x1806d07b6

Function at 0x1807098f5
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
jae 0x1806f7990
xor dword [rsp + 8], ebx
jmp 0x1806e02e3
pop r10
push rdx
add ecx, 0xa78269b5
movsxd rbx, ebx
xadd r8w, ax
dec edi
not rdi
add r11, rbx
cqo
push r9
pop rdi
add qword [rsp + rdi - 0x27], r11
ret
dec rcx
push 0x659e6a95
jmp 0x180709dfb
lea rsp, [rsp + 0x40]
jne 0x18070dc54
mov ecx, 0xbc87bfb1
push rcx
movzx r8d, word [rsp + 2]
not ebx
movsx eax, r8w
mov edx, 0xd957da3
mov dword [r8 + rsi - 0xbc87], ebx
bt cx, dx
imul word [rsp + r8*8 - 0x5e435]
call fcn.180705fe5
rol ebx, 2
movsx r9d, dl
rol r9w, 4
mov qword [rsp + 8], r10
jb 0x1806ecc77
jmp 0x180702ba9
movzx edx, byte [r8]
call fcn.180701257
mov r9, qword [rsi]
push 0x39a3b388
mov di, word ss:[r9]
mov eax, 0x5a868496
mov word [rsi + rax - 0x5a868490], di
lea rbx, [rax*2 + 0x48007c0f]
mov r8d, dword [rbp + rax - 0x5a86849a]
movzx edi, byte [rsp + rax - 0x5a868493]
lea rbp, [rdi + rbp - 0x3d]
and bl, dil
lea r9, [rdi + rax*4 + 0x603a1585]
neg byte [rsp + rdi*8 - 0x1c3]
xor r8d, r10d
movsx ecx, ax
pop rbx
rol bl, 1
dec r8d
lea rdi, [rcx*8 + 0x99a6f01]
xor r8d, 0x5492ce9a
rol r9, cl
adc edi, edi
adc ebx, 0x1aabf13c
ror r8d, 2
bswap ebx
call fcn.1806d7ba2
sar dword [rsp + rdx - 0xe40c], 0xed
xor edi, r10d
sub word [rsp + rdx*2 - 0x1c81e], cx
rol edi, 1
movsx eax, byte [rsp + r8 - 0x173ce40c]
push r8
sub word [rsp + r8 - 0x173ce411], 0xd78d
lea edi, [rdi + r8*2 - 0x27e97699]
cwde
xor edi, 0xb34d096
rol byte [rsp + r8 - 0x173ce413], 0xc7
lea rbx, [rcx*4 - 0x1dd48b55]
inc edi
sal qword [rsp + r8 - 0x173ce403], 0x9b
inc dword [rsp + r8*2 - 0x2e79c813]
btc ecx, r8d
rol edi, 1
mov qword [rsp + r8 - 0x173ce3ff], r10
xor dword [rsp + r8*4 - 0x5cf39044], edi
dec bx
ror dword [rsp + r8 - 0x173ce407], 0x96
mov r10, qword [rsp + r8 - 0x173ce3ff]
movsxd rdi, edi
not word [rsp + r8*2 - 0x2e79c81d]
adc r11, rdi
mov qword [rsp + r8 - 0x173ce417], r11
ret 0x18

Function at 0x18070dc1d
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
adc rsi, 0xb
push 0xe39483a
sar word [rsp + 6], 0xa1
xor ebx, ebx
mov qword [rsp + 8], 0xffffffffffbd820e
test rcx, rcx
lea rsp, [rsp + 0x10]
je 0x180709e06
mov edx, 0xa59c0d2d
lea rax, [0x180700560]

Function at 0x18071066a
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
movsx r8d, r9w
pop r8
js fcn.1806c4df4
Function at 0x18071433d
Capabilities:
Execute anti-debugging instructions
Hash data using murmur3

Disassembly:
mov qword [rsp], 0xffffffffa9125280
inc r9
inc qword [rsp]
xor r8d, 0x71188b85
shl byte [rsp + 7], 0x65
dec rdx
push 0xffffffffc8856c99
push 0x3835838b
push 0xffffffff9b3a6ea7
lea rsp, [rsp + 0x38]
jne 0x1806f2980
pop rsi