joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003cb0
Capabilities:
Set socket configuration

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 8], 0
mov rdi, rcx
jne 0x180003cca
or rax, 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x58], rbx
xor ebx, ebx
mov rcx, qword [rdi + 8]
mov edx, reloc.WS2_32.dll_WSAGetLastError
lea r8d, [rdx - 0x6e]
test ebx, ebx
je 0x180003ce8
mov r8d, 0xffffffef
call fcn.18003c2b0
mov rcx, qword [rdi + 8]
call fcn.18003c520
test eax, eax
je 0x180003d10
inc ebx
cmp ebx, 2
jl 0x180003cd1
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x50]
mov edx, 0x20001d
mov qword [rsp + 0x50], 0
call fcn.18003c550
mov rbx, qword [rsp + 0x50]
lea r8, [rsp + 0x40]
mov rcx, rbx
mov edx, 0x8004667e
mov dword [rsp + 0x40], 0
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x1006
mov rcx, rbx
mov dword [rsp + 0x40], 0x1d4c0
mov dword [rsp + 0x48], 0x1d4c0
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x1005
mov rcx, rbx
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180005080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov esi, r9d
mov rdi, r8
mov rbp, rdx
shr esi, 4
mov r12, rcx
test esi, esi
je 0x18000514a
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0xf4]
nop dword [rax + rax]
movzx eax, bl
dec esi
or al, dil
test al, 7
jne 0x1800050dc
mov rax, qword [rdi]
xor qword [rbx], rax
mov rax, qword [rdi + 8]
xor qword [rbx + 8], rax
jmp 0x180005118
mov rdx, rdi
mov rcx, rbx
mov r8d, 4
sub rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
add rcx, 4
xor byte [rcx - 4], al
movzx eax, byte [rdx + rcx - 3]
xor byte [rcx - 3], al
movzx eax, byte [rdx + rcx - 2]
xor byte [rcx - 2], al
movzx eax, byte [rdx + rcx - 1]
xor byte [rcx - 1], al
dec r8
jne 0x1800050f0
mov r8, rbx
mov rdx, rbx
mov rcx, r12
call fcn.180003db0
mov rax, qword [rbx]
add rbp, 0x10
mov qword [rbp - 0x10], rax
mov rax, qword [rbx + 8]
add rdi, 0x10
mov qword [rbp - 8], rax
test esi, esi
jne 0x1800050c0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop r12
ret

Function at 0x180005170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r12
push r13
sub rsp, 0x20
mov ebp, r9d
mov r12, r8
mov rbx, rdx
shr ebp, 4
mov r13, rcx
test ebp, ebp
je 0x180005279
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
lea rdi, [rcx + 0xf4]
nop word [rax + rax]
mov rax, qword [r12]
lea rdx, [r13 + 0x104]
mov r8, rbx
mov qword [r13 + 0x104], rax
mov rax, qword [r12 + 8]
mov rcx, r13
mov qword [r13 + 0x10c], rax
dec ebp
call fcn.180004380
movzx r11d, dil
or r11b, bl
test r11b, 7
jne 0x1800051f8
mov rax, qword [rdi]
xor qword [rbx], rax
mov rax, qword [rdi + 8]
xor qword [rbx + 8], rax
jmp 0x180005238
mov rdx, rdi
mov rcx, rbx
mov r8d, 4
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
add rcx, 4
xor byte [rcx - 4], al
movzx eax, byte [rdx + rcx - 3]
xor byte [rcx - 3], al
movzx eax, byte [rdx + rcx - 2]
xor byte [rcx - 2], al
movzx eax, byte [rdx + rcx - 1]
xor byte [rcx - 1], al
dec r8
jne 0x180005210
mov eax, dword [r13 + 0x104]
add rbx, 0x10
add r12, 0x10
mov dword [rdi], eax
mov eax, dword [r13 + 0x108]
mov dword [rdi + 4], eax
mov eax, dword [r13 + 0x10c]
mov dword [rdi + 8], eax
mov eax, dword [r13 + 0x110]
mov dword [rdi + 0xc], eax
test ebp, ebp
jne 0x1800051b0
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rbp
ret
Function at 0x180005330
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx r11d, byte [rcx]
mov esi, r9d
movzx r9d, byte [rcx + 1]
mov rdi, r8
mov rbx, rdx
mov r10, rcx
test esi, esi
je 0x1800053b8
sub rbx, r8
nop dword [rax + rax]
movzx r8d, byte [r11 + r10 + 2]
inc rdi
lea eax, [r8 + r9]
movzx r9d, al
lea eax, [r11 + 1]
movzx ecx, byte [r9 + r10 + 2]
mov byte [r11 + r10 + 2], cl
movzx r11d, al
mov byte [r9 + r10 + 2], r8b
lea eax, [rcx + r8]
movzx ecx, al
movzx eax, byte [rcx + r10 + 2]
xor al, byte [rdi - 1]
dec esi
mov byte [rbx + rdi - 1], al
jne 0x180005360
mov byte [r10], r11b
mov byte [r10 + 1], r9b
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov byte [rcx], r11b
mov byte [rcx + 1], r9b
ret
Function at 0x18000ab50
Capabilities:
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x90
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor r11d, r11d
mov rbx, r8
mov esi, edx
mov r9, rcx
lea rbp, [0x180000000]
mov r8d, r11d
movzx eax, byte [r8 + rbp + 0x86218]
dec eax
movsxd rdx, eax
mov rax, rdx
and edx, 7
sar rax, 3
movzx ecx, byte [rax + r9]
test byte [rbp + rdx*4 + 0x86790], cl
setne al
mov byte [rsp + r8], al
movzx eax, byte [r8 + rbp + 0x86219]
dec eax
movsxd rdx, eax
mov rax, rdx
and edx, 7
sar rax, 3
movzx ecx, byte [rax + r9]
test byte [rbp + rdx*4 + 0x86790], cl
setne al
mov byte [rsp + r8 + 1], al
movzx eax, byte [r8 + rbp + 0x8621a]
dec eax
movsxd rdx, eax
mov rax, rdx
and edx, 7
sar rax, 3
movzx ecx, byte [rax + r9]
test byte [rbp + rdx*4 + 0x86790], cl
setne al
mov byte [rsp + r8 + 2], al
movzx eax, byte [r8 + rbp + 0x8621b]
dec eax
movsxd rdx, eax
mov rax, rdx
and edx, 7
sar rax, 3
movzx ecx, byte [rax + r9]
test byte [rbp + rdx*4 + 0x86790], cl
setne al
add r8, 4
mov byte [rsp + r8 - 1], al
cmp r8, 0x38
jl 0x18000ab92
mov rdi, r11
mov r12d, Ordinal_33
lea r13, [0x180086760]
nop
movzx edx, byte [rdi + rbp + 0x86750]
xor eax, eax
mov r9d, r11d
mov qword [rsp + 0x70], rax
mov r8, r11
nop word [rax + rax]
cmp r9d, r12d
mov eax, gethostname
cmovl eax, r12d
cmp edx, eax
mov eax, edx
jl 0x18000ac95
lea eax, [rdx - 0x1c]
cdqe
inc r8
inc r9d
movzx ecx, byte [rsp + rax]
inc edx
mov byte [rsp + r8 + 0x37], cl
cmp r8, 0x38
jl 0x18000ac80
mov r9d, r11d
mov r10, r13
movzx eax, byte [r10]
cmp byte [rsp + rax + 0x37], r11b
je 0x18000ace5
mov eax, 0xaaaaaaab
mul r9d
mov eax, r9d
shr edx, 2
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub eax, ecx
movsxd rcx, eax
mov eax, dword [rbp + rcx*4 + 0x86790]
sar eax, 2
or byte [rsp + rdx + 0x70], al
inc r9d
inc r10
cmp r9d, 0x30
jl 0x18000acb4
movzx eax, byte [rsp + 0x72]
movzx ecx, byte [rsp + 0x70]
inc rdi
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x74]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x76]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x73]
mov dword [rbx + rdi*8 - 8], ecx
movzx ecx, byte [rsp + 0x71]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x75]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x77]
shl ecx, 8
or ecx, eax
mov dword [rbx + rdi*8 - 4], ecx
cmp rdi, 0x10
jl 0x18000ac60
cmp esi, 1
jne 0x18000ad8c
lea rdx, [rbx + 0x7c]
nop word [rax + rax]
mov eax, dword [rdx - 4]
mov ecx, dword [rbx + r11*4]
add r11, 2
mov dword [rbx + r11*4 - 8], eax
mov dword [rdx - 4], ecx
mov eax, dword [rdx]
mov ecx, dword [rbx + r11*4 - 4]
mov dword [rbx + r11*4 - 4], eax
sub rdx, 8
mov dword [rdx + 8], ecx
cmp r11, 0x10
jl 0x18000ad60
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18002cf50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18000adc0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov r11d, dword [rcx]
mov ebx, dword [rdx]
mov r9, rdx
mov r10, rcx
lea rdi, [r8 + 8]
mov esi, 8
lea rbp, [0x1800867b0]
nop
mov eax, ebx
add rdi, 0x10
ror eax, 4
xor eax, dword [rdi - 0x18]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4]
xor edx, dword [rbp + rax*4 + 0x200]
mov eax, r8d
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x400]
mov eax, dword [rdi - 0x14]
xor edx, dword [rbp + r8*4 + 0x600]
xor eax, ebx
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
xor r11d, edx
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x100]
xor edx, dword [rbp + rax*4 + 0x300]
mov eax, r8d
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x500]
xor edx, dword [rbp + r8*4 + 0x700]
xor r11d, edx
mov eax, r11d
ror eax, 4
xor eax, dword [rdi - 0x10]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4]
xor edx, dword [rbp + rax*4 + 0x200]
mov eax, r8d
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x400]
mov eax, dword [rdi - 0xc]
xor edx, dword [rbp + r8*4 + 0x600]
xor eax, r11d
mov r8d, eax
mov ecx, eax
xor ebx, edx
shr rax, 0x10
shr rcx, 0x18
and eax, 0x3f
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x100]
xor edx, dword [rbp + rax*4 + 0x300]
mov eax, r8d
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x500]
xor edx, dword [rbp + r8*4 + 0x700]
xor ebx, edx
dec rsi
jne 0x18000adf0
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov dword [r9], ebx
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret

Function at 0x18000bd90
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov rbx, r8
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x6c], 0x67452301
mov dword [rsp + 0x70], 0xefcdab89
mov dword [rsp + 0x74], 0x98badcfe
mov dword [rsp + 0x78], 0x10325476
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.1800199e0
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.180019ac0
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x90
pop rbx
ret
Function at 0x18000bee0
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xa0
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov rbx, r8
mov r8d, edx
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov qword [r11 - 0x28], rax
mov dword [r11 - 0x20], eax
call fcn.18001a260
test eax, eax
jne 0x18000bf6b
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.18001a470
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0xa0
pop rbx
ret

Function at 0x18000c010
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x110
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x100], rax
movabs rax, 0x6a09e667f3bcc908
mov rbx, r8
mov r8d, edx
mov qword [rsp + 0x38], rax
movabs rax, 0xbb67ae8584caa73b
mov rdx, rcx
mov qword [rsp + 0x40], rax
movabs rax, 0x3c6ef372fe94f82b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x48], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x50], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x58], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x60], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x68], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x70], rax
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
call fcn.18001b4a0
test eax, eax
jne 0x18000c0d7
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.18001b990
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x110
pop rbx
ret
Function at 0x18000c0f0
Capabilities:
Hash data using sha1
Hash data using sha256
Hash data using sha512

Disassembly:
mov byte [rcx + 0x221], 0
mov byte [rcx + 0x220], dl
test edx, edx
je 0x18000c20b
cmp edx, 1
je 0x18000c129
cmp edx, 2
je 0x18000c129
cmp edx, 5
je 0x18000c129
cmp edx, 4
je 0x18000c129
cmp edx, 7
je 0x18000c129
cmp edx, 8
je 0x18000c129
mov eax, 0xffffff53
ret
test edx, edx
je 0x18000c20b
dec edx
je 0x18000c204
dec edx
je 0x18000c1c3
cmp edx, 2
jne 0x18000c123
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x18], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x20], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x28], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x30], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x38], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x40], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x48], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x50], rax
xor eax, eax
mov dword [rcx], eax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
ret
xor eax, eax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
mov dword [rcx + 0x5c], 0xc3d2e1f0
xor eax, eax
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x4c], 0x67452301
mov dword [rcx + 8], eax
mov qword [rcx], rax
ret
Function at 0x18000c230
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov edi, r9d
mov rbp, rcx
lea rbx, [rcx + 0xd8]
mov r9, r8
lea r12, [rcx + 0x158]
call fcn.18000c0f0
test eax, eax
jne 0x18000c3ad
movzx ecx, byte [rcx + 0x220]
mov qword [rsp + 0x30], rsi
test ecx, ecx
je 0x18000c334
dec ecx
je 0x18000c30d
dec ecx
je 0x18000c2d6
cmp ecx, 2
je 0x18000c298
mov eax, 0xffffff53
jmp 0x18000c3a8
mov esi, pe_nt_image_headers64
mov rdx, r9
cmp edi, esi
jbe 0x18000c340
mov r8d, edi
mov rcx, rbp
call fcn.18001b4a0
test eax, eax
jne 0x18000c3a8
mov rdx, rbx
mov rcx, rbp
call fcn.18001b990
test eax, eax
jne 0x18000c3a8
lea edi, [rsi - 0x40]
jmp 0x18000c36c
mov esi, 0x40
mov rdx, r9
cmp edi, esi
jbe 0x18000c340
mov r8d, edi
mov rcx, rbp
call fcn.18001a260
test eax, eax
jne 0x18000c3a8
mov rdx, rbx
mov rcx, rbp
call fcn.18001a470
test eax, eax
jne 0x18000c3a8
lea edi, [rsi - 0x20]
jmp 0x18000c36c
mov esi, 0x40
mov rdx, r9
cmp edi, esi
jbe 0x18000c340
mov r8d, edi
mov rcx, rbp
call fcn.1800199e0
mov rdx, rbx
mov rcx, rbp
call fcn.180019ac0
lea edi, [rsi - 0x2c]
jmp 0x18000c36c
mov esi, 0x40
mov rdx, r9
cmp edi, esi
ja 0x18000c351
mov r8, rdi
mov rcx, rbx
call fcn.18002d8c0
cmp edi, esi
jae 0x18000c37e
jmp 0x18000c36c
mov r8d, edi
mov rcx, rbp
call fcn.180014630
mov rdx, rbx
mov rcx, rbp
call fcn.1800146e0
mov edi, reloc.WS2_32.dll_recv
mov r8d, esi
mov ecx, edi
xor edx, edx
sub r8d, edi
add rcx, rbx
call fcn.180030f50
test esi, esi
je 0x18000c3a6
sub r12, rbx
mov ecx, esi
nop word [rax + rax]
movzx eax, byte [rbx]
inc rbx
xor al, 0x5c
mov byte [r12 + rbx - 1], al
xor byte [rbx - 1], 0x36
dec rcx
jne 0x18000c390
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x1800146e0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 4]
mov rbx, rcx
lea rdi, [rcx + 0xc]
mov ecx, dword [rcx]
mov rsi, rdx
lea eax, [rcx + r8]
mov dword [rbx + 4], eax
cmp eax, r8d
jae 0x180014713
inc dword [rbx + 8]
mov byte [rcx + rdi], pe_nt_image_headers64
inc dword [rbx]
mov ecx, dword [rbx]
xor ebp, ebp
cmp ecx, 0x38
jbe 0x180014745
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.180030f50
mov rcx, rbx
mov dword [rbx], 0x40
call fcn.180013eb0
mov dword [rbx], ebp
mov ecx, dword [rbx]
mov r8d, gethostname
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.180030f50
mov r11d, dword [rbx + 4]
mov eax, dword [rbx + 8]
mov ecx, r11d
shr ecx, 0x1d
lea ecx, [rcx + rax*8]
lea eax, [r11*8]
mov dword [rbx + 8], ecx
mov dword [rbx + 4], eax
mov dword [rdi + 0x38], eax
mov eax, dword [rbx + 8]
mov rcx, rbx
mov dword [rdi + 0x3c], eax
call fcn.180013eb0
mov rax, qword [rbx + 0x4c]
mov qword [rsi], rax
mov rax, qword [rbx + 0x54]
mov qword [rsi + 8], rax
mov rsi, qword [rsp + 0x40]
mov qword [rbx], rbp
mov dword [rbx + 8], ebp
mov rbp, qword [rsp + 0x38]
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1800147d0
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
sub rsp, 0xa0
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov r12, r8
mov esi, edx
mov rbp, rcx
mov dword [rsp + 0x6c], 0x67452301
mov dword [rsp + 0x70], 0xefcdab89
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x74], 0x98badcfe
mov dword [rsp + 0x78], 0x10325476
test edx, edx
je 0x1800148a0
mov qword [r11 - 0x20], rbx
mov qword [r11 - 0x28], rdi
nop
mov edi, 0x40
lea rcx, [rsp + rax + 0x2c]
mov rdx, rbp
sub edi, eax
cmp esi, edi
cmovb edi, esi
mov r8d, edi
mov ebx, edi
call fcn.18002d8c0
mov eax, dword [rsp + 0x20]
add rbp, rbx
add eax, edi
sub esi, edi
mov dword [rsp + 0x20], eax
cmp eax, 0x40
jne 0x18001488c
lea rcx, [rsp + 0x20]
call fcn.180013eb0
mov r11d, dword [rsp + 0x24]
mov eax, r11d
add r11d, 0x40
mov dword [rsp + 0x24], r11d
cmp r11d, eax
jae 0x180014886
inc dword [rsp + 0x28]
xor eax, eax
mov dword [rsp + 0x20], eax
test esi, esi
jne 0x180014830
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x98]
lea rcx, [rsp + 0x20]
mov rdx, r12
call fcn.1800146e0
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0xa0
pop r12
pop rsi
pop rbp
ret
Function at 0x180015370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
sub rsp, 0x20
mov ebp, r9d
mov r12, r8
mov rsi, rdx
mov r13, rcx
test r8b, 3
jne 0x1800153ab
test dl, 3
jne 0x1800153ab
mov r9d, ebp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rsi
jmp fcn.1800151d0
mov rax, qword [0x180097878]
mov qword [rsp + 0x40], rbx
mov rcx, rbp
mov qword [rsp + 0x48], rdi
test rax, rax
je 0x1800153c8
call rax
jmp 0x1800153cd
call fcn.18002d468
mov rbx, rax
test rax, rax
jne 0x1800153da
lea eax, [rbx - 0x7d]
jmp 0x180015422
mov r8, rbp
mov rdx, r12
mov rcx, rbx
call fcn.18002d8c0
mov r9d, ebp
mov r8, rbx
mov rdx, rbx
mov rcx, r13
call fcn.1800151d0
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call fcn.18002d8c0
mov r11, qword [0x180097880]
mov rcx, rbx
test r11, r11
je 0x18001541b
call r11
jmp 0x180015420
call fcn.18002d284
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rsi
ret
Function at 0x180016190
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0x70
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rcx
test rcx, rcx
je 0x1800162fc
mov qword [rcx + 0x10], rdx
xor ecx, ecx
call fcn.1800164f0
test eax, eax
jne 0x1800162e0
mov rax, qword [0x180097878]
mov qword [rsp + 0x88], rbx
mov ecx, 0x78
test rax, rax
je 0x1800161e1
call rax
jmp 0x1800161e6
call fcn.18002d468
mov qword [rdi], rax
mov ebx, Ordinal_50
test rax, rax
jne 0x1800161f8
lea ecx, [rax - 0x7d]
jmp 0x180016271
lea rcx, [rdi + 8]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x90], rsi
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180016264
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x180016264
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call fcn.1800160a0
test eax, eax
jne 0x180016264
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.180015c60
mov ecx, eax
jmp 0x180016269
mov ecx, 2
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x30]
mov byte [rax], 0
inc rax
dec ebx
jne 0x180016276
mov rbx, qword [rsp + 0x88]
test ecx, ecx
jne 0x1800162a5
mov byte [rdi + 0x18], 1
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x70
pop rdi
ret
cmp ecx, 4
je 0x1800162e0
mov byte [rdi + 0x18], 2
cmp ecx, 2
jne 0x1800162cb
mov eax, 0xffffff39
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x70
pop rdi
ret
mov eax, ecx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x70
pop rdi
ret
mov byte [rdi + 0x18], 3
mov eax, 0xffffff2f
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x70
pop rdi
ret
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x70
pop rdi
ret
Function at 0x180016320
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x180016464
test rdx, rdx
je 0x180016464
cmp r8d, 0x10000
ja 0x180016464
cmp byte [rcx + 0x18], 1
je 0x18001636f
mov eax, 0xffffff39
jmp 0x180016469
mov rcx, qword [rcx]
call fcn.180015c60
mov r11d, eax
cmp eax, 3
jne 0x18001643f
lea ecx, [rax - 2]
call fcn.1800164f0
test eax, eax
jne 0x18001644e
lea r9d, [rax + 1]
lea rcx, [rdi + 8]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x20], 0xf0000000
mov qword [rsp + 0x60], r12
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, reloc.WLDAP32.dll_Ordinal_32
test eax, eax
je 0x18001641d
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18001641d
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
mov r8d, ebx
call fcn.180015800
test eax, eax
jne 0x18001641d
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.180015c60
mov r11d, eax
test eax, eax
jne 0x180016423
mov rcx, qword [rdi]
mov r8d, ebp
mov rdx, rsi
call fcn.180015c60
mov r11d, eax
jmp 0x180016423
mov r11d, 2
mov r12, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
nop dword [rax]
mov byte [rax], 0
inc rax
dec ebx
jne 0x180016430
mov rbx, qword [rsp + 0x68]
test r11d, r11d
jne 0x180016448
xor eax, eax
jmp 0x180016469
cmp r11d, 4
jne 0x180016459
mov eax, 0xffffff2f
mov byte [rdi + 0x18], 3
jmp 0x180016469
mov eax, 0xffffff39
mov byte [rdi + 0x18], 2
jmp 0x180016469
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret