joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180012fb0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x70
mov rax, qword [0x180055010]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor esi, esi
mov r12, rcx
mov rcx, qword [rcx + 8]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], 2
lea r8d, [rsi + 3]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180013008
xor eax, eax
jmp 0x180013132
xor edx, edx
mov qword [rsp + 0x98], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
test eax, eax
jne 0x180013031
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x18001312a
mov qword [rsp + 0xa0], rbp
mov rdx, rbx
mov qword [rsp + 0x60], r15
mov ecx, 0x40
mov r15, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
mov rcx, rdi
test rax, rax
jne 0x180013072
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x8007000e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18001311d
lea r9, [rsp + 0x4c]
mov qword [rsp + 0x68], r14
mov r8d, ebx
mov qword [rsp + 0x20], rsi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x30
call fcn.18002d8f4
mov r14, rax
mov qword [rsp + 0x40], rax
lea rax, vtable.C64AddressPoint.0
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbp
xor edx, edx
mov rcx, r14
mov qword [r14], rax
mov dword [rsp + 0x48], esi
mov rdi, qword [r14]
call qword [rdi + reloc.WS2_32.dll_recv]
mov rdi, qword [r14]
lea r9, [rsp + 0x48]
add ebx, 0xfffffff0
lea rdx, [rbp + 0x10]
mov r8d, ebx
mov rcx, r14
call qword [rdi + htons]
mov rdi, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rdi]
mov rdi, qword [r12]
lea rdx, [rbp + 0x10]
mov r8d, ebx
mov rcx, r12
call qword [rdi + 0x38]
xor eax, eax
mov rcx, r15
mov rdi, rbp
rep stosb byte [rdi], al
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov r14, qword [rsp + 0x68]
mov eax, 1
mov rbp, qword [rsp + 0xa0]
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002d8d0
add rsp, 0x70
pop r12
pop rdi
pop rsi
ret
Function at 0x1800195c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, r9d
mov rdi, r8
shr esi, 4
mov rbp, rdx
mov r14, rcx
test esi, esi
je 0x18001968d
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0xf4]
nop dword [rax + rax]
movzx eax, bl
lea rcx, [rdi + 0xf]
or al, dil
dec esi
test al, 7
jne 0x180019620
mov rax, qword [rdi]
xor qword [rbx], rax
mov rax, qword [rcx - 7]
xor qword [rbx + 8], rax
jmp 0x180019663
lea rax, [rbx + 0xf]
cmp rbx, rcx
ja 0x180019653
cmp rax, rdi
jb 0x180019653
mov r8, rdi
mov rax, rbx
sub r8, rbx
mov edx, reloc.WS2_32.dll_recv
nop dword [rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180019640
jmp 0x180019663
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov r8, rbx
mov rdx, rbx
mov rcx, r14
call fcn.180017990
movups xmm0, xmmword [rbx]
add rdi, 0x10
movups xmmword [rbp], xmm0
add rbp, 0x10
test esi, esi
jne 0x180019600
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800196b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov esi, r9d
mov rbp, r8
shr esi, 4
mov rbx, rdx
mov r15, rcx
test esi, esi
je 0x180019798
mov qword [rsp + 0x40], rdi
lea rdi, [rcx + 0xf4]
mov qword [rsp + 0x48], r14
nop word [rax + rax]
movups xmm0, xmmword [rbp]
mov r8, rbx
lea rdx, [r15 + 0x104]
mov rcx, r15
dec esi
movups xmmword [r15 + 0x104], xmm0
call fcn.180017f30
movzx eax, dil
or al, bl
test al, 7
jne 0x18001972a
mov rax, qword [rdi]
xor qword [rbx], rax
mov rax, qword [rdi + 8]
xor qword [rbx + 8], rax
jmp 0x180019773
lea rax, [rdi + 0xf]
cmp rbx, rax
ja 0x180019763
lea rax, [rbx + 0xf]
cmp rax, rdi
jb 0x180019763
mov r8, rdi
mov rax, rbx
sub r8, rbx
mov edx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180019750
jmp 0x180019773
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
movups xmm0, xmmword [r15 + 0x104]
add rbx, 0x10
add rbp, 0x10
movups xmmword [rdi], xmm0
test esi, esi
jne 0x1800196f0
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x180019850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx r10d, byte [rcx]
mov edi, r9d
movzx r11d, byte [rcx + 1]
mov rbx, r8
mov rsi, rdx
test r9d, r9d
je 0x1800198c2
sub rsi, rbx
nop dword [rax]
movzx r9d, byte [r10 + rcx + 2]
lea rbx, [rbx + 1]
lea eax, [r9 + r11]
movzx r11d, al
lea eax, [r10 + 1]
movzx edx, byte [r11 + rcx + 2]
mov byte [r10 + rcx + 2], dl
movzx r10d, al
mov byte [r11 + rcx + 2], r9b
lea eax, [r9 + rdx]
movzx edx, al
movzx eax, byte [rdx + rcx + 2]
xor al, byte [rbx - 1]
mov byte [rsi + rbx - 1], al
add edi, 0xffffffff
jne 0x180019880
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov byte [rcx + 1], r11b
mov byte [rcx], r10b
ret
Function at 0x18001ea00
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r15
mov r12, r9
lea r10d, [rdx + 0x3f]
shr r10d, 6
xor esi, esi
mov r11d, edx
mov r15, r8
sub r11d, r10d
mov ebx, edx
inc r11d
mov rdi, rcx
mov eax, esi
lea r9d, [r11 + r11*2]
shr r9d, 2
cmp r9d, dword [r12]
jbe 0x18001ea4a
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x40]
pop r15
pop r12
pop rdi
pop rsi
ret
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r14
cmp edx, 3
jbe 0x18001eba5
lea r13, [0x18004b6e0]
nop dword [rax]
mov ecx, eax
inc eax
movzx r8d, byte [rax + rdi]
inc eax
movzx edx, byte [rcx + rdi]
movzx ebp, byte [rax + rdi]
inc eax
movzx r10d, byte [rax + rdi]
inc eax
test dl, dl
je 0x18001eba5
cmp dl, 0x2b
jb 0x18001ebc6
cmp r8b, 0x2b
jb 0x18001ebc6
cmp bpl, 0x2b
jb 0x18001ebc6
cmp r10b, 0x2b
jb 0x18001ebc6
cmp dl, 0x7a
ja 0x18001ebc6
cmp r8b, 0x7a
ja 0x18001ebc6
cmp bpl, 0x7a
ja 0x18001ebc6
cmp r10b, 0x7a
ja 0x18001ebc6
movzx r14d, byte [rdx + r13 - 0x2b]
movzx r11d, byte [r8 + r13 - 0x2b]
cmp bpl, 0x3d
jne 0x18001eaf9
xor r8b, r8b
jmp 0x18001eaff
movzx r8d, byte [rbp + r13 - 0x2b]
cmp r10b, 0x3d
jne 0x18001eb09
xor cl, cl
jmp 0x18001eb0f
movzx ecx, byte [r10 + r13 - 0x2b]
shl r14b, 2
movzx edx, r11b
shr dl, 4
movzx r9d, r8b
or dl, r14b
shl r9b, 6
mov byte [rsi + r15], dl
or r9b, cl
inc esi
cmp bpl, 0x3d
je 0x18001eb45
shr r8b, 2
shl r11b, 4
or r8b, r11b
mov byte [rsi + r15], r8b
inc esi
cmp r10b, 0x3d
je 0x18001eba5
mov byte [rsi + r15], r9b
inc esi
add ebx, 0xfffffffc
je 0x18001eb9c
movzx edx, byte [rax + rdi]
cmp dl, 0x20
ja 0x18001eb9c
movabs r8, 0x100002400
bt r8, rdx
jae 0x18001eb9c
inc eax
add ebx, 0xffffffff
je 0x18001eb86
cmp dl, 0x20
jne 0x18001eb86
movzx edx, byte [rax + rdi]
inc eax
add ebx, 0xffffffff
jne 0x18001eb76
cmp dl, 0xd
jne 0x18001eb97
test ebx, ebx
je 0x18001ebc6
movzx edx, byte [rax + rdi]
inc eax
dec ebx
cmp dl, 0xa
jne 0x18001ebc6
cmp ebx, 3
ja 0x18001ea70
mov dword [r12], esi
xor eax, eax
mov r13, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
pop r15
pop r12
pop rdi
pop rsi
ret
mov eax, 0xffffff66
jmp 0x18001ebab
Function at 0x180020a70
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x180055010]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov dword [rsp + 0x6c], 0x67452301
mov rbx, r8
mov dword [rsp + 0x70], 0xefcdab89
mov r8d, edx
mov dword [rsp + 0x74], 0x98badcfe
mov rdx, rcx
mov dword [rsp + 0x78], 0x10325476
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x7c], 0xc3d2e1f0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
call fcn.18002c200
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.18002c470
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18002d8d0
add rsp, 0x90
pop rbx
ret
Function at 0x180020bb0
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, r9d
mov r9, r8
mov byte [rcx + 0x10d], 0
mov rbx, rcx
mov byte [rcx + 0x10c], dl
lea rdi, [rcx + 0x6c]
lea r14, [rcx + 0xac]
test edx, edx
je 0x180020c3a
cmp edx, 1
je 0x180020c33
cmp edx, 2
jne 0x180020c72
mov dword [rcx + 0xc], 0x6a09e667
mov dword [rcx + 0x10], 0xbb67ae85
mov dword [rcx + 0x14], 0x3c6ef372
mov dword [rcx + 0x18], 0xa54ff53a
mov dword [rcx + 0x1c], 0x510e527f
mov dword [rcx + 0x20], 0x9b05688c
mov dword [rcx + 0x24], 0x1f83d9ab
mov dword [rcx + 0x28], 0x5be0cd19
jmp 0x180020c56
mov dword [rcx + 0x5c], 0xc3d2e1f0
mov dword [rcx + 0x58], 0x10325476
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x4c], 0x67452301
xor eax, eax
mov dword [rcx + 8], eax
mov qword [rcx], rax
movzx ecx, dl
lea ebp, [rax + 0x40]
test dl, dl
je 0x180020cd2
sub ecx, 1
je 0x180020cae
cmp ecx, 1
je 0x180020c7c
mov eax, 0xffffff53
jmp 0x180020dd6
mov rdx, r9
cmp esi, ebp
jbe 0x180020cd9
mov r8d, esi
mov rcx, rbx
call fcn.18002cf90
test eax, eax
jne 0x180020dd6
mov rdx, rdi
mov rcx, rbx
call fcn.18002d200
test eax, eax
jne 0x180020dd6
lea esi, [rax + 0x20]
jmp 0x180020d05
mov rdx, r9
cmp esi, ebp
jbe 0x180020cd9
mov r8d, esi
mov rcx, rbx
call fcn.18002c200
mov rdx, rdi
mov rcx, rbx
call fcn.18002c470
mov esi, socket
jmp 0x180020d05
mov rdx, r9
cmp esi, ebp
ja 0x180020cea
mov r8, rsi
mov rcx, rdi
call fcn.18002fd00
cmp esi, ebp
jae 0x180020d17
jmp 0x180020d05
mov r8d, esi
mov rcx, rbx
call fcn.1800293e0
mov rdx, rdi
mov rcx, rbx
call fcn.180029490
mov esi, reloc.WS2_32.dll_recv
mov r8d, ebp
mov ecx, esi
sub r8d, esi
add rcx, rdi
xor edx, edx
call fcn.18002fae0
lea rax, [r14 + 0x3f]
lea rcx, [rbx + 0xab]
cmp rdi, rax
ja 0x180020d4b
cmp rcx, r14
jb 0x180020d4b
nop dword [rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
xor al, 0x5c
mov byte [rdi + 0x3f], al
xor byte [rdi - 1], 0x36
sub rbp, 1
jne 0x180020d30
jmp 0x180020dd4
movdqu xmm1, xmmword [rdi]
movdqa xmm3, xmmword [0x18004cc90]
movdqa xmm2, xmmword [0x18004cca0]
movdqa xmm0, xmm1
pxor xmm1, xmm3
pxor xmm0, xmm2
movdqu xmmword [rdi], xmm1
movdqu xmm1, xmmword [rbx + 0x7c]
movdqu xmmword [r14], xmm0
movdqa xmm0, xmm1
pxor xmm1, xmm3
movdqu xmmword [rbx + 0x7c], xmm1
movdqu xmm1, xmmword [rbx + 0x8c]
pxor xmm0, xmm2
movdqu xmmword [r14 + 0x10], xmm0
movdqa xmm0, xmm1
pxor xmm1, xmm3
movdqu xmmword [rbx + 0x8c], xmm1
movdqu xmm1, xmmword [rbx + 0x9c]
pxor xmm0, xmm2
movdqu xmmword [r14 + 0x20], xmm0
movdqa xmm0, xmm1
pxor xmm1, xmm3
pxor xmm0, xmm2
movdqu xmmword [r14 + 0x30], xmm0
movdqu xmmword [rbx + 0x9c], xmm1
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180029490
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 4]
lea rdi, [rcx + 0xc]
mov rbx, rcx
mov rsi, rdx
mov ecx, dword [rcx]
lea eax, [rcx + r8]
mov dword [rbx + 4], eax
cmp eax, r8d
jae 0x1800294c3
inc dword [rbx + 8]
mov byte [rcx + rdi], 0x80
xor ebp, ebp
mov ecx, dword [rbx]
inc ecx
mov dword [rbx], ecx
cmp ecx, 0x38
jbe 0x1800294f9
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.18002fae0
mov rcx, rbx
mov dword [rbx], 0x40
call fcn.180028c10
mov ecx, ebp
mov dword [rbx], ebp
mov r8d, 0x38
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.18002fae0
mov edx, dword [rbx + 4]
mov ecx, edx
mov eax, dword [rbx + 8]
shr ecx, 0x1d
lea ecx, [rcx + rax*8]
mov dword [rbx + 8], ecx
lea eax, [rdx*8]
mov dword [rbx + 4], eax
mov rcx, rbx
mov dword [rdi + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0x3c], eax
call fcn.180028c10
movups xmm0, xmmword [rbx + 0x4c]
movups xmmword [rsi], xmm0
mov rsi, qword [rsp + 0x40]
mov qword [rbx], rbp
mov dword [rbx + 8], ebp
mov rbp, qword [rsp + 0x38]
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180029580
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xe0
mov rax, qword [0x180055010]
xor rax, rsp
mov qword [rbp - 9], rax
mov r13, qword [rbp + 0x67]
mov eax, 0x1b8
mov r15, qword [rbp + 0x77]
mov ecx, eax
mov r12d, dword [rbp + 0x7f]
movzx r14d, r9b
ror ecx, 8
mov rbx, rdx
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
mov byte [rsp + 0x28], r9b
or ecx, eax
mov byte [rsp + 0x20], 1
mov dword [rsp + 0x30], ecx
mov edi, 0x37
xor ecx, ecx
mov esi, ecx
nop
mov dword [rsp + 0x48], ecx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x4c], 0x6a09e667
mov r8d, 1
mov dword [rsp + 0x50], 0xbb67ae85
mov dword [rsp + 0x54], 0x3c6ef372
mov dword [rsp + 0x58], 0xa54ff53a
mov dword [rbp - 0x7d], 0x510e527f
mov dword [rbp - 0x79], 0x9b05688c
mov dword [rbp - 0x75], 0x1f83d9ab
mov dword [rbp - 0x71], 0x5be0cd19
mov qword [rsp + 0x40], 0
call fcn.18002cf90
test eax, eax
jne 0x180029740
lea r8d, [rax + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.18002cf90
test eax, eax
jne 0x180029740
cmp r14b, 4
je 0x180029698
lea r8d, [rax + 1]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.18002cf90
test eax, eax
jne 0x180029740
movzx r14d, byte [rsp + 0x28]
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, r13
call fcn.18002cf90
test eax, eax
jne 0x180029740
test r15, r15
je 0x1800296cf
test r12d, r12d
je 0x1800296cf
mov r8d, r12d
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.18002cf90
test eax, eax
jne 0x180029740
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.18002d200
test eax, eax
jne 0x180029740
cmp edi, 0x20
jbe 0x1800296fe
movups xmm0, xmmword [rbp - 0x29]
add edi, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
add rbx, 0x20
jmp 0x18002970d
mov r8d, edi
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.18002fd00
inc byte [rsp + 0x20]
inc esi
mov ecx, 0
cmp esi, 2
jl 0x1800295f0
mov ecx, 0x20
lea rax, [rbp - 0x29]
nop word [rax + rax]
mov byte [rax], 0
lea rax, [rax + 1]
add ecx, 0xffffffff
jne 0x180029730
xor eax, eax
jmp 0x180029745
mov eax, 2
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.18002d8d0
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180029870
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
mov rax, qword [0x180055010]
xor rax, rsp
mov qword [rbp + 0xf], rax
movups xmm0, xmmword [r9]
mov eax, dword [r9 + 0x30]
test r8d, r8d
movups xmm1, xmmword [r9 + 0x10]
mov r13d, 0
mov dword [rbp + 7], eax
movzx eax, word [r9 + 0x34]
mov rdi, rcx
mov ecx, r13d
mov word [rbp + 0xb], ax
movzx eax, byte [r9 + 0x36]
mov esi, 1
cmovne esi, r8d
mov byte [rbp + 0xd], al
test sil, 0x1f
lea ebx, [r13 + 0x37]
mov r15d, esi
mov r14, rdx
setne cl
mov r12d, r13d
movups xmmword [rbp - 0x29], xmm0
shr r15d, 5
movups xmm0, xmmword [r9 + 0x20]
movups xmmword [rbp - 0x19], xmm1
movups xmmword [rbp - 9], xmm0
add r15d, ecx
je 0x180029a3b
nop dword [rax]
nop word [rax + rax]
mov r8d, ebx
mov dword [rsp + 0x4c], 0x6a09e667
lea rdx, [rbp - 0x29]
mov dword [rsp + 0x50], 0xbb67ae85
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x54], 0x3c6ef372
mov dword [rsp + 0x58], 0xa54ff53a
mov dword [rbp - 0x7d], 0x510e527f
mov dword [rbp - 0x79], 0x9b05688c
mov dword [rbp - 0x75], 0x1f83d9ab
mov dword [rbp - 0x71], 0x5be0cd19
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x48], r13d
call fcn.18002cf90
test eax, eax
jne 0x180029a75
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.18002d200
test eax, eax
jne 0x180029a75
cmp dword [rdi], 1
mov eax, dword [rsp + 0x20]
jbe 0x1800299b0
cmp eax, dword [rdi + 4]
jne 0x1800299b0
cmp byte [rdi + 0x76], 1
je 0x180029a6e
cmp r12d, r15d
lea eax, [r15 + 1]
mov cl, 1
cmovne eax, r15d
mov r15d, eax
jmp 0x1800299b5
mov dword [rdi + 4], eax
xor cl, cl
mov byte [rdi + 0x76], cl
cmp esi, 0x20
jb 0x180029a13
movups xmm0, xmmword [rsp + 0x20]
add esi, 0xffffffe0
lea rcx, [rbp + 0xb]
movups xmm1, xmmword [rsp + 0x30]
mov edx, 0x36
lea rax, [rbp + 0xb]
movups xmmword [r14], xmm0
movups xmmword [r14 + 0x10], xmm1
add r14, 0x20
sub rdx, rcx
add byte [rax + 2], 1
jne 0x180029a2f
add byte [rax + 1], 1
jne 0x180029a2f
add byte [rax], 1
jne 0x180029a2f
add byte [rax - 1], 1
jne 0x180029a2f
add byte [rax - 2], 1
jne 0x180029a2f
sub rax, 5
lea rcx, [rdx + rax]
test rcx, rcx
jns 0x1800299e7
jmp 0x180029a2f
test r14, r14
je 0x180029a2f
test esi, esi
je 0x180029a2f
mov r8d, esi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.18002fd00
mov esi, r13d
inc r12d
cmp r12d, r15d
jl 0x180029910
lea rax, [rbp - 0x29]
nop
mov byte [rax], r13b
lea rax, [rax + 1]
add ebx, 0xffffffff
jne 0x180029a40
xor eax, eax
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.18002d8d0
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 4
jmp 0x180029a4e
mov eax, 2
jmp 0x180029a4e
Function at 0x18002a130
Capabilities:
Create new key via cryptacquirecontext
Generate random numbers via winapi

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180055010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x18002a274
test rdx, rdx
je 0x18002a274
cmp r8d, 0x10000
ja 0x18002a274
cmp byte [rcx + 0x10], 1
je 0x18002a17f
mov eax, 0xffffff39
jmp 0x18002a279
mov rcx, qword [rcx]
call fcn.180029a80
mov ecx, eax
cmp eax, 3
jne 0x18002a251
lea ecx, [rax - 2]
call fcn.18002a550
test eax, eax
jne 0x18002a25e
mov qword [rsp + 0x68], rbx
lea r9d, [rax + 1]
xor r8d, r8d
mov qword [rsp + 0x60], r14
xor edx, edx
mov dword [rsp + 0x20], 0xf0000000
lea rcx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0x20
test eax, eax
je 0x18002a22a
mov rcx, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x18002a22a
mov rcx, qword [rdi + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
mov r8d, ebx
call fcn.180029770
test eax, eax
jne 0x18002a22a
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.180029a80
mov ecx, eax
test eax, eax
jne 0x18002a22f
mov rcx, qword [rdi]
mov r8d, ebp
mov rdx, rsi
call fcn.180029a80
mov ecx, eax
jmp 0x18002a22f
mov ecx, 2
mov r14, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
nop dword [rax]
mov byte [rax], 0
lea rax, [rax + 1]
add ebx, 0xffffffff
jne 0x18002a240
mov rbx, qword [rsp + 0x68]
test ecx, ecx
jne 0x18002a259
xor eax, eax
jmp 0x18002a279
cmp ecx, 4
jne 0x18002a269
mov eax, 0xffffff2f
mov byte [rdi + 0x10], 3
jmp 0x18002a279
mov eax, 0xffffff39
mov byte [rdi + 0x10], 2
jmp 0x18002a279
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002d8d0
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002a550
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x180055010]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
test ecx, ecx
je 0x18002a655
lea r9, [0x18004c008]
mov dword [rsp + 0x20], 0x20
lea rdx, str.c63w
mov ecx, 1
call fcn.18002a380
mov ecx, eax
test eax, eax
jne 0x18002a70b
xorps xmm4, xmm4
lea rdx, [0x180000000]
xorps xmm3, xmm3
xor ebx, ebx
nop word [rax + rax]
movd xmm2, dword [rbx + rdx + 0x4c090]
xorps xmm0, xmm0
movd xmm1, dword [rsp + rbx + 0x40]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [rsp + rbx + 0x44]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [rbx + rdx + 0x4c094]
add rbx, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rbx, 0x80
jl 0x18002a5c0
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x18002a64e
mov eax, 0xffffffff
jmp 0x18002a70b
mov eax, ecx
jmp 0x18002a70b
xor ebx, ebx
lea rdx, [0x18004c058]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call fcn.18002a380
test eax, eax
jne 0x18002a70b
xorps xmm4, xmm4
lea rdx, [0x180000000]
xorps xmm3, xmm3
movd xmm2, dword [rbx + rdx + 0x4c110]
xorps xmm0, xmm0
movd xmm1, dword [rsp + rbx + 0x40]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [rsp + rbx + 0x44]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [rbx + rdx + 0x4c114]
add rbx, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rbx, 0x80
jl 0x18002a681
por xmm3, xmm4
mov edx, 0xffffffff
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
test ecx, ecx
cmovne eax, edx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18002d8d0
add rsp, 0xd0
pop rbx
ret
Function at 0x18002d770
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov r9, qword [0x180056fb0]
lea r8, [0x180002150]
xor eax, eax
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
add rsp, 0x38
ret