joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180109d70
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
mov r9, r8
lea r8, [0x1802a0b30]
jmp 0x180109d80

Function at 0x180109d80
Capabilities:
Encode data using base64

Disassembly:
mov r11, rsp
push rbx
push rsi
push r12
push r15
sub rsp, 0x158
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, r9
mov r15, r8
mov esi, edx
mov r12, rcx
test edx, edx
je 0x180109fee
test rcx, rcx
je 0x180109fee
lea ecx, [rdx*4 + 8]
mov qword [r11 - 0x28], rbp
mov eax, 0xaaaaaaab
mov qword [r11 - 0x30], rdi
mul ecx
mov qword [r11 - 0x38], r14
mov ecx, edx
xor edx, edx
shr ecx, 1
lea eax, [rcx + rcx]
div esi
lea edx, [rcx + 3]
mov rcx, rbx
add edx, eax
call fcn.1800d67f0
test al, al
je 0x180109fea
mov eax, 0xaaaaaaab
xor ebp, ebp
mul esi
xor r9d, r9d
xor edi, edi
mov r14d, edx
shr r14d, 1
je 0x180109eed
xor r10d, r10d
nop word [rax + rax]
movsx rcx, byte [rbp + r12]
add r9d, 4
mov eax, ecx
inc ebp
shr rax, 2
and ecx, 3
and eax, 0x3f
shl rcx, 4
movsx r8, byte [rbp + r12]
inc ebp
movzx eax, byte [rax + r15]
mov byte [rsp + r10 + 0x20], al
mov eax, r8d
movsx edx, byte [rbp + r12]
inc ebp
shr rax, 4
and eax, 0xf
or rcx, rax
movzx eax, byte [rcx + r15]
mov rcx, r8
mov byte [rsp + r10 + 0x21], al
and ecx, 0xf
mov eax, edx
shl rcx, 2
shr rax, 6
and edx, 0x3f
and eax, 3
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rsp + r10 + 0x22], al
movzx eax, byte [rdx + r15]
mov byte [rsp + r10 + 0x23], al
add r10, 4
cmp r9d, 0x100
jl 0x180109ec5
mov r8d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800d3f30
test al, al
je 0x180109fea
xor r9d, r9d
xor r10d, r10d
inc edi
cmp edi, r14d
jb 0x180109e20
test r9d, r9d
je 0x180109eed
mov r8d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800d3f30
test al, al
je 0x180109fea
lea eax, [r14 + r14*2]
mov cl, 1
sub esi, eax
sub esi, 1
je 0x180109f5b
cmp esi, 1
jne 0x180109fb1
movzx esi, byte [rbp + r12]
lea eax, [rbp + 1]
movzx edi, byte [rax + r12]
mov rcx, rbx
mov eax, esi
shr rax, 2
movzx edx, byte [rax + r15]
call fcn.1800d3140
test al, al
je 0x180109faf
and esi, 3
mov eax, edi
shr rax, 4
shl esi, 4
mov ecx, esi
or rcx, rax
movzx edx, byte [rcx + r15]
mov rcx, rbx
call fcn.1800d3140
test al, al
je 0x180109faf
and edi, 0xf
shl edi, 2
movzx edx, byte [rdi + r15]
jmp 0x180109f91
movzx edi, byte [rbp + r12]
mov rcx, rbx
mov eax, edi
shr rax, 2
movzx edx, byte [rax + r15]
call fcn.1800d3140
test al, al
je 0x180109faf
and edi, 3
mov rcx, rbx
shl edi, 4
movzx edx, byte [rdi + r15]
call fcn.1800d3140
test al, al
je 0x180109faf
mov dl, 0x3d
mov rcx, rbx
call fcn.1800d3140
test al, al
je 0x180109faf
mov dl, 0x3d
mov rcx, rbx
call fcn.1800d3140
test al, al
je 0x180109faf
mov cl, 1
jmp 0x180109fb1
xor cl, cl
movzx eax, cl
mov rdi, qword [rsp + 0x148]
mov rbp, qword [rsp + 0x150]
mov r14, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x158
pop r15
pop r12
pop rsi
pop rbx
ret
xor al, al
jmp 0x180109fb4
mov al, 1
jmp 0x180109fcc
mov r9, r8
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
jmp 0x180109d80
Function at 0x18010a160
Capabilities:
Encode data using base64

Disassembly:
mov r11, rsp
push rbx
push rsi
push r12
push r15
sub rsp, 0x158
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, r9
mov r15, r8
mov esi, edx
mov r12, rcx
test edx, edx
je 0x180109fee
test rcx, rcx
je 0x180109fee
lea ecx, [rdx*4 + 8]
mov qword [r11 - 0x28], rbp
mov eax, 0xaaaaaaab
mov qword [r11 - 0x30], rdi
mul ecx
mov qword [r11 - 0x38], r14
mov ecx, edx
xor edx, edx
shr ecx, 1
lea eax, [rcx + rcx]
div esi
lea edx, [rcx + 3]
mov rcx, rbx
add edx, eax
call fcn.1800d67f0
test al, al
je 0x180109fea
mov eax, 0xaaaaaaab
xor ebp, ebp
mul esi
xor r9d, r9d
xor edi, edi
mov r14d, edx
shr r14d, 1
je 0x180109eed
xor r10d, r10d
nop word [rax + rax]
movsx rcx, byte [rbp + r12]
add r9d, 4
mov eax, ecx
inc ebp
shr rax, 2
and ecx, 3
and eax, 0x3f
shl rcx, 4
movsx r8, byte [rbp + r12]
inc ebp
movzx eax, byte [rax + r15]
mov byte [rsp + r10 + 0x20], al
mov eax, r8d
movsx edx, byte [rbp + r12]
inc ebp
shr rax, 4
and eax, 0xf
or rcx, rax
movzx eax, byte [rcx + r15]
mov rcx, r8
mov byte [rsp + r10 + 0x21], al
and ecx, 0xf
mov eax, edx
shl rcx, 2
shr rax, 6
and edx, 0x3f
and eax, 3
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rsp + r10 + 0x22], al
movzx eax, byte [rdx + r15]
mov byte [rsp + r10 + 0x23], al
add r10, 4
cmp r9d, 0x100
jl 0x180109ec5
mov r8d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800d3f30
test al, al
je 0x180109fea
xor r9d, r9d
xor r10d, r10d
inc edi
cmp edi, r14d
jb 0x180109e20
test r9d, r9d
je 0x180109eed
mov r8d, r9d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800d3f30
test al, al
je 0x180109fea
lea eax, [r14 + r14*2]
mov cl, 1
sub esi, eax
sub esi, 1
je 0x180109f5b
cmp esi, 1
jne 0x180109fb1
movzx esi, byte [rbp + r12]
lea eax, [rbp + 1]
movzx edi, byte [rax + r12]
mov rcx, rbx
mov eax, esi
shr rax, 2
movzx edx, byte [rax + r15]
call fcn.1800d3140
test al, al
je 0x180109faf
and esi, 3
mov eax, edi
shr rax, 4
shl esi, 4
mov ecx, esi
or rcx, rax
movzx edx, byte [rcx + r15]
mov rcx, rbx
call fcn.1800d3140
test al, al
je 0x180109faf
and edi, 0xf
shl edi, 2
movzx edx, byte [rdi + r15]
jmp 0x180109f91
movzx edi, byte [rbp + r12]
mov rcx, rbx
mov eax, edi
shr rax, 2
movzx edx, byte [rax + r15]
call fcn.1800d3140
test al, al
je 0x180109faf
and edi, 3
mov rcx, rbx
shl edi, 4
movzx edx, byte [rdi + r15]
call fcn.1800d3140
test al, al
je 0x180109faf
mov dl, 0x3d
mov rcx, rbx
call fcn.1800d3140
test al, al
je 0x180109faf
mov dl, 0x3d
mov rcx, rbx
call fcn.1800d3140
test al, al
je 0x180109faf
mov cl, 1
jmp 0x180109fb1
xor cl, cl
movzx eax, cl
mov rdi, qword [rsp + 0x148]
mov rbp, qword [rsp + 0x150]
mov r14, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x158
pop r15
pop r12
pop rsi
pop rbx
ret
xor al, al
jmp 0x180109fb4
mov al, 1
jmp 0x180109fcc
mov r9, r8
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
jmp 0x180109d80
Function at 0x180120960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x20], 0
mov rbx, rcx
jne 0x180120a35
mov qword [rsp + 0x88], rdi
lea rdx, [rsp + 0x20]
xor edi, edi
mov word [rsp + 0x28], 0x101
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x2a], dil
call fcn.1801207b0
cmp byte [0x1803883b0], dil
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x30], rax
jne 0x1801209c5
call fcn.18023005c
mov byte [0x1803883b0], 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.18022f26c
movzx eax, word [rsp + 0x4c]
mov ecx, 0x76c
add ax, cx
mov word [rbx + 0x1e], di
mov rdi, qword [rsp + 0x88]
mov word [rbx + 0x10], ax
movzx eax, word [rsp + 0x48]
inc ax
mov dword [rbx + 0x24], 0xffffffff
mov word [rbx + 0x12], ax
movzx eax, word [rsp + 0x50]
mov word [rbx + 0x14], ax
movzx eax, word [rsp + 0x44]
mov word [rbx + 0x16], ax
movzx eax, word [rsp + 0x40]
mov word [rbx + 0x18], ax
movzx eax, word [rsp + 0x3c]
mov word [rbx + 0x1a], ax
movzx eax, word [rsp + 0x38]
mov word [rbx + 0x1c], ax
mov byte [rbx + 0x20], 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x70
pop rbx
ret
Function at 0x1801250d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, r8
mov rdi, rcx
mov qword [rsp + 0x20], rcx
cmp dword [rcx + 8], 0x62cb09e3
je 0x180125113
xor al, al
jmp 0x1801252bd
xor esi, esi
mov r15d, esi
test rdx, rdx
cmovns r15, rdx
cmp byte [r8 + 0x167], sil
je 0x18012514c
cmp byte [rcx + 0xdc], sil
jne 0x18012514c
cmp qword [rcx + 0xb8], rsi
jle 0x18012514c
mov r8, r15
lea rdx, str.consumeProgress
mov rcx, r14
call fcn.1801061b0
mov byte [rsp + 0x30], sil
mov r13d, esi
movzx ebx, byte [rdi + 0xdc]
test bl, bl
jne 0x180125218
mov r12, qword [rdi + 0xb8]
test r12, r12
jle 0x1801251f7
mov rbx, qword [rdi + 0xc0]
mov r8, r12
mov rdx, rbx
mov rcx, rdi
call fcn.180125790
mov r13d, eax
lea rax, [rbx + r15]
mov qword [rdi + 0xc0], rax
xor bl, bl
cmp rax, r12
jle 0x1801251f7
cmp byte [r14 + 0x167], bl
je 0x1801251f0
mov rax, qword [r14]
lea rdx, str.Amount_consumed_is_greater_than_the_total.
mov rcx, r14
call qword [rax + 0x28]
mov r8, qword [rdi + 0xc0]
lea rdx, str.m_consumed64
mov rcx, r14
call fcn.1801061b0
mov r8, qword [rdi + 0xb8]
lea rdx, str.m_totalAmount64
mov rcx, r14
call fcn.1801061b0
mov r12, qword [rdi + 0xb8]
movzx ebx, byte [rdi + 0xdc]
mov qword [rdi + 0xc0], r12
test bl, bl
jne 0x180125218
mov r8, qword [rdi + 0xb8]
test r8, r8
jle 0x180125218
mov rdx, qword [rdi + 0xc0]
mov rcx, rdi
call fcn.180125790
mov esi, eax
cmp qword [rdi + 0xa8], 0
je 0x1801252b6
test bl, bl
jne 0x1801252da
cmp esi, r13d
jbe 0x1801252da
cmp esi, dword [rdi + 0xa0]
jbe 0x1801252da
call sub.KERNEL32.dll_GetTickCount
mov dword [rdi + 0xb4], eax
cmp byte [rdi + 0xde], bl
je 0x18012525e
cmp esi, dword [rdi + 0xd4]
je 0x1801252a8
mov dword [rdi + 0xa0], esi
cmp byte [r14 + 0x167], 0
je 0x180125281
mov r8d, esi
lea rdx, str.percentDoneCB
mov rcx, r14
call fcn.180106220
nop
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x18012529e
mov rax, qword [rcx]
lea r8, [rsp + 0x30]
mov edx, esi
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x180125339
cmp byte [rsp + 0x30], 0
je 0x1801252b6
mov byte [rdi + 0xb1], 1
movzx eax, byte [rdi + 0xb1]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
cmp byte [rdi + 0xdd], 0
jne 0x1801252b6
cmp dword [rdi + 0xd0], 0
je 0x1801252b6
call sub.KERNEL32.dll_GetTickCount
mov edx, eax
mov ecx, eax
sub ecx, dword [rdi + 0xb4]
mov eax, dword [rdi + 0xd0]
mov r8d, 0x12c
test eax, eax
cmove eax, r8d
cmp ecx, eax
jbe 0x1801252b6
mov dword [rdi + 0xd8], edx
mov dword [rdi + 0xb4], edx
mov rcx, qword [rdi + 0xa8]
cmp dword [rcx + 0x10], 0x77109acd
jne 0x180125339
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x18]
nop
jmp 0x1801252a8
Function at 0x180126b00
Capabilities:
Create thread

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
mov rax, qword [0x1803883d0]
test rax, rax
jne 0x180126cca
cmp byte [0x1803883b9], al
jne 0x180126c7b
cmp byte [0x1803883ba], al
jne 0x180126c84
cmp byte [0x1803883b8], al
jne 0x180126cbb
cmp byte [0x1803883bb], al
jne 0x180126cbb
cmp byte [0x1803883bc], al
jne 0x180126cbb
mov byte [0x1803883ba], 1
call fcn.180126d50
mov rsi, rax
mov qword [0x1803883d0], rax
test rax, rax
jne 0x180126ba0
mov byte [0x1803883ba], al
jmp 0x180126cc8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
lea r8, str.startupThreadPool
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180105b50
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r9, rsi
lea r8, [0x180126ad0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
je 0x180126bf9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
setne bpl
test rsi, rsi
jne 0x180126c0e
mov rcx, rdi
call fcn.180106a70
nop
lea rcx, [rsp + 0x40]
call fcn.180105c80
test bpl, bpl
je 0x180126c37
mov byte [0x1803883b9], 1
mov byte [0x1803883ba], 0
mov rax, qword [0x1803883d0]
jmp 0x180126cca
mov rcx, qword [0x1803883d0]
mov qword [0x1803883d0], rbx
test rcx, rcx
je 0x180126c54
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov byte [0x1803883b9], 0
mov byte [0x1803883ba], 0
mov rax, qword [rdi]
lea rdx, str.Failed_to_start_threadPool_thread.
mov rcx, rdi
call qword [rax + 0x28]
mov rax, qword [0x1803883d0]
jmp 0x180126cca
cmp byte [0x1803883ba], 0
je 0x180126cbb
xor ebx, ebx
mov ecx, 5
call fcn.180104b90
inc ebx
cmp ebx, 0xc8
ja 0x180126cac
cmp byte [0x1803883ba], 0
jne 0x180126c86
mov rax, qword [0x1803883d0]
jmp 0x180126cca
mov rax, qword [rdi]
lea rdx, str.Gave_up_waiting_for_another_thread_to_finish_initializing_the_threadPool_thread.
mov rcx, rdi
jmp 0x180126cc5
mov rax, qword [rcx]
lea rdx, str.The_thread_pool_must_be_in_the_pristine_state_to_be_created.
call qword [rax + 0x28]
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18007b140
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180129590
Capabilities:
Hash data using djb2

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
lea rcx, [rsp + 0x30]
call fcn.1800d2750
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x18012960b
xor ecx, ecx
call fcn.1800c57e0
xor bl, bl
jmp 0x180129699
lea rcx, [rsp + 0x30]
call fcn.1800d6d80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x180129640
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x180129630
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x180129691
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180129691
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x180129691
call fcn.180198880
mov rbx, rax
test rax, rax
je 0x180129691
nop dword [rax]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180198910
test al, al
jne 0x180129693
mov rcx, rbx
call fcn.1801988e0
mov rbx, rax
test rax, rax
jne 0x180129670
xor ebx, ebx
test rbx, rbx
setne bl
lea rcx, [rsp + 0x30]
call fcn.1800d28c0
movzx eax, bl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18007b140
add rsp, 0xd0
pop rbx
ret
Function at 0x1801296c0
Capabilities:
Hash data using djb2

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rdi, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x180129708
xor ecx, ecx
call fcn.1800c57e0
xor al, al
jmp 0x180129780
test rbx, rbx
je 0x180129704
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0x30]
call fcn.1800d27d0
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800d2e50
cmp dword [rdi + 0x10], 0x6119a407
je 0x1801297a5
xor ecx, ecx
call fcn.1800c57e0
xor bl, bl
lea rcx, [rsp + 0x30]
call fcn.1800d28c0
movzx eax, bl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18007b140
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp qword [rdi + 0x18], 0
je 0x180129771
lea rcx, [rsp + 0x30]
call fcn.1800d6d80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x1801297e0
nop word [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x1801297d0
xor edx, edx
div dword [rdi + 0x14]
cmp edx, dword [rdi + 0x14]
jae 0x18012976a
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x180129771
lea rsi, [rdx*8]
mov rcx, qword [rsi + rcx]
test rcx, rcx
je 0x180129771
call fcn.180198880
mov rbx, rax
test rax, rax
je 0x180129771
nop dword [rax]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180198910
test al, al
jne 0x180129846
mov rcx, rbx
call fcn.1801988e0
mov rbx, rax
test rax, rax
jne 0x180129820
jmp 0x180129771
test rbx, rbx
je 0x180129771
mov rcx, qword [rdi + 0x18]
mov rdx, rbx
mov rcx, qword [rcx + rsi]
call fcn.180198950
mov bl, 1
jmp 0x180129773

Function at 0x1801298f0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rbx, rcx
je 0x180129911
xor ecx, ecx
call fcn.1800c57e0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rdx
call fcn.1800d6d80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x180129940
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x180129930
xor edx, edx
div dword [rbx + 0x14]
mov eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x180129b60
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rcx
test rdx, rdx
jne 0x180129b90
xor eax, eax
jmp 0x180129bf6
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
lea rcx, [rsp + 0x30]
call fcn.1800d2750
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x180129c0f
xor ecx, ecx
call fcn.1800c57e0
xor ebx, ebx
lea rcx, [rsp + 0x30]
call fcn.1800d28c0
mov rax, rbx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18007b140
add rsp, 0xd0
pop rbx
ret
lea rcx, [rsp + 0x30]
call fcn.1800d6d80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x180129c40
nop dword [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x180129c30
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x180129be7
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180129be7
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x180129be7
call fcn.180198880
mov rbx, rax
test rax, rax
je 0x180129be7
nop dword [rax]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180198910
test al, al
jne 0x180129c96
mov rcx, rbx
call fcn.1801988e0
mov rbx, rax
test rax, rax
jne 0x180129c70
jmp 0x180129be7
test rbx, rbx
je 0x180129be7
mov rcx, rbx
call fcn.1801988b0
mov rbx, rax
jmp 0x180129be9

Function at 0x180129cb0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rdi, rdx
mov rbx, rcx
je 0x180129cdd
xor ecx, ecx
call fcn.1800c57e0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.1800d6d80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x180129d10
nop dword [rax]
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x180129d00
xor edx, edx
mov r8, rdi
div dword [rbx + 0x14]
mov rcx, rbx
call fcn.1801293e0
test rax, rax
je 0x180129cd0
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1801988b0
Function at 0x180129d40
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x180129d83
xor ecx, ecx
call fcn.1800c57e0
xor al, al
jmp 0x180129df9
mov rcx, rsi
call fcn.1800da550
test rdi, rdi
je 0x180129d7f
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1800d2750
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x180129e14
xor ecx, ecx
call fcn.1800c57e0
xor bl, bl
lea rcx, [rsp + 0x30]
call fcn.1800d28c0
movzx eax, bl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18007b140
add rsp, 0xd0
pop rdi
pop rsi
pop rbx
ret
lea rcx, [rsp + 0x30]
call fcn.1800d6d80
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x180129e40
nop dword [rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x180129e30
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x180129dea
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180129dea
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x180129dea
call fcn.180198880
mov rbx, rax
test rax, rax
je 0x180129dea
nop dword [rax]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180198910
test al, al
jne 0x180129e96
mov rcx, rbx
call fcn.1801988e0
mov rbx, rax
test rax, rax
jne 0x180129e70
jmp 0x180129dea
test rbx, rbx
je 0x180129dea
mov rcx, rbx
call fcn.1801988b0
test rax, rax
je 0x180129dea
mov rdx, rax
mov rcx, rsi
call fcn.1800d2b80
mov bl, 1
jmp 0x180129dec

Function at 0x180129ed0
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable._ckMd5.0
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x18012a810
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rbx
mov rbp, r8
mov dword [rcx + 0xc], 0xefcdab89
mov rdi, rdx
mov dword [rcx + 0x10], 0x98badcfe
mov rsi, rcx
mov dword [rcx + 0x14], 0x10325476
cmp dword [rdx + 0xc08], ebx
jbe 0x18012a87f
nop word [rax + rax]
mov r8d, dword [rdi + rbx*4 + 0x808]
mov rcx, rsi
mov rdx, qword [rdi + rbx*8 + 8]
call fcn.18012ab30
inc ebx
cmp ebx, dword [rdi + 0xc08]
jb 0x18012a860
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18012a9f0