joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801b5a50
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1801b5af6
test rdx, rdx
je 0x1801b5af6
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], 0
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1801b5b0f
mov ecx, 0x248
call qword [sym.imp.MSVCR100.dll_malloc]
mov qword [rbx], rax
test rax, rax
jne 0x1801b5ab6
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], ntohl
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov r8d, 0x248
mov rcx, rax
call sub.MSVCR100.dll_memset
mov rdx, qword [rbx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rbx]
mov qword [rcx + 0x140], rax
mov rcx, qword [rbx]
cmp qword [rcx + 0x140], 0xffffffffffffffff
jne 0x1801b5b23
call qword [sym.imp.MSVCR100.dll_free]
mov qword [rbx], 0
call qword [sym.imp.MSVCR100.dll__errno]
mov dword [rax], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rcx
mov rcx, qword [rcx + 0x140]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1801b5b02
mov rcx, qword [rbx]
mov r8d, 0xff
lea rdx, [rcx + 0x2c]
add rcx, 0x148
call qword [sym.imp.MSVCR100.dll_strncpy]
mov r11, qword [rbx]
mov byte [r11 + 0x247], 0
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rax, 0x148
add rsp, 0x20
pop rdi
ret
Function at 0x1801d1de0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, qword [rsp + 0x90]
lea eax, [r8 - 1]
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
cmp eax, 0x7f
ja 0x1801d1f9b
mov rax, qword [rsi]
mov r8, r9
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rax, qword [rsi + 8]
mov rcx, rsi
mov qword [rsp + 0x28], rax
call sym.VBoxRT.dll_AES_encrypt
lea eax, [rbp + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0x98], 0
movsxd r9, eax
je 0x1801d1e8c
test eax, eax
jle 0x1801d1ecd
lea r8, [rsp + 0x30]
mov rdx, rsi
sub r8, rbx
sub rdx, rbx
sub rdi, rbx
nop word [rax + rax]
movzx ecx, byte [rdx + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
dec r9
mov byte [r8 + rbx - 1], cl
mov byte [rdi + rbx - 1], cl
jne 0x1801d1e70
jmp 0x1801d1ecd
xor r8d, r8d
test eax, eax
jle 0x1801d1ecd
lea rax, [rsp + 0x30]
mov r10, rsi
sub rbx, rax
lea rax, [rsp + 0x30]
sub r10, rax
lea rax, [rsp + 0x30]
sub rdi, rax
nop
lea rdx, [rsp + r8 + 0x30]
inc r8
movzx ecx, byte [rbx + rdx]
movzx eax, byte [r10 + rdx]
xor al, cl
mov byte [rdx], cl
mov byte [rdi + rdx], al
cmp r8, r9
jl 0x1801d1eb0
mov eax, ebp
cdq
and edx, 7
add eax, edx
mov ecx, eax
and eax, 7
sub eax, edx
sar ecx, 3
mov r10d, eax
movsxd rcx, ecx
test eax, eax
jne 0x1801d1eff
mov rax, qword [rsp + rcx + 0x20]
mov qword [rsi], rax
mov rax, qword [rsp + rcx + 0x28]
mov qword [rsi + 8], rax
jmp 0x1801d1f9b
mov r11d, 8
lea rbx, [rsp + rcx + 0x21]
mov edi, 4
sub r11b, al
mov rax, rcx
sub rax, rsi
sub rsi, rcx
lea rbp, [rsp + rax + 0x20]
lea rax, [rsp + 0x21]
sub rsi, rax
nop dword [rax + rax]
movzx r9d, byte [rbx]
lea r8, [rsi + rbx]
mov ecx, r10d
movzx edx, byte [r8 + rbp]
movzx eax, r9b
add rbx, 4
shl dl, cl
movzx ecx, r11b
shr al, cl
or dl, al
mov byte [r8], dl
movzx r8d, byte [rbx - 3]
movzx edx, byte [rbx - 2]
movzx eax, r8b
shr al, cl
mov ecx, r10d
shl r9b, cl
shl r8b, cl
movzx ecx, r11b
or al, r9b
mov byte [rsi + rbx - 3], al
movzx eax, dl
shr al, cl
or r8b, al
movzx eax, byte [rbx - 1]
shr al, cl
mov ecx, r10d
mov byte [rsi + rbx - 2], r8b
shl dl, cl
or al, dl
dec rdi
mov byte [rsi + rbx - 1], al
jne 0x1801d1f30
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180227610
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801d2910
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call sym.VBoxRT.dll_AES_set_encrypt_key
test eax, eax
js 0x1801d2b4e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1801d2999
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop word [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x1801d2950
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1801d2b4c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x180000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x33e240]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
mov r9d, dword [rdi + rdx*4 + 0x33ee40]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x33f640]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x33fa40]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
xor r9d, dword [rdi + rcx*4 + 0x33f240]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x33e240]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
mov r8d, dword [rdi + rdx*4 + 0x33ee40]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x33f640]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x33f240]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x33fa40]
mov eax, r9d
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x33e240]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
mov r8d, dword [rdi + rdx*4 + 0x33ee40]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x33f640]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x33f240]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x33fa40]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x33e240]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
mov r8d, dword [rdi + rdx*4 + 0x33f640]
mov eax, r9d
xor r8d, dword [rdi + rcx*4 + 0x33f240]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x33e240]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x33ee40]
movzx ecx, byte [rdi + rax*4 + 0x33e240]
xor r8d, dword [rdi + rcx*4 + 0x33fa40]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1801d29c0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1801db9c0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x1801dbabf
mov qword [rsp], rbx
lea r10, [rdx + 1]
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx ecx, byte [r10 - 1]
cmp r8d, 3
jl 0x1801dba41
movzx eax, byte [r10]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 2], al
movzx eax, byte [rdx + rbx]
mov byte [r9 + 3], al
jmp 0x1801dba96
shl ecx, 0x10
cmp r8d, 2
jne 0x1801dba53
movzx eax, byte [r10]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rbx]
mov byte [r9 + 1], al
cmp r8d, 1
jne 0x1801dba82
lea eax, [r8 + 0x3c]
jmp 0x1801dba8d
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + rbx]
mov byte [r9 + 2], al
mov byte [r9 + 3], 0x3d
sub r8d, 3
add r9, 4
add r11d, 4
add r10, 3
test r8d, r8d
jg 0x1801db9e2
mov rbx, qword [rsp]
mov byte [r9], 0
mov eax, r11d
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x1801dc950
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r13
push r14
sub rsp, 0x68
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xb0]
lea esi, [rdx - 1]
mov ebp, r9d
lea eax, [rsi - 0x29]
mov r13, r8
cmp r9d, eax
jle 0x1801dc9a5
xor r9d, r9d
mov dword [rsp + 0x20], 0
lea edx, [r9 + 0x79]
lea r8d, [r9 + 0x6e]
lea ecx, [rdx - 0x75]
call sym.VBoxRT.dll_ERR_put_error
xor eax, eax
jmp 0x1801dcb6b
cmp esi, 0x29
jge 0x1801dc9cc
xor r9d, r9d
mov dword [rsp + 0x20], 0
lea edx, [r9 + 0x79]
lea r8d, [r9 + 0x78]
lea ecx, [rdx - 0x75]
call sym.VBoxRT.dll_ERR_put_error
xor eax, eax
jmp 0x1801dcb6b
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], r12
mov byte [rcx], 0
lea r12, [rcx + 0x15]
lea rbx, [rcx + 1]
call sym.VBoxRT.dll_EVP_sha1
movsxd rdx, dword [rsp + 0xb8]
xor r9d, r9d
mov r8, r12
mov rcx, r14
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.VBoxRT.dll_EVP_Digest
mov r11d, esi
lea rcx, [r12 + 0x14]
sub r11d, ebp
xor edx, edx
sub r11d, 0x29
movsxd r8, r11d
call sub.MSVCR100.dll_memset
movsxd r11, ebp
movsxd rax, esi
sub rax, r11
mov r8, rbp
mov rdx, r13
lea rcx, [rax + r12 - 0x14]
mov byte [rax + r12 - 0x15], 1
call sub.MSVCR100.dll_memcpy
mov edx, reloc.WS2_32.dll_sendto
mov rcx, rbx
call sym.VBoxRT.dll_RAND_bytes
test eax, eax
jle 0x1801dca88
add esi, 0xffffffec
lea rdx, str.D:_tinderboxwin_4.2_srclibsopenssl_0.9.8ycrypto_rsa_rsa_oaep.c
mov r8d, 0x48
mov ecx, esi
call sym.VBoxRT.dll_CRYPTO_malloc
mov rbp, rax
test rax, rax
jne 0x1801dca8f
lea edx, [rax + 0x79]
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
xor r9d, r9d
mov dword [rsp + 0x20], eax
call sym.VBoxRT.dll_ERR_put_error
xor eax, eax
jmp 0x1801dcb61
mov r9d, reloc.WS2_32.dll_sendto
mov r8, rbx
mov edx, esi
mov rcx, rax
call sym.VBoxRT.dll_MGF1
test esi, esi
jle 0x1801dcad0
mov r11, rbp
mov rcx, r12
mov r10d, esi
sub r11, r12
nop word [rax + rax]
movzx eax, byte [r11 + rcx]
inc rcx
xor byte [rcx - 1], al
dec r10
jne 0x1801dcac0
call sym.VBoxRT.dll_EVP_sha1
lea rcx, [rsp + 0x30]
mov r9d, esi
mov r8, r12
mov edx, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x20], rax
call sym.VBoxRT.dll_PKCS1_MGF1
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x31]
lea r9, [rsp + 0x32]
lea r10, [rsp + 0x33]
lea r11, [rsp + 0x34]
sub rdx, rbx
sub r8, rbx
sub r9, rbx
sub r10, rbx
mov ecx, 4
sub r11, rbx
nop dword [rax]
movzx eax, byte [rdx + rbx]
add rbx, 5
xor byte [rbx - 5], al
movzx eax, byte [r8 + rbx - 5]
xor byte [rbx - 4], al
movzx eax, byte [r9 + rbx - 5]
xor byte [rbx - 3], al
movzx eax, byte [r10 + rbx - 5]
xor byte [rbx - 2], al
movzx eax, byte [r11 + rbx - 5]
xor byte [rbx - 1], al
dec rcx
jne 0x1801dcb20
mov rcx, rbp
call sym.VBoxRT.dll_CRYPTO_free
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180227610
add rsp, 0x68
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x1801dcec0
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x38
mov r10, rcx
cmp dword [rsp + 0x60], r9d
jne 0x1801dcf8c
movzx eax, byte [r8]
cmp al, 0x6a
je 0x1801dcee2
cmp al, 0x6b
jne 0x1801dcf8c
lea rdx, [r8 + 1]
xor r8d, r8d
mov qword [rsp + 0x30], rbx
cmp al, 0x6b
jne 0x1801dcf42
lea ebx, [r9 - 3]
mov eax, r8d
test ebx, ebx
jle 0x1801dcf16
nop dword [rax]
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x1801dcf16
cmp cl, 0xbb
jne 0x1801dcf1c
inc eax
cmp eax, ebx
jl 0x1801dcf00
sub ebx, eax
test eax, eax
jne 0x1801dcf46
mov edx, 0x80
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call sym.VBoxRT.dll_ERR_put_error
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x1801dcf75
mov edx, 0x80
mov dword [rsp + 0x20], r8d
xor r9d, r9d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call sym.VBoxRT.dll_ERR_put_error
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r10
call sub.MSVCR100.dll_memcpy
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
xor r8d, r8d
mov edx, 0x80
xor r9d, r9d
mov dword [rsp + 0x20], r8d
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call sym.VBoxRT.dll_ERR_put_error
or eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x1801e6e10
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ecx, ecx
mov rdx, rbx
mov r11d, eax
cmp byte [rbx], cl
je 0x1801e6e62
nop word [rax + rax]
cmp ecx, 0x80000000
jae 0x1801e6e62
inc rdx
inc ecx
cmp byte [rdx], 0
jne 0x1801e6e50
btr ecx, 0x1f
lea eax, [r11 + 1]
lea r8d, [rcx + 1]
mov ecx, eax
add rax, r8
cmp rax, 0x104
jbe 0x1801e6e7f
xor eax, eax
jmp 0x1801e6e9d
lea rcx, [rsp + rcx + 0x20]
mov rdx, rbx
mov byte [rsp + r11 + 0x20], 0x5c
call sub.MSVCR100.dll_memcpy
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180227610
add rsp, 0x140
pop rbx
ret
Function at 0x1801e6f30
Capabilities:
Capture screenshot

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x98], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1801e6f63
call sym.VBoxRT.dll_OPENSSL_isservice
test eax, eax
jg 0x1801e7189
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rbp
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
mov qword [rsp + 0xc0], r13
lea rcx, str.DISPLAY
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xb0], r15
call qword [sym.imp.GDI32.dll_CreateDCA]
mov rcx, rax
mov r12, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, 8
mov rcx, r12
mov rsi, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edx, 0xa
mov rcx, r12
mov ebx, eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov r8d, reloc.WS2_32.dll_recv
mov edx, ebx
mov rcx, r12
mov ebp, eax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, rsi
mov rdx, rax
mov r15, rax
call qword [sym.imp.GDI32.dll_SelectObject]
lea r8, [rsp + 0x60]
mov edx, 0x20
mov rcx, r15
mov r14, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.GDI32.dll_GetObjectA]
movzx r13d, word [rsp + 0x70]
lea rdx, str.D:_tinderboxwin_4.2_srclibsopenssl_0.9.8ycrypto_rand_rand_win.c
imul r13d, dword [rsp + 0x68]
mov r8d, 0x325
imul r13d, dword [rsp + 0x6c]
mov ecx, r13d
call sym.VBoxRT.dll_CRYPTO_malloc
mov rdi, rax
test rax, rax
je 0x1801e7122
add ebp, 0xfffffff0
xor ebx, ebx
test ebp, ebp
jle 0x1801e711a
movaps xmmword [rsp + 0xa0], xmm6
xorpd xmm6, xmm6
mov r14d, r13d
nop word [rax + rax]
mov r9d, dword [rsp + 0x50]
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.GDI32.dll_BitBlt]
mov r8, rdi
mov edx, r13d
mov rcx, r15
call qword [sym.imp.GDI32.dll_GetBitmapBits]
call sym.VBoxRT.dll_EVP_sha1
lea r8, [rsp + 0x80]
xor r9d, r9d
mov rdx, r14
mov rcx, rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call sym.VBoxRT.dll_EVP_Digest
movapd xmm2, xmm6
lea rcx, [rsp + 0x80]
mov edx, reloc.WS2_32.dll_sendto
call sym.VBoxRT.dll_RAND_add
add ebx, 0x10
cmp ebx, ebp
jl 0x1801e7080
mov r14, qword [rsp + 0x58]
movaps xmm6, xmmword [rsp + 0xa0]
mov rcx, rdi
call sym.VBoxRT.dll_CRYPTO_free
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov r15, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180227610
add rsp, 0xd8
ret
sub rsp, 0x28
call sym.VBoxRT.dll_RAND_poll
add rsp, 0x28
jmp 0x1801e6f30
Function at 0x1801e7b50
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
movaps xmmword [rsp + 0x40], xmm6
xorpd xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm7
movapd xmm7, xmm6
cmp ecx, 0x100
je 0x1801e7bdc
cmp ecx, 0x200
jne 0x1801e7bf4
mov ecx, dword [0x1803db8bc]
mov edx, dword [0x1803db8b8]
movzx r9d, r8w
shr r8, 0x10
movzx r10d, r8w
sub ecx, r10d
sub edx, r9d
je 0x1801e7bc0
test ecx, ecx
je 0x1801e7bc0
cmp edx, dword [0x1803db8cc]
je 0x1801e7bc0
cmp ecx, dword [0x1803db8c8]
je 0x1801e7bc0
movsd xmm7, qword [0x1803493c0]
mov dword [0x1803db8b8], r9d
mov dword [0x1803db8bc], r10d
mov dword [0x1803db8cc], edx
mov dword [0x1803db8c8], ecx
jmp 0x1801e7bf4
cmp qword [0x1803db8c0], rdx
je 0x1801e7bed
movsd xmm7, qword [0x1803493b8]
mov qword [0x1803db8c0], rdx
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x1801e7c30
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1801e7c14
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x1801e7c30
lea rcx, [rsp + 0x20]
movapd xmm2, xmm6
mov edx, 8
call sym.VBoxRT.dll_RAND_add
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x1801e7c4d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x78]
movapd xmm2, xmm6
mov edx, 4
mov dword [rsp + 0x78], eax
call sym.VBoxRT.dll_RAND_add
lea rcx, [rsp + 0x60]
movapd xmm2, xmm7
mov edx, 4
call sym.VBoxRT.dll_RAND_add
lea rcx, [rsp + 0x68]
mov edx, 8
movapd xmm2, xmm6
call sym.VBoxRT.dll_RAND_add
lea rcx, [rsp + 0x70]
mov edx, 8
movapd xmm2, xmm6
call sym.VBoxRT.dll_RAND_add
call sym.VBoxRT.dll_RAND_status
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x58
ret

Function at 0x1801ec4b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rbx, rcx
cmp dword [rdx + 8], eax
jge 0x1801ec4d3
mov rdi, r8
jmp 0x1801ec4d9
mov rdi, rdx
mov rsi, r8
mov edx, dword [rdi + 8]
cmp edx, dword [rcx + 0xc]
jg 0x1801ec4e6
mov rax, rcx
jmp 0x1801ec4eb
call sym.VBoxRT.dll_bn_expand2
test rax, rax
jne 0x1801ec500
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x1801ec534
mov r9d, r8d
nop dword [rax]
mov rax, qword [rdi]
mov rcx, qword [rsi]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rbx]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x1801ec510
movsxd rdx, r8d
cmp r8d, dword [rdi + 8]
jge 0x1801ec55d
shl rdx, 3
mov rax, qword [rdi]
mov rcx, qword [rbx]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rdi + 8]
jl 0x1801ec541
mov eax, dword [rdi + 8]
mov dword [rbx + 8], eax
test eax, eax
jle 0x1801ec587
dec eax
movsxd rcx, eax
mov rax, qword [rbx]
lea rdx, [rax + rcx*8]
mov rax, qword [rdx]
sub rdx, 8
test rax, rax
jne 0x1801ec587
dec dword [rbx + 8]
cmp dword [rbx + 8], eax
jg 0x1801ec573
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1801f2180
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
lea rcx, str.OPENSSL_CONF
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x1801f21a2
mov rcx, rax
add rsp, 0x28
jmp sym.VBoxRT.dll_BUF_strdup
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call sym.VBoxRT.dll_X509_get_default_cert_area
xor edx, edx
mov ecx, edx
cmp byte [rax], cl
je 0x1801f21d1
nop dword [rax]
cmp ecx, 0x80000000
jae 0x1801f21d1
inc rax
inc ecx
cmp byte [rax], dl
jne 0x1801f21c0
btr ecx, 0x1f
lea rax, str.openssl.cnf
inc ecx
nop
cmp edx, 0x80000000
jae 0x1801f21f2
inc rax
inc edx
cmp byte [rax], 0
jne 0x1801f21e0
btr edx, 0x1f
mov r8d, 0x231
lea ebx, [rdx + rcx + 1]
lea rdx, str.D:_tinderboxwin_4.2_srclibsopenssl_0.9.8ycryptoconfconf_mod.c
mov ecx, ebx
call sym.VBoxRT.dll_CRYPTO_malloc
mov rdi, rax
test rax, rax
jne 0x1801f2225
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
movsxd rbx, ebx
call sym.VBoxRT.dll_X509_get_default_cert_area
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call sym.VBoxRT.dll_BUF_strlcpy
lea rdx, [0x1802615ac]
mov r8, rbx
mov rcx, rdi
call sym.VBoxRT.dll_BUF_strlcat
lea rdx, str.openssl.cnf
mov r8, rbx
mov rcx, rdi
call sym.VBoxRT.dll_BUF_strlcat
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x1801ff250
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test r8, r8
jne 0x1801ff27f
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
test rcx, rcx
je 0x1801ff30e
test rdx, rdx
je 0x1801ff2d2
mov rcx, qword [rcx + 0x10]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rbx
call sym.VBoxRT.dll_lh_retrieve
test rax, rax
jne 0x1801ff2fa
mov qword [rsp + 0x50], rdi
lea rdi, [0x18034c5a4]
mov ecx, 4
repe cmpsb byte [rsi], byte [rdi]
mov rdi, qword [rsp + 0x50]
jne 0x1801ff2d2
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
jne 0x1801ff317
mov rcx, qword [rbp + 0x10]
lea rax, [0x180237f88]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
call sym.VBoxRT.dll_lh_retrieve
test rax, rax
je 0x1801ff26d
mov rax, qword [rax + 0x10]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_getenv]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret

Function at 0x180202680
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1803c1370]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
lea rdx, [rsp + 0x20]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1802026de
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x1802026d8
shr ax, 8
cmp al, 2
jne 0x1802026d8
xor eax, eax
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180227610
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180227610
add rsp, 0x1d8
ret