joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802a0970
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.1800b8180
sub rsp, rax
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor edi, edi
movsxd rsi, r8d
mov rbp, r9
mov r14, rdx
mov rbx, rcx
mov eax, edi
test r9, r9
je 0x1802a09d6
cmp r9, qword [rcx]
je 0x1802a09cc
test rdx, rdx
je 0x1802a0bb9
test r8d, r8d
js 0x1802a0bb9
mov eax, 1
mov qword [rcx], r9
jmp 0x1802a09e2
mov rbp, qword [rcx]
test rbp, rbp
je 0x1802a0bb9
test r14, r14
je 0x1802a0ab4
mov rcx, rbp
mov qword [rsp + 0xb0], r15
call fcn.180287ea0
mov r15d, eax
cmp eax, 0x80
jle 0x1802a0a1e
mov r8d, Ordinal_41
lea rdx, str.cryptohmachmac.c
lea rcx, str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.1800d8350
cmp r15d, esi
mov r15, qword [rsp + 0xb0]
jge 0x1802a0a70
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.1802766e0
test eax, eax
je 0x1802a0a69
mov rcx, qword [rbx + 8]
mov r8, rsi
mov rdx, r14
call fcn.180276950
test eax, eax
je 0x1802a0a69
mov rcx, qword [rbx + 8]
lea r14, [rbx + 0x20]
mov r8, r14
lea rdx, [rbx + 0x24]
call fcn.180276600
test eax, eax
jne 0x1802a0a8e
xor eax, eax
jmp 0x1802a0bb9
cmp esi, 0x80
ja 0x1802a0a69
mov r8, rsi
lea rcx, [rbx + 0x24]
mov rdx, r14
call fcn.18020f990
lea r14, [rbx + 0x20]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x1802a0abc
mov eax, ecx
mov r8d, 0x80
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.18020fe90
jmp 0x1802a0abc
test eax, eax
je 0x1802a0b9f
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, rdi
lea rsi, [rax + 0x24]
lea r14, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x1802a0ae0
mov rcx, qword [rbx + 0x10]
mov r8, r12
mov rdx, rbp
call fcn.1802766e0
test eax, eax
je 0x1802a0a69
mov rcx, rbp
call fcn.180287ea0
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.180276950
test eax, eax
je 0x1802a0a69
nop
lea rcx, [rsp + 0x20]
add rcx, rdi
add rdi, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdi, 0x80
jl 0x1802a0b40
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, rbp
call fcn.1802766e0
test eax, eax
je 0x1802a0a69
mov rcx, rbp
call fcn.180287ea0
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.180276950
test eax, eax
je 0x1802a0a69
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.1802769b0
test eax, eax
je 0x1802a0a69
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1802d2d20
Capabilities:
Encode data using base64

Disassembly:
xor r10d, r10d
test r8d, r8d
jle 0x1802d2e13
lea r9, [rdx + 1]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r8d, 3
jl 0x1802d2d9b
movzx eax, byte [r9]
movzx edx, byte [r9 - 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [r9 + 1]
shl rdx, 8
or rdx, rax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
mov rax, rdx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 2], al
add rcx, 3
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx], al
jmp 0x1802d2df4
movzx edx, byte [r9 - 1]
shl edx, 0x10
cmp r8d, 2
jne 0x1802d2db2
movzx eax, byte [r9]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
cmp r8d, 1
jne 0x1802d2dde
lea eax, [r8 + 0x3c]
jmp 0x1802d2dea
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx + 2], al
add rcx, 3
mov byte [rcx], 0x3d
add r10d, 4
add r9, 3
sub r8d, 3
inc rcx
test r8d, r8d
jg 0x1802d2d37
mov byte [rcx], 0
mov eax, r10d
ret
mov byte [rcx], r10b
mov eax, r10d
ret
Function at 0x1802d7740
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x40
call fcn.1800b8180
sub rsp, rax
cmp dword [rsp + 0x70], 2
mov rdi, r8
movsxd rbp, r9d
mov r14, rcx
je 0x1802d77d0
test rdx, rdx
je 0x1802d77bc
mov r9, rdx
xor r8d, r8d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.1802b2280
cmp dword [rsp + 0x30], 0xffffffff
je 0x1802d77bc
mov dword [rsp + 0x20], Ordinal_50
mov ecx, reloc.WS2_32.dll_recv
lea r9, str.cryptoececx_meth.c
mov edx, 0x10a
lea r8d, [rcx + 0x56]
call fcn.18026b510
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
test rdi, rdi
je 0x1802d77c6
cmp ebp, 0x20
je 0x1802d77d0
mov dword [rsp + 0x20], gethostname
jmp 0x1802d778f
mov r8d, Ordinal_60
mov qword [rsp + 0x50], rbx
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x12]
call fcn.180269b10
mov rbx, rax
test rax, rax
jne 0x1802d781a
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_60
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.18026b510
xor eax, eax
jmp 0x1802d790a
cmp dword [rsp + 0x70], 0
jne 0x1802d7834
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.18020f990
jmp 0x1802d78f5
mov r8d, 0x43
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x23]
call fcn.1802bb5d0
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x1802d787b
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], 0x45
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.18026b510
mov r8d, 0x46
jmp 0x1802d78af
cmp dword [rsp + 0x70], 2
jne 0x1802d78db
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rax
call fcn.18026e330
test eax, eax
jg 0x1802d78c2
mov rcx, qword [rbx + 0x20]
lea rdx, str.cryptoececx_meth.c
mov r8d, Ordinal_79
call fcn.1802bb5b0
mov r8d, Ordinal_79
lea rdx, str.cryptoececx_meth.c
mov rcx, rbx
call fcn.180269820
xor eax, eax
jmp 0x1802d790a
mov rax, qword [rbx + 0x20]
and byte [rax], 0xf8
mov rax, qword [rbx + 0x20]
and byte [rax + 0x1f], 0x7f
mov rax, qword [rbx + 0x20]
or byte [rax + 0x1f], 0x40
jmp 0x1802d78e9
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm1
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
call fcn.180305ad0
mov r8, rbx
mov edx, 0x40a
mov rcx, r14
call fcn.180277170
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x1802dfaf0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x50
call fcn.1800b8180
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rsi, rcx
mov rdi, qword [rcx + 0x160]
mov r14, r9
mov qword [rsp + 0x30], rax
mov rbp, r8
mov rax, qword [rcx + 0x168]
mov r15, rdx
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x1802dfd2e
cmp rcx, r9
jb 0x1802dfd2e
cmp dword [rsi + 0x174], 0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x48], r12
mov qword [rsi + 0x38], rcx
je 0x1802dfb81
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov dword [rsi + 0x174], 0
mov ebx, dword [rsi + 0x170]
mov r12d, dword [rsi + 0xc]
mov dword [rsp + 0x80], ebx
bswap r12d
test ebx, ebx
je 0x1802dfbe4
nop dword [rax]
test r14, r14
je 0x1802dfbd2
movzx edx, byte [r15]
dec r14
mov ecx, ebx
inc r15
movzx eax, byte [rcx + rsi + 0x10]
xor al, dl
mov byte [rbp], al
inc rbp
xor byte [rcx + rsi + 0x40], dl
inc ebx
and ebx, 0xf
mov dword [rsp + 0x80], ebx
jne 0x1802dfba0
jmp 0x1802dfbda
test ebx, ebx
jne 0x1802dfd0d
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov qword [rsp + 0x40], r13
mov r13, qword [rsp + 0xa0]
cmp r14, 0xc00
jb 0x1802dfc78
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
nop dword [rax + rax]
mov r9d, 0xc00
lea rdx, [rsi + 0x60]
mov r8, r15
lea rcx, [rsi + 0x40]
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8d, 0xc0
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov rcx, r15
call r13
add r12d, 0xc0
add rbp, 0xc00
mov eax, r12d
add r15, 0xc00
bswap eax
mov dword [rsi + 0xc], eax
sub rdi, 1
jne 0x1802dfc20
mov ebx, dword [rsp + 0x80]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x1802dfcc8
mov rdi, r13
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
shr rdi, 4
mov r9, r13
mov r8, r15
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8, rdi
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov rcx, r15
call qword [rsp + 0xa0]
add r12d, edi
add rbp, r13
mov eax, r12d
add r15, r13
bswap eax
mov dword [rsi + 0xc], eax
sub r14, r13
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x1802dfd0d
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
inc r12d
bswap r12d
mov dword [rsi + 0xc], r12d
nop
mov edx, ebx
inc ebx
movzx ecx, byte [rdx + r15]
movzx eax, byte [rsi + rdx + 0x10]
xor byte [rdx + rsi + 0x40], cl
xor al, cl
mov byte [rdx + rbp], al
sub r14, 1
jne 0x1802dfcf0
mov r12, qword [rsp + 0x48]
xor eax, eax
mov dword [rsi + 0x170], ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1802e0010
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x50
call fcn.1800b8180
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rsi, rcx
mov rdi, qword [rcx + 0x160]
mov r14, r9
mov qword [rsp + 0x30], rax
mov r15, r8
mov rax, qword [rcx + 0x168]
mov rbp, rdx
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x1802e026e
cmp rcx, r9
jb 0x1802e026e
cmp dword [rsi + 0x174], 0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x48], r12
mov qword [rsi + 0x38], rcx
je 0x1802e00a1
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov dword [rsi + 0x174], 0
mov ebx, dword [rsi + 0x170]
mov r12d, dword [rsi + 0xc]
mov dword [rsp + 0x80], ebx
bswap r12d
test ebx, ebx
je 0x1802e0101
nop dword [rax]
test r14, r14
je 0x1802e00ef
mov ecx, ebx
dec r14
movzx eax, byte [rcx + rsi + 0x10]
xor al, byte [rbp]
inc rbp
mov byte [r15], al
inc r15
xor byte [rcx + rsi + 0x40], al
inc ebx
and ebx, 0xf
mov dword [rsp + 0x80], ebx
jne 0x1802e00c0
jmp 0x1802e00f7
test ebx, ebx
jne 0x1802e024d
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov r10, qword [rsp + 0xa0]
mov qword [rsp + 0x40], r13
cmp r14, 0xc00
jb 0x1802e01b6
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
mov qword [rsp + 0x98], r14
mov r14, qword [rsp + 0x30]
nop word [rax + rax]
mov r9, r14
mov qword [rsp + 0x20], rsi
mov r8d, 0xc0
mov rdx, r15
mov rcx, rbp
call r10
add r12d, 0xc0
lea rdx, [rsi + 0x60]
mov eax, r12d
lea rcx, [rsi + 0x40]
bswap eax
mov r9d, 0xc00
mov dword [rsi + 0xc], eax
mov r8, r15
call qword [rsp + gethostname]
mov r10, qword [rsp + 0xa0]
add r15, 0xc00
add rbp, 0xc00
sub rdi, 1
jne 0x1802e0150
mov ebx, dword [rsp + 0x80]
mov r14, qword [rsp + 0x98]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x1802e0202
mov r9, qword [rsp + 0x30]
mov rdi, r13
shr rdi, 4
mov rdx, r15
mov r8, rdi
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call r10
add r12d, edi
lea rdx, [rsi + 0x60]
mov eax, r12d
lea rcx, [rsi + 0x40]
bswap eax
mov r9, r13
mov dword [rsi + 0xc], eax
mov r8, r15
add rbp, r13
sub r14, r13
call qword [rsp + gethostname]
add r15, r13
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x1802e024d
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
inc r12d
bswap r12d
mov dword [rsi + 0xc], r12d
nop dword [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + rbp]
movzx eax, byte [rsi + rcx + 0x10]
xor edx, eax
mov byte [rcx + r15], dl
xor byte [rcx + rsi + 0x40], dl
sub r14, 1
jne 0x1802e0230
mov r12, qword [rsp + 0x48]
xor eax, eax
mov dword [rsi + 0x170], ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1802e0450
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1800b8180
sub rsp, rax
mov r13, qword [rcx + 0x160]
xor r14d, r14d
mov qword [rcx], r14
mov rsi, r8
mov qword [rcx + 8], r14
mov rdi, rdx
mov qword [rcx + 0x40], r14
mov rbx, rcx
mov qword [rcx + 0x48], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x38], r14
mov qword [rcx + 0x170], r14
cmp r8, 0xc
jne 0x1802e04b7
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov byte [rcx + 0xf], 1
jmp 0x1802e0629
mov qword [rsp + 0x58], rbp
mov rbp, rsi
mov qword [rsp + 0x50], rsi
cmp rsi, 0x10
jb 0x1802e0563
mov qword [rsp + 0x60], r12
mov r12, rbx
shr rbp, 4
neg r12
imul rax, rbp, 0xfffffffffffffff0
mov qword [rsp + 0x68], r15
lea r15, [rcx + 0xf]
add rsi, rax
nop dword [rax]
lea r8, [r12 + rdi]
lea rax, [r8 + r15]
cmp rbx, rax
ja 0x1802e0530
cmp r15, rdi
jb 0x1802e0530
mov rax, rbx
mov edx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1802e0510
jmp 0x1802e0540
movdqu xmm1, xmmword [rbx]
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
add rdi, 0x10
sub rbp, 1
jne 0x1802e04f0
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
test rsi, rsi
je 0x1802e060a
cmp rsi, 0x20
jb 0x1802e05d3
lea rcx, [rbx - 1]
lea rax, [rdi - 1]
add rcx, rsi
add rax, rsi
cmp rbx, rax
ja 0x1802e058a
cmp rcx, rdi
jae 0x1802e05d3
mov rdx, rsi
mov rcx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rbx
sub rcx, rbx
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r14, 0x20
movdqu xmm1, xmmword [rax + rcx]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp r14, rdx
jb 0x1802e05a0
cmp r14, rsi
jae 0x1802e0600
sub rdi, rbx
lea rcx, [r14 + rbx]
sub rsi, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x1802e05f0
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
shl rbp, 3
lea rdx, [rbx + 0x60]
bswap rbp
xor qword [rbx + 8], rbp
mov rcx, rbx
call r13
mov edi, dword [rbx + 0xc]
mov rbp, qword [rsp + 0x58]
bswap edi
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x20
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret

Function at 0x1802e5960
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1800b8180
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1802e5989
lea rax, [0x1802e3f30]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1802dea70
lea rax, [0x1802e3090]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1802de7a0
Function at 0x1802f9b60
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
mov eax, Ordinal_211
call fcn.1800b8180
sub rsp, rax
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0x40
test eax, eax
je 0x1802f9bf2
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1802f9be5
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1802f9bd6
addsd xmm2, qword [0x180337f18]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.18026e2e0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9d, reloc.WLDAP32.dll_Ordinal_22
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1802f9c62
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1802f9c55
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1802f9c46
addsd xmm2, qword [0x180337f18]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.18026e2e0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x1802f9c9d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1802f9c82
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x1802f9c9d
xorps xmm2, xmm2
lea rcx, [rsp + 0x40]
mov edx, 8
call fcn.18026e2e0
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x1802f9cb9
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 4
mov dword [rsp + 0x38], eax
call fcn.18026e2e0
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movsd xmm2, qword [0x180337ef8]
lea rcx, [rsp + 0x48]
mov edx, gethostname
call fcn.18026e2e0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsd xmm2, qword [0x180337ef8]
lea rcx, [rsp + 0x3c]
mov edx, 4
mov dword [rsp + 0x3c], eax
call fcn.18026e2e0
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0xd0
pop rbx
ret
Function at 0x18031d599
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18031d78a
push rbx
mov eax, Ordinal_211
call fcn.1800b8180
sub rsp, rax
mov rax, qword [0x1804a20e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1802836e0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.180283430
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1802cdd40
mov rcx, r15
call fcn.1802836e0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.180283430
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1802cdd40
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x18031d600
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800b8140
add rsp, 0xd0
pop rbx
ret
Function at 0x140001e50
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x14015c040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xorps xmm0, xmm0
test eax, eax
js 0x140001f06
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140001eb1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14000c410
nop
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
lea r8, [rdx + rcx*2]
lea rdx, [rsp + 0x40]
cmova rdx, qword [rsp + 0x40]
mov rcx, rbx
call fcn.14000ba80
nop
lea rcx, [rsp + 0x40]
call fcn.14000b730
jmp 0x140001f2b
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
xor r8d, r8d
lea rdx, [0x1401353b2]
mov rcx, rbx
call fcn.14000c8c0
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140113570
add rsp, 0x280
pop rbx
ret

Function at 0x140004a70
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140437314]
mov edx, ecx
test ecx, ecx
je 0x140004abb
sub edx, 1
je 0x140004a9b
cmp edx, 1
jne 0x140004ae3
mov byte [0x140437320], dl
mov byte [0x1404381f0], dl
add rsp, 0x28
ret
mov ecx, dword [0x140437310]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x140437314]
test ax, ax
setne al
mov byte [0x140437320], al
jmp 0x140004aea
mov ecx, dword [0x140437310]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x140437314]
test al, 1
je 0x140004ae3
cmp byte [0x140437320], 0
sete al
mov byte [0x140437320], al
jmp 0x140004aea
movzx eax, byte [0x140437320]
test ecx, ecx
jne 0x140004b0a
test al, al
je 0x140004b26
cmp byte [0x1404381f0], cl
mov byte [0x140437320], cl
sete byte [0x1404381f0]
add rsp, 0x28
ret
cmp ecx, 1
jne 0x140004b1a
mov byte [0x1404381f0], al
add rsp, 0x28
ret
cmp ecx, 2
jne 0x140004b26
mov byte [0x1404381f0], 1
add rsp, 0x28
ret

Function at 0x14000f400
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000f45d
lea rbx, [0x1401362a0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000f444
cmp r10, 2
jb 0x14000f444
cmp byte [r9], r8b
jne 0x14000f444
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000f420
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000f49f
lea rbx, [0x1401362a0]
cmp r8b, 0x23
jne 0x14000f483
cmp byte [r9], r8b
jne 0x14000f483
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000f470
mov rbx, qword [rsp + 8]
not eax
ret