joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803488f0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.180338ac8
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.kernel32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x180348991
cmp ebx, dword [rsp + 0x30]
je 0x18034898a
test esi, esi
je 0x18034898a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x180348965
sub r8w, 0x61
cmp r8w, 0x19
ja 0x180348972
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x18034894f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x180348976
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x180348993
mov eax, 1
jmp 0x180348993
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18034aa38
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x18034aa82
call fcn.180328918
mov dword [rax], 0xf
call fcn.180328938
mov dword [rax], 0xd
call fcn.180329f68
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180313c00
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x18034aa8d
lea eax, [rbx + 1]
jmp 0x18034aa6f
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.kernel32.dll_GetDriveTypeW]
test eax, eax
je 0x18034aa6d
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x18034aa6f
Function at 0x18034c7dc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.180321b80
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x18034c866
cmp byte [rbp - 0x21], r15b
je 0x18034c861
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x18034c89c
call fcn.18033dafc
test eax, eax
jne 0x18034c888
cmp byte [rbp - 0x21], r15b
je 0x18034c880
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x18034c89c
cmp byte [rbp - 0x21], r15b
je 0x18034c899
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.180325554
test eax, eax
jne 0x18034c93c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.180321b80
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x18034c8db
cmp byte [rbp - 0x21], r15b
je 0x18034c910
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x18034c910
call fcn.18033dafc
test eax, eax
jne 0x18034c8fc
cmp byte [rbp - 0x21], r15b
je 0x18034c8f5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x18034c910
cmp byte [rbp - 0x21], r15b
je 0x18034c90d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.180325554
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x18034c93c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.kernel32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x18034c93f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x18034c94d
mov rcx, rdi
call fcn.18033a994
cmp byte [rbp + 0x3f], r15b
je 0x18034c95c
mov rcx, qword [rbp + 0x27]
call fcn.18033a994
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18034d0d4
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180340ef4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180340ef4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x18034d224
cmp rax, 0xffffffffffffffff
je 0x18034d224
xor edi, edi
test rbp, rbp
jle 0x18034d1cf
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18033a91c
mov rbx, rax
test rax, rax
jne 0x18034d15c
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x18034d1c5
mov edx, 0x8000
mov ecx, r14d
call fcn.18033187c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18033cff4
cmp eax, 0xffffffff
je 0x18034d1a5
cdqe
sub rbp, rax
test rbp, rbp
jg 0x18034d16c
mov edx, r15d
mov ecx, r14d
call fcn.18033187c
jmp 0x18034d1c5
cmp byte [rsi + 0x38], dil
je 0x18034d1bc
cmp dword [rsi + 0x34], 5
jne 0x18034d1bc
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x18034d1c5
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18033a994
jmp 0x18034d238
jns 0x18034d238
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180340ef4
cmp rax, 0xffffffffffffffff
jne 0x18034d1f0
cmp byte [rsi + 0x30], dil
je 0x18034d238
mov edi, dword [rsi + 0x2c]
jmp 0x18034d238
mov ecx, r14d
call fcn.18033f29c
mov rcx, rax
call qword [sym.imp.kernel32.dll_SetEndOfFile]
test eax, eax
jne 0x18034d238
call qword [sym.imp.kernel32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18034d238
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x18034d231
mov eax, dword [rsi + 0x2c]
jmp 0x18034d236
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180340ef4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x18034f710
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
mov r9d, 0x811c9dc5
test rdx, rdx
je 0x18034f737
nop dword [rax]
movzx r8d, byte [rax + rcx]
inc rax
xor r8d, r9d
imul r9d, r8d, 0x1000193
cmp rax, rdx
jb 0x18034f720
mov eax, r9d
ret
Function at 0x18034f9e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
mov r12, rcx
lea rax, [0x1804bd52a]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rcx + 0x18], xmm0
mov ecx, 0x800
call fcn.180313d50
mov rdx, rax
mov qword [r12], rax
mov qword [r12 + 8], 0x80
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
lea r8, [rax + 0x10]
mov r9d, 0x3f
mov rcx, qword [rdx]
mov qword [r8], rcx
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [r8 + 0x10], rax
lea r8, [r8 + 0x20]
mov rax, qword [rdx + 0x18]
mov qword [r8 - 8], rax
lea rdx, [rdx + 0x20]
sub r9, 1
jne 0x18034fa60
mov rax, qword [rdx]
mov qword [r8], rax
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
mov qword [r12 + 0x30], rbx
mov eax, 0x121
mov dword [rsp + 0x78], eax
lea rcx, [0x18050c170]
mov qword [rsp + 0x80], rcx
nop word [rax + rax]
mov r15, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [r15 + rdi], 0
jne 0x18034fad0
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x2c], eax
mov r13, qword [r12 + 8]
mov rcx, qword [r12 + 0x10]
lea rax, [r13*2]
add rax, r13
shr rax, 2
cmp rcx, rax
jb 0x18034fbba
test rcx, rcx
je 0x18034fbb2
cmp edi, dword [r12 + 0x20]
jne 0x18034fb2c
mov r8d, edi
mov rdx, qword [r12 + 0x18]
mov rcx, r15
call fcn.1803bbe20
test eax, eax
je 0x18034fbb2
dec r13
mov edx, 0x811c9dc5
mov r8d, edi
xor ecx, ecx
test edi, edi
je 0x18034fb55
nop dword [rax]
movzx eax, byte [rcx + r15]
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
cmp rcx, r8
jb 0x18034fb40
mov esi, edx
and rsi, r13
xor ebp, ebp
nop dword [rax]
mov rbx, rsi
shl rbx, 4
add rbx, qword [r12]
mov r14d, dword [rbx + 8]
cmp r14d, edi
jne 0x18034fb86
mov r8d, r14d
mov rdx, r15
mov rcx, qword [rbx]
call fcn.1803bbe20
test eax, eax
je 0x18034fbba
cmp r14d, dword [r12 + 0x20]
jne 0x18034fba1
mov r8, r14
mov rdx, qword [r12 + 0x18]
mov rcx, qword [rbx]
call fcn.1803bbe20
test eax, eax
je 0x18034fbb2
inc rsi
add rsi, rbp
and rsi, r13
inc rbp
cmp rbp, r13
jbe 0x18034fb60
mov rcx, r12
call fcn.180351fd0
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1803507a0
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0x80]
add rcx, 8
mov qword [rsp + 0x80], rcx
cmp eax, 0x137
jl 0x18034fac0
mov rax, r12
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18034fe70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov r12, rcx
je 0x18034ff52
mov r15d, dword [rdx + 8]
cmp r15d, dword [rcx + 0x20]
jne 0x18034febf
mov rdx, qword [rcx + 0x18]
mov r8d, r15d
mov rcx, qword [r13]
call fcn.1803bbe20
test eax, eax
je 0x18034ff52
mov r14, qword [r12 + 8]
xor esi, esi
dec r14
mov edx, 0x811c9dc5
mov ecx, esi
test r15, r15
je 0x18034fef5
mov r8, qword [r13]
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r15
jb 0x18034fee0
mov edi, edx
and rdi, r14
nop word [rax + rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, r15d
jne 0x18034ff26
mov rdx, qword [r13]
mov r8d, ebp
mov rcx, qword [rbx]
call fcn.1803bbe20
test eax, eax
je 0x18034ff71
cmp ebp, dword [r12 + 0x20]
jne 0x18034ff41
mov rdx, qword [r12 + 0x18]
mov r8, rbp
mov rcx, qword [rbx]
call fcn.1803bbe20
test eax, eax
je 0x18034ff52
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x18034ff00
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbx
jmp 0x18034ff54

Function at 0x1803507a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 8]
xor esi, esi
mov r15d, dword [rdx + 8]
dec r14
mov r13, rdx
mov r12, rcx
mov r9d, 0x811c9dc5
mov r8d, esi
test r15, r15
je 0x1803507f7
mov r10, qword [rdx]
movzx eax, byte [r10 + r8]
inc r8
xor eax, r9d
imul r9d, eax, 0x1000193
cmp r8, r15
jb 0x1803507e0
mov edi, r9d
and rdi, r14
nop dword [rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, dword [r12 + 0x20]
jne 0x180350829
mov rdx, qword [r12 + 0x18]
mov r8d, ebp
mov rcx, qword [rbx]
call fcn.1803bbe20
test eax, eax
je 0x180350871
cmp ebp, r15d
jne 0x180350841
mov rdx, qword [r13]
mov r8, rbp
mov rcx, qword [rbx]
call fcn.1803bbe20
test eax, eax
je 0x18035087e
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x180350800
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movups xmm0, xmmword [r13]
movups xmmword [rbx], xmm0
inc qword [r12 + 0x10]
mov rax, rbx
jmp 0x180350854
Function at 0x180351fd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
sub rsp, 0x98
movups xmm0, xmmword [rcx + 0x18]
mov qword [rax - 8], rbx
mov rbx, qword [rcx + 8]
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x30], r13
mov r13, rcx
mov qword [rax - 0x40], r15
lea r15, [rcx + 0x18]
mov rdi, r15
movups xmmword [rax - 0x60], xmm0
test rbx, rbx
jne 0x180352033
mov ecx, 0x100
mov ebx, 0x10
call fcn.180313d50
mov rsi, rax
mov qword [rsp + 0xa0], rax
mov ebp, ebx
mov qword [rsp + 0xa8], rbx
jmp 0x180352073
xor esi, esi
xor ebp, ebp
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rbp
add rbx, rbx
je 0x180352091
mov rcx, rbx
shl rcx, 4
call fcn.180313d50
mov qword [rsp + 0xa0], rax
mov rsi, rax
mov qword [rsp + 0xa8], rbx
mov rbp, rbx
test rbx, rbx
je 0x180352091
mov rax, rsi
nop word [rax + rax]
lea rax, [rax + 0x10]
movups xmm0, xmmword [rdi]
movups xmmword [rax - 0x10], xmm0
sub rbx, 1
jne 0x180352080
cmp qword [r13 + 8], 0
mov qword [rsp + 0xb8], 0
jbe 0x1803521ea
xor ecx, ecx
mov qword [rsp + 0x70], r12
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x60], r14
nop dword [rax]
mov r12, qword [r13]
add r12, rcx
mov r14d, dword [r12 + 8]
cmp r14d, dword [r15 + 8]
jne 0x1803520e9
mov rdx, qword [r15]
mov r8d, r14d
mov rcx, qword [r12]
call fcn.1803bbe20
test eax, eax
je 0x18035219f
xor ecx, ecx
lea r15, [rbp - 1]
mov edx, 0x811c9dc5
test r14, r14
je 0x180352115
mov r8, qword [r12]
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r14
jb 0x180352100
mov edi, edx
and rdi, r15
xor ebp, ebp
nop dword [rax]
mov rbx, rdi
shl rbx, 4
add rbx, rsi
mov esi, dword [rbx + 8]
cmp esi, dword [rsp + 0x40]
jne 0x180352147
mov rdx, qword [rsp + 0x38]
mov r8d, esi
mov rcx, qword [rbx]
call fcn.1803bbe20
test eax, eax
je 0x18035217a
cmp esi, r14d
jne 0x18035215f
mov rdx, qword [r12]
mov r8, rsi
mov rcx, qword [rbx]
call fcn.1803bbe20
test eax, eax
je 0x180352186
inc rdi
add rdi, rbp
inc rbp
and rdi, r15
cmp rbp, r15
ja 0x180352184
mov rsi, qword [rsp + 0xa0]
jmp 0x180352120
movups xmm0, xmmword [r12]
movups xmmword [rbx], xmm0
jmp 0x180352186
xor ebx, ebx
mov rax, qword [r13]
lea r15, [r13 + 0x18]
mov rcx, qword [rsp + 0xb0]
movups xmm0, xmmword [rcx + rax]
movups xmmword [rbx], xmm0
jmp 0x1803521a7
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
add rcx, 0x10
mov rsi, qword [rsp + 0xa0]
inc rdx
mov rbp, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xb0], rcx
cmp rdx, qword [r13 + 8]
jb 0x1803520c0
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
mov rcx, qword [r13]
mov rax, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov qword [r13], rsi
mov rsi, qword [rsp + 0x80]
mov qword [r13 + 8], rax
mov r13, qword [rsp + 0x68]
test rcx, rcx
je 0x18035222f
call fcn.1803141cc
add rsp, 0x98
ret
Function at 0x180355830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov r8b, 1
xor edx, edx
add rcx, 8
call fcn.180350a80
xor ebp, ebp
Function at 0x180365ba0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov edx, 0x2b
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x180365c7b
xor r14d, r14d
nop dword [rax]
mov edi, 4
lea rdx, [rsp + 0x50]
cmp rsi, rdi
mov r8d, 4
mov rcx, rbp
cmovb rdi, rsi
call fcn.180369740
cmp eax, 4
je 0x180365bf8
mov edx, eax
jmp 0x180365c25
cmp byte [0x180518ce4], r14b
jne 0x180365c2f
mov r9d, 2
mov dword [rsp + 0x50], r14d
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 2]
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb edx, edx
and edx, 2
mov eax, edx
test eax, eax
jne 0x180365c7d
mov eax, dword [rsp + 0x50]
jmp 0x180365c4e
imul eax, dword [0x180518ce0], 0x41c64e6d
mov edx, r14d
add eax, 0x3039
mov dword [0x180518ce0], eax
ror eax, 0x10
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x180365c72
sub rsi, rdi
nop word [rax + rax]
mov byte [rbx], al
inc rbx
shr eax, 8
sub rdi, 1
jne 0x180365c60
mov dword [rsp + 0x50], eax
test rsi, rsi
jne 0x180365bd0
mov eax, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180365c90
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
sub rdi, 1
je 0x180365d33
xor ebp, ebp
lea r14, [0x1804af140]
nop
mov r8d, 4
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180369740
cmp eax, 4
jne 0x180365cff
cmp byte [0x180518ce4], bpl
jne 0x180365d4b
lea r9d, [rax - 2]
mov dword [rsp + 0x50], ebp
mov r8d, eax
lea rdx, [rsp + 0x50]
xor ecx, ecx
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
test eax, eax
jne 0x180365d38
mov ecx, dword [rsp + 0x50]
cmp ecx, 0xfffffffc
jae 0x180365cc0
mov eax, 0x8421085
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx eax, byte [rcx + r14]
mov byte [rsi], al
inc rsi
sub rdi, 1
jne 0x180365cc0
mov byte [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
imul ecx, dword [0x180518ce0], 0x41c64e6d
add ecx, 0x3039
mov dword [0x180518ce0], ecx
ror ecx, 0x10
mov dword [rsp + 0x50], ecx
jmp 0x180365d07
Function at 0x18036bd10
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x18036bdf2
call fcn.1803821c0
test al, al
jne 0x18036bdf2
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x18036bd42
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.180383510
test rax, rax
je 0x18036bd87
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.180383510
mov rsi, rax
test rax, rax
je 0x18036bd87
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x18036bdbb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.180365690
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x18036bda0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x18037d300
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, [0x180498848]
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x18037d32a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, [0x1804b0da8]
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
lea rdx, [0x18049f0f0]
mov rcx, rbx
mov r14, rax
call fcn.18033ec00
test rax, rax
je 0x18037d389
mov rcx, rbx
test r14, r14
je 0x18037d376
xor edx, edx
lea r8d, [rdx + 8]
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.kernel32.dll_LoadLibraryW]
test r14, r14
je 0x18037d3c0
lea rdx, [0x1804b0db8]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x18037d3c0
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
je 0x18037d48a
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov rdx, rdi
nop dword [rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x18037d3f0
lea ecx, [rax + 1]
add rcx, rdx
add rcx, rcx
call qword [fcn.18033037c]
mov rsi, rax
test rax, rax
je 0x18037d47c
mov edx, r15d
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18037d47c
mov rax, rdi
cmp word [rsi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x18037d423
mov dword [rsi + rax*2], 0x5c
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x18037d435
add rdi, rdi
sub rdi, rbx
add rdi, rsi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rbx + rdi], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x18037d450
mov rcx, rsi
test r14, r14
je 0x18037d473
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x18037d479
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rbp, rax
mov rcx, rsi
call qword [fcn.180328c78]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x18037d4a0
Capabilities:
Get common file path
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x18037d506
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
jne 0x18037d4e9
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x18037d4e3
shr ax, 8
cmp al, 2
je 0x18037d506
call qword [sym.imp.ws2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180313c00
add rsp, 0x1e8
ret
call fcn.1803ad660
test eax, eax
jne 0x18037d717
mov qword [rsp + 0x200], rsi
lea rcx, [0x180498848]
mov qword [rsp + 0x208], rdi
xor esi, esi
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x18037d546
mov qword [0x180518dd8], rsi
jmp 0x18037d6d4
mov qword [rsp + 0x1f0], rbx
lea rdx, [0x1804b0da8]
mov rcx, rdi
mov qword [rsp + 0x1f8], rbp
call qword [sym.imp.kernel32.dll_GetProcAddress]
lea rbx, [0x1804b0d78]
mov rbp, rax
mov rcx, rbx
lea rdx, [0x18049f0f0]
call fcn.18033ec00
test rax, rax
je 0x18037d5aa
mov rcx, rbx
test rbp, rbp
je 0x18037d59c
xor edx, edx
lea r8d, [rdx + 8]
call rbp
mov rsi, rax
jmp 0x18037d69c
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rsi, rax
jmp 0x18037d69c
test rbp, rbp
je 0x18037d5d9
lea rdx, [0x1804b0db8]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x18037d5d9
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call rbp
mov rsi, rax
jmp 0x18037d69c
xor edx, edx
mov qword [rsp + 0x1e0], r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov r14d, eax
test eax, eax
je 0x18037d694
lea ecx, [rax + 1]
lea rcx, [rcx*2 + 0x18]
call qword [fcn.18033037c]
mov rdi, rax
test rax, rax
je 0x18037d68b
mov edx, r14d
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18037d68b
mov rcx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
cmp word [rdi + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x18037d630
mov dword [rdi + rax*2], 0x5c
inc rcx
cmp word [rdi + rcx*2], si
jne 0x18037d642
add rcx, rcx
sub rcx, rbx
add rcx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x18037d660
mov rcx, rdi
test rbp, rbp
je 0x18037d682
xor edx, edx
lea r8d, [rdx + 8]
call rbp
jmp 0x18037d688
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rsi, rax
mov rcx, rdi
call qword [fcn.180328c78]
mov r14, qword [rsp + 0x1e0]
mov rbp, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
mov qword [0x180518dd8], rsi
test rsi, rsi
je 0x18037d6d4
lea rdx, [0x1804b0d98]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x18037d6d4
mov qword [0x180518dd0], rax
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.1803ad210
test al, al
lea rcx, [0x180519658]
setne byte [0x180519650]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
mov rdi, qword [rsp + 0x208]
xor eax, eax
mov rsi, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180313c00
add rsp, 0x1e8
ret