joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18029b4f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.1800b7d60
sub rsp, rax
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor edi, edi
movsxd rsi, r8d
mov rbp, r9
mov r14, rdx
mov rbx, rcx
mov eax, edi
test r9, r9
je 0x18029b556
cmp r9, qword [rcx]
je 0x18029b54c
test rdx, rdx
je 0x18029b739
test r8d, r8d
js 0x18029b739
mov eax, 1
mov qword [rcx], r9
jmp 0x18029b562
mov rbp, qword [rcx]
test rbp, rbp
je 0x18029b739
test r14, r14
je 0x18029b634
mov rcx, rbp
mov qword [rsp + 0xb0], r15
call fcn.180282020
mov r15d, eax
cmp eax, 0x80
jle 0x18029b59e
mov r8d, Ordinal_41
lea rdx, str.cryptohmachmac.c
lea rcx, str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.1800d8290
cmp r15d, esi
mov r15, qword [rsp + 0xb0]
jge 0x18029b5f0
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.18026ed60
test eax, eax
je 0x18029b5e9
mov rcx, qword [rbx + 8]
mov r8, rsi
mov rdx, r14
call fcn.18026efd0
test eax, eax
je 0x18029b5e9
mov rcx, qword [rbx + 8]
lea r14, [rbx + 0x20]
mov r8, r14
lea rdx, [rbx + 0x24]
call fcn.18026ec80
test eax, eax
jne 0x18029b60e
xor eax, eax
jmp 0x18029b739
cmp esi, 0x80
ja 0x18029b5e9
mov r8, rsi
lea rcx, [rbx + 0x24]
mov rdx, r14
call fcn.18020cd80
lea r14, [rbx + 0x20]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x18029b63c
mov eax, ecx
mov r8d, 0x80
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.18020d280
jmp 0x18029b63c
test eax, eax
je 0x18029b71f
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, rdi
lea rsi, [rax + 0x24]
lea r14, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x18029b660
mov rcx, qword [rbx + 0x10]
mov r8, r12
mov rdx, rbp
call fcn.18026ed60
test eax, eax
je 0x18029b5e9
mov rcx, rbp
call fcn.180282020
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.18026efd0
test eax, eax
je 0x18029b5e9
nop
lea rcx, [rsp + 0x20]
add rcx, rdi
add rdi, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdi, 0x80
jl 0x18029b6c0
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, rbp
call fcn.18026ed60
test eax, eax
je 0x18029b5e9
mov rcx, rbp
call fcn.180282020
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.18026efd0
test eax, eax
je 0x18029b5e9
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.18026f030
test eax, eax
je 0x18029b5e9
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800b7d20
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1802c87c0
Capabilities:
Encode data using base64

Disassembly:
xor r10d, r10d
test r8d, r8d
jle 0x1802c88b3
lea r9, [rdx + 1]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r8d, 3
jl 0x1802c883b
movzx eax, byte [r9]
movzx edx, byte [r9 - 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [r9 + 1]
shl rdx, 8
or rdx, rax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
mov rax, rdx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 2], al
add rcx, 3
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx], al
jmp 0x1802c8894
movzx edx, byte [r9 - 1]
shl edx, 0x10
cmp r8d, 2
jne 0x1802c8852
movzx eax, byte [r9]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
cmp r8d, 1
jne 0x1802c887e
lea eax, [r8 + 0x3c]
jmp 0x1802c888a
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx + 2], al
add rcx, 3
mov byte [rcx], 0x3d
add r10d, 4
add r9, 3
sub r8d, 3
inc rcx
test r8d, r8d
jg 0x1802c87d7
mov byte [rcx], 0
mov eax, r10d
ret
mov byte [rcx], r10b
mov eax, r10d
ret
Function at 0x1802cd1e0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x40
call fcn.1800b7d60
sub rsp, rax
cmp dword [rsp + 0x70], 2
mov rdi, r8
movsxd rbp, r9d
mov r14, rcx
je 0x1802cd270
test rdx, rdx
je 0x1802cd25c
mov r9, rdx
xor r8d, r8d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.1802b3400
cmp dword [rsp + 0x30], 0xffffffff
je 0x1802cd25c
mov dword [rsp + 0x20], Ordinal_50
mov ecx, reloc.WS2_32.dll_recv
lea r9, str.cryptoececx_meth.c
mov edx, 0x10a
lea r8d, [rcx + 0x56]
call fcn.180277e20
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
test rdi, rdi
je 0x1802cd266
cmp ebp, 0x20
je 0x1802cd270
mov dword [rsp + 0x20], gethostname
jmp 0x1802cd22f
mov r8d, Ordinal_60
mov qword [rsp + 0x50], rbx
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x12]
call fcn.180267460
mov rbx, rax
test rax, rax
jne 0x1802cd2ba
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_60
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.180277e20
xor eax, eax
jmp 0x1802cd3aa
cmp dword [rsp + 0x70], 0
jne 0x1802cd2d4
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.18020cd80
jmp 0x1802cd395
mov r8d, 0x43
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x23]
call fcn.1802a5dc0
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x1802cd31b
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], 0x45
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.180277e20
mov r8d, 0x46
jmp 0x1802cd34f
cmp dword [rsp + 0x70], 2
jne 0x1802cd37b
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rax
call fcn.180275860
test eax, eax
jg 0x1802cd362
mov rcx, qword [rbx + 0x20]
lea rdx, str.cryptoececx_meth.c
mov r8d, Ordinal_79
call fcn.1802a5da0
mov r8d, Ordinal_79
lea rdx, str.cryptoececx_meth.c
mov rcx, rbx
call fcn.180267170
xor eax, eax
jmp 0x1802cd3aa
mov rax, qword [rbx + 0x20]
and byte [rax], 0xf8
mov rax, qword [rbx + 0x20]
and byte [rax + 0x1f], 0x7f
mov rax, qword [rbx + 0x20]
or byte [rax + 0x1f], 0x40
jmp 0x1802cd389
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm1
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
call fcn.180301180
mov r8, rbx
mov edx, 0x40a
mov rcx, r14
call fcn.18026f790
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x1802dd980
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x50
call fcn.1800b7d60
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rsi, rcx
mov rdi, qword [rcx + 0x160]
mov r14, r9
mov qword [rsp + 0x30], rax
mov rbp, r8
mov rax, qword [rcx + 0x168]
mov r15, rdx
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x1802ddbbe
cmp rcx, r9
jb 0x1802ddbbe
cmp dword [rsi + 0x174], 0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x48], r12
mov qword [rsi + 0x38], rcx
je 0x1802dda11
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov dword [rsi + 0x174], 0
mov ebx, dword [rsi + 0x170]
mov r12d, dword [rsi + 0xc]
mov dword [rsp + 0x80], ebx
bswap r12d
test ebx, ebx
je 0x1802dda74
nop dword [rax]
test r14, r14
je 0x1802dda62
movzx edx, byte [r15]
dec r14
mov ecx, ebx
inc r15
movzx eax, byte [rcx + rsi + 0x10]
xor al, dl
mov byte [rbp], al
inc rbp
xor byte [rcx + rsi + 0x40], dl
inc ebx
and ebx, 0xf
mov dword [rsp + 0x80], ebx
jne 0x1802dda30
jmp 0x1802dda6a
test ebx, ebx
jne 0x1802ddb9d
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov qword [rsp + 0x40], r13
mov r13, qword [rsp + 0xa0]
cmp r14, 0xc00
jb 0x1802ddb08
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
nop dword [rax + rax]
mov r9d, 0xc00
lea rdx, [rsi + 0x60]
mov r8, r15
lea rcx, [rsi + 0x40]
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8d, 0xc0
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov rcx, r15
call r13
add r12d, 0xc0
add rbp, 0xc00
mov eax, r12d
add r15, 0xc00
bswap eax
mov dword [rsi + 0xc], eax
sub rdi, 1
jne 0x1802ddab0
mov ebx, dword [rsp + 0x80]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x1802ddb58
mov rdi, r13
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
shr rdi, 4
mov r9, r13
mov r8, r15
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8, rdi
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov rcx, r15
call qword [rsp + 0xa0]
add r12d, edi
add rbp, r13
mov eax, r12d
add r15, r13
bswap eax
mov dword [rsi + 0xc], eax
sub r14, r13
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x1802ddb9d
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
inc r12d
bswap r12d
mov dword [rsi + 0xc], r12d
nop
mov edx, ebx
inc ebx
movzx ecx, byte [rdx + r15]
movzx eax, byte [rsi + rdx + 0x10]
xor byte [rdx + rsi + 0x40], cl
xor al, cl
mov byte [rdx + rbp], al
sub r14, 1
jne 0x1802ddb80
mov r12, qword [rsp + 0x48]
xor eax, eax
mov dword [rsi + 0x170], ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1802ddea0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x50
call fcn.1800b7d60
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rsi, rcx
mov rdi, qword [rcx + 0x160]
mov r14, r9
mov qword [rsp + 0x30], rax
mov r15, r8
mov rax, qword [rcx + 0x168]
mov rbp, rdx
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x1802de0fe
cmp rcx, r9
jb 0x1802de0fe
cmp dword [rsi + 0x174], 0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x48], r12
mov qword [rsi + 0x38], rcx
je 0x1802ddf31
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov dword [rsi + 0x174], 0
mov ebx, dword [rsi + 0x170]
mov r12d, dword [rsi + 0xc]
mov dword [rsp + 0x80], ebx
bswap r12d
test ebx, ebx
je 0x1802ddf91
nop dword [rax]
test r14, r14
je 0x1802ddf7f
mov ecx, ebx
dec r14
movzx eax, byte [rcx + rsi + 0x10]
xor al, byte [rbp]
inc rbp
mov byte [r15], al
inc r15
xor byte [rcx + rsi + 0x40], al
inc ebx
and ebx, 0xf
mov dword [rsp + 0x80], ebx
jne 0x1802ddf50
jmp 0x1802ddf87
test ebx, ebx
jne 0x1802de0dd
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov r10, qword [rsp + 0xa0]
mov qword [rsp + 0x40], r13
cmp r14, 0xc00
jb 0x1802de046
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
mov qword [rsp + 0x98], r14
mov r14, qword [rsp + 0x30]
nop word [rax + rax]
mov r9, r14
mov qword [rsp + 0x20], rsi
mov r8d, 0xc0
mov rdx, r15
mov rcx, rbp
call r10
add r12d, 0xc0
lea rdx, [rsi + 0x60]
mov eax, r12d
lea rcx, [rsi + 0x40]
bswap eax
mov r9d, 0xc00
mov dword [rsi + 0xc], eax
mov r8, r15
call qword [rsp + gethostname]
mov r10, qword [rsp + 0xa0]
add r15, 0xc00
add rbp, 0xc00
sub rdi, 1
jne 0x1802ddfe0
mov ebx, dword [rsp + 0x80]
mov r14, qword [rsp + 0x98]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x1802de092
mov r9, qword [rsp + 0x30]
mov rdi, r13
shr rdi, 4
mov rdx, r15
mov r8, rdi
mov qword [rsp + 0x20], rsi
mov rcx, rbp
call r10
add r12d, edi
lea rdx, [rsi + 0x60]
mov eax, r12d
lea rcx, [rsi + 0x40]
bswap eax
mov r9, r13
mov dword [rsi + 0xc], eax
mov r8, r15
add rbp, r13
sub r14, r13
call qword [rsp + gethostname]
add r15, r13
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x1802de0dd
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
inc r12d
bswap r12d
mov dword [rsi + 0xc], r12d
nop dword [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + rbp]
movzx eax, byte [rsi + rcx + 0x10]
xor edx, eax
mov byte [rcx + r15], dl
xor byte [rcx + rsi + 0x40], dl
sub r14, 1
jne 0x1802de0c0
mov r12, qword [rsp + 0x48]
xor eax, eax
mov dword [rsi + 0x170], ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1802de2e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1800b7d60
sub rsp, rax
mov r13, qword [rcx + 0x160]
xor r14d, r14d
mov qword [rcx], r14
mov rsi, r8
mov qword [rcx + 8], r14
mov rdi, rdx
mov qword [rcx + 0x40], r14
mov rbx, rcx
mov qword [rcx + 0x48], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x38], r14
mov qword [rcx + 0x170], r14
cmp r8, 0xc
jne 0x1802de347
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov byte [rcx + 0xf], 1
jmp 0x1802de4b9
mov qword [rsp + 0x58], rbp
mov rbp, rsi
mov qword [rsp + 0x50], rsi
cmp rsi, 0x10
jb 0x1802de3f3
mov qword [rsp + 0x60], r12
mov r12, rbx
shr rbp, 4
neg r12
imul rax, rbp, 0xfffffffffffffff0
mov qword [rsp + 0x68], r15
lea r15, [rcx + 0xf]
add rsi, rax
nop dword [rax]
lea r8, [r12 + rdi]
lea rax, [r8 + r15]
cmp rbx, rax
ja 0x1802de3c0
cmp r15, rdi
jb 0x1802de3c0
mov rax, rbx
mov edx, reloc.WS2_32.dll_recv
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1802de3a0
jmp 0x1802de3d0
movdqu xmm1, xmmword [rbx]
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
add rdi, 0x10
sub rbp, 1
jne 0x1802de380
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
test rsi, rsi
je 0x1802de49a
cmp rsi, 0x20
jb 0x1802de463
lea rcx, [rbx - 1]
lea rax, [rdi - 1]
add rcx, rsi
add rax, rsi
cmp rbx, rax
ja 0x1802de41a
cmp rcx, rdi
jae 0x1802de463
mov rdx, rsi
mov rcx, rdi
and rdx, 0xffffffffffffffe0
mov rax, rbx
sub rcx, rbx
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r14, 0x20
movdqu xmm1, xmmword [rax + rcx]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp r14, rdx
jb 0x1802de430
cmp r14, rsi
jae 0x1802de490
sub rdi, rbx
lea rcx, [r14 + rbx]
sub rsi, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x1802de480
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
shl rbp, 3
lea rdx, [rbx + 0x60]
bswap rbp
xor qword [rbx + 8], rbp
mov rcx, rbx
call r13
mov edi, dword [rbx + 0xc]
mov rbp, qword [rsp + 0x58]
bswap edi
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x20
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret

Function at 0x1802e37f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, gethostname
call fcn.1800b7d60
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x1802e3819
lea rax, [0x1802e1dc0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1802dc900
lea rax, [0x1802e0f20]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1802dc630
Function at 0x1802fadd0
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
mov eax, Ordinal_211
call fcn.1800b7d60
sub rsp, rax
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0x40
test eax, eax
je 0x1802fae62
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1802fae55
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1802fae46
addsd xmm2, qword [0x180334ef8]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.180275810
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r9d, reloc.WLDAP32.dll_Ordinal_22
mov dword [rsp + 0x20], 0xf0000040
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1802faed2
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1802faec5
xorps xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1802faeb6
addsd xmm2, qword [0x180334ef8]
mov edx, ebx
lea rcx, [rsp + 0x80]
call fcn.180275810
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x1802faf0d
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1802faef2
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x1802faf0d
xorps xmm2, xmm2
lea rcx, [rsp + 0x40]
mov edx, 8
call fcn.180275810
cmp dword [reloc.WS2_32.dll_accept], 0
jne 0x1802faf29
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 4
mov dword [rsp + 0x38], eax
call fcn.180275810
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
movsd xmm2, qword [0x180334ed8]
lea rcx, [rsp + 0x48]
mov edx, gethostname
call fcn.180275810
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsd xmm2, qword [0x180334ed8]
lea rcx, [rsp + 0x3c]
mov edx, 4
mov dword [rsp + 0x3c], eax
call fcn.180275810
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800b7d20
add rsp, 0xd0
pop rbx
ret
Function at 0x18031faa9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18031fc9a
push rbx
mov eax, Ordinal_211
call fcn.1800b7d60
sub rsp, rax
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.18027d8a0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.18027d5f0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1802c37d0
mov rcx, r15
call fcn.18027d8a0
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.18027d5f0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1802c37d0
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x18031fb10
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800b7d20
add rsp, 0xd0
pop rbx
ret
Function at 0x140002945
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rcx
push r15
xor rax, rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [rsp + 0x28]
cmp r15, 1
jne 0x140002981
push qword [0x1400204e4]
pop rcx
call fcn.140007168
and rax, rax
je 0x140002981
push qword [0x1400204e4]
pop rcx
call fcn.140007204
push qword [0x140020594]
pop rcx
call fcn.14000e1bc
push qword [0x140020574]
pop rcx
call fcn.14000e1bc
call fcn.140004884
push qword [0x140020534]
pop rcx
call fcn.14000e1bc
push qword [0x14002050c]
pop rcx
call sub.KERNEL32.DLL_RemoveDirectoryW
push qword [0x1400205a4]
pop rcx
call sub.KERNEL32.DLL_RemoveDirectoryW
mov rax, qword [rsp + 0x40]
mov qword [0x1400204dc], rax
jmp 0x140001250
Function at 0x14000348c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.DLL_LoadResource
mov qword [rsp + 0x28], rax
push qword [rsp + 0x48]
push qword [rsp + 0x48]
pop rcx
pop rdx
call sub.KERNEL32.DLL_SizeofResource
mov qword [0x1400204f4], rax
push qword [0x1400204f4]
pop rcx
call fcn.14000d130
mov qword [rsp + 0x30], rax
push qword [0x1400204f4]
push qword [rsp + 0x38]
push qword [rsp + 0x38]
pop rcx
pop rdx
pop r8
call fcn.14000d260
push qword [rsp + 0x28]
pop rcx
call sub.KERNEL32.DLL_FreeResource
mov rax, qword [rsp + 0x30]
jmp 0x14000350a
add rsp, 0x38
ret

Function at 0x14000475f
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
xor rax, rax
push rax
push rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov rcx, qword [rsp + 0x70]
call fcn.140006b38
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140012a60
add rsp, 0x10
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
sub rsp, 0x10
call fcn.140012a60
add rsp, 0x10
push rcx
sub rsp, 0x28
call fcn.140012930
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140012930
add rsp, 0x28
pop rcx
push rax
push 0x800
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140008160
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140012980
push 0x800
push qword [rsp + 0x40]
pop rcx
pop rdx
call sub.KERNEL32.DLL_GetSystemDirectoryW
push qword [rsp + 0x38]
pop rcx
call sub.SHLWAPI.DLL_PathAddBackslashW
mov rcx, qword [rsp + 0x38]
push rcx
sub rsp, 0x28
call fcn.140012930
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140012bc0
add rsp, 0x28
pop rax
push rax
call fcn.140012d10
pop rdx
add rax, rdx
jmp 0x140004847
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140012ad0
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140012ad0
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140012ad0
add rsp, 0x28
pop rax
add rsp, 0x48
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.DLL_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.DLL_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.DLL_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.DLL_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret