joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140104dfc
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
mov r14, qword [rcx + 8]
mov r15, qword [rcx]
mov r9d, dword [rdi]
mov r8d, dword [rsi]
mov rdx, qword [r14]
mov rcx, qword [r15]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
test eax, eax
jns 0x140104e48
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140104e24
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x140104e68
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rdi, qword [rcx + 0x10]
mov rsi, qword [rcx + 8]
mov r14, qword [rcx]
mov ecx, dword [r14]
xor r9d, r9d
inc ecx
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_select]
movsxd rbx, eax
test eax, eax
jns 0x140104eb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
je 0x140104e88
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x140115950
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x140115add
cmp ecx, 0x7c
je 0x140115add
cmp ecx, 0x29
jne 0x1401159ca
cmp dword [rdi + 0x1c], 0
jne 0x140115add
lea rbx, [rdi + 0x80]
test dword [rbx], 0x10000000
je 0x140115af6
cmp ecx, 0x5d
jne 0x1401159a7
test dword [rbx], 0x10000000
je 0x140115b04
mov dl, byte [rdi + 0x78]
lea rcx, [rdi + 0x40]
call fcn.140114f44
mov rcx, rdi
call fcn.1401198b0
mov rcx, rdi
call fcn.140119924
mov ecx, dword [rdi + 0x7c]
mov al, 1
jmp 0x140115962
lea rbx, [rdi + 0x80]
cmp ecx, 0x2e
jne 0x1401159e1
lea rcx, [rdi + 0x40]
call fcn.1401151cc
jmp 0x1401159b3
cmp ecx, 0x5c
jne 0x140115a2f
mov rcx, rdi
call fcn.1401198b0
test byte [rbx], 0x80
je 0x140115a25
mov al, byte [rdi + 0x78]
cmp al, 0x62
jne 0x140115a0d
lea rcx, [rdi + 0x40]
call fcn.140115944
mov rcx, rdi
call fcn.1401198b0
jmp 0x1401159c3
cmp al, 0x42
jne 0x140115a25
lea rcx, [rdi + 0x40]
call fcn.140115944
lea rcx, [rdi + 0x40]
call fcn.14011984c
jmp 0x140115a03
mov rcx, rdi
call fcn.140115b20
jmp 0x1401159bb
cmp ecx, 0x5b
jne 0x140115a5a
mov rcx, rdi
call fcn.1401198b0
mov rcx, rdi
call fcn.140116528
mov edx, 0x5d
mov rcx, rdi
lea r8d, [rdx - 0x59]
call fcn.1401181d8
jmp 0x1401159bb
cmp ecx, 0x28
jne 0x140115a8f
mov rcx, rdi
call fcn.1401198b0
mov rcx, rdi
call fcn.14011a04c
mov edx, 0x29
mov rcx, rdi
mov bl, al
lea r8d, [rdx - 0x24]
call fcn.1401181d8
test bl, bl
je 0x1401159c3
jmp 0x1401159bb
cmp ecx, 0x5e
jne 0x140115aa2
lea rcx, [rdi + 0x40]
call fcn.140114f38
jmp 0x140115a03
cmp ecx, 0x24
jne 0x140115ab5
lea rcx, [rdi + 0x40]
call fcn.1401152cc
jmp 0x140115a03
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x140115b12
cmp ecx, 0x3f
je 0x140115b12
cmp ecx, 0x7b
je 0x140115b12
cmp ecx, 0x7d
jne 0x140115996
test dword [rbx], 0x10000000
je 0x140115ae8
jmp 0x1401159a7
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 6
mov rcx, rdi
call fcn.1401181cc
int3
mov edx, 5
mov rcx, rdi
call fcn.1401181cc
int3
mov edx, 4
mov rcx, rdi
call fcn.1401181cc
int3
mov edx, 0xa
mov rcx, rdi
call fcn.1401181cc
int3
Function at 0x140140f64
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1406a0188]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x1406a7d90]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1406a7c80], ecx
jg 0x140141046
mov eax, ebx
cmp rbx, rax
jne 0x140141008
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x140141008
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x1406a7c78]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x140141089
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140149980
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.14000a7c0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140140c94
lea rdx, [0x1401ab890]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x1406a7c80]
call fcn.140149e74
cmp dword [0x1406a7c80], 0xffffffff
jne 0x140140fb0
lea rcx, [0x1406a7c78]
call fcn.140140ba8
lea rcx, [0x14015087c]
call fcn.140149cd4
nop
lea rcx, [0x1406a7c80]
call fcn.140149e14
jmp 0x140140fb0
mov ecx, eax
call fcn.1401410cc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x140186c58]
lea rcx, [rsp + 0x20]
call fcn.14000a7c0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140140c94
lea rdx, [0x1401ab890]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x14014a8bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14014a906
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14014a906
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14014a906
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14014a906
cmp dword [rcx + 0x84], 0xe
jbe 0x14014a906
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14014a908
xor al, al
add rsp, 0x28
ret

Function at 0x1800010f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp ebx, 1
jne 0x180001122
xor eax, eax
lea r8, section..text
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1408ea160
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1408ea2e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1408ea191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408ea177
add dl, dl
jne 0x1408ea19e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408ea1fe
xor eax, eax
add dl, dl
jne 0x1408ea1ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408ea2b5
add dl, dl
jne 0x1408ea1be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408ea1cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408ea1d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408ea1e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1408ea1f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1408ea186
mov eax, 1
add dl, dl
jne 0x1408ea20e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1408ea21b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408ea203
sub eax, ebx
mov ebx, 1
jne 0x1408ea254
mov ecx, 1
add dl, dl
jne 0x1408ea236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408ea243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408ea22b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408ea186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1408ea270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1408ea27d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1408ea265
cmp eax, 0x7d00
jae 0x1408ea2a3
cmp eax, 0x500
jb 0x1408ea29e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408ea186
cmp eax, 0x7f
ja 0x1408ea2a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1408ea186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408ea2da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1408ea186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180006d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x180006d8c
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
mov r8, rax
add rdx, 4
mov ecx, 2
jmp fcn.180022fb0

Function at 0x180010f80
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
cmp qword [rcx + 0x2c8], 0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov rbp, r8
mov rdi, rcx
mov rsi, r9
movsxd rbx, edx
je 0x180010fe5
mov edx, 1
call fcn.18000e930
mov r11, qword [rdi + 0x218]
mov r9, rsi
mov r8, rbp
mov edx, ebx
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [rdi + 0x2c8]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.18000e930
mov eax, ebx
jmp 0x18001102b
test edx, edx
js 0x180011029
cmp ebx, 2
jg 0x180011029
mov r9, qword [rdi + 0x210]
lea rdx, [0x180186678]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.180167c68
mov r9, qword [rdi + 0x210]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.180167c68
xor eax, eax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x180014c00
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
lea rsi, [rcx + rdx]
cmp rcx, rsi
mov qword [rsp + 0x48], rdi
mov rbx, rcx
mov edi, 0x1505
jae 0x180014be0
movzx ecx, byte [rbx]
call fcn.180018740
add rbx, 1
movsx rdx, al
imul rdi, rdi, 0x21
xor rdi, rdx
cmp rbx, rsi
jb 0x180014bc4
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
movzx eax, dil
mov rdi, qword [rsp + 0x48]
add rsp, 0x28
ret
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
je 0x180014c36
call fcn.180014990
test eax, eax
jne 0x180014c36
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180014ae0
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x180014ba0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x18001ba60
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
xor eax, eax
mov r9, rdx
mov r8, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call fcn.18016a468
test rax, rax
je 0x18001ba89
cmp rax, 0xffffffffffffffff
jne 0x18001ba8b
xor eax, eax
add rsp, 0x38
ret
Function at 0x180048ab0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub rsp, 0x38
mov eax, dword [rcx + 0x18]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
lea r9d, [rax + rax]
mov eax, dword [rcx + 0x20]
mov rbx, rcx
lea rcx, [r9 + rax + 0x18]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x30], r12
mov r12d, r8d
mov rbp, rdx
call qword [0x1801f00a8]
test rax, rax
mov rdi, rax
je 0x180048bdc
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rdi + 0x10], rax
cmp r12d, dword [rbx + 0x1c]
jbe 0x180048b31
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, r12d
mov rdx, rbp
call qword [rbx + 8]
mov ebp, dword [rbx + 0x18]
mov rdx, qword [rdi + 8]
add rbp, qword [rdi + 0x10]
mov rcx, rbp
call qword [rbx + 0x10]
mov r12d, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x50], rsi
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test r12, r12
je 0x180048b96
mov rsi, r12
nop
movzx eax, byte [rbp]
lea rdx, [rsp + 0x20]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x20], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx r11d, byte [rbp]
lea rdx, [rsp + 0x20]
xor r11b, 0x5c
mov r8d, 1
add rbp, 1
mov byte [rsp + 0x20], r11b
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub r12, 1
jne 0x180048b50
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x180048bd4
nop
mov rcx, qword [rdi + 8]
lea rdx, [0x180190464]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x180190465]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
add rsi, 1
cmp rsi, rax
jb 0x180048ba0
mov rsi, qword [rsp + 0x50]
mov rax, rdi
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x180062e80
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, 0x20
call fcn.18017d710
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.1801566d0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1800639b0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, 0x20
call fcn.18017d710
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.1801566d0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180133ec0
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1210]
mov eax, 0x1310
call fcn.18017d710
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1350], rbx
mov qword [rsp + 0x1358], rsi
mov rax, qword [0x1801f0008]
xor rax, rsp
mov qword [rbp + 0x1200], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], rbx
cmp qword [rcx + 0x18], 0x10
jb 0x180133f31
mov rax, qword [rcx]
jmp 0x180133f34
mov rax, rsi
mov byte [rax], bl
xor r8d, r8d
lea rdx, [0x1801cbebe]
call fcn.180135950
mov dword [rsp + 0x20], 1
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [r14 + rdi], 0
jne 0x180133f51
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x200]
call fcn.1801566d0
lea rcx, [rdi + 1]
call fcn.18015beb0
mov r12, rax
test rax, rax
je 0x180133f9e
lea r8, [rdi + 1]
xor edx, edx
mov rcx, rax
call fcn.1801566d0
mov r8, rdi
mov rdx, r14
mov rcx, r12
call fcn.1801542b0
jmp 0x180133fb2
mov r8, r14
mov edx, 0x1000
lea rcx, [rbp + 0x200]
call fcn.1801580f8
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x20]
call fcn.1801566d0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xf0]
call fcn.1801566d0
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x180133fe0
test rax, rax
je 0x1801340b3
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov dword [rsp + 0x4c], 0x10325476
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x68], 0x80
test r12, r12
je 0x180134049
mov r8d, edi
mov rdx, r12
jmp 0x180134065
lea rax, [rbp + 0x200]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180134054
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x40]
call fcn.180136e70
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.180136f80
lea rdi, [rbp - 0x20]
lea r14, [rbp + 0xf0]
mov r15d, 0x10
nop
movzx r8d, byte [rdi]
lea rdx, [0x1801cbec0]
mov rcx, r14
call fcn.180133d00
add r14, 2
lea rdi, [rdi + 1]
sub r15, 1
jne 0x180134090
jmp 0x1801340cb
lea r8, [0x1801cbec8]
mov edx, 0x104
lea rcx, [rbp + 0xf0]
call fcn.1801580f8
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x20]
call fcn.1801566d0
movups xmm0, xmmword [rbp + 0xf8]
movups xmmword [rbp - 0x20], xmm0
movd eax, xmm0
test al, al
je 0x180134100
lea rax, [rbp - 0x20]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1801340f7
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.180135bb0
test r12, r12
je 0x18013411c
mov rcx, r12
call fcn.18015b844
mov rax, rsi
mov rcx, qword [rbp + 0x1200]
xor rcx, rsp
call fcn.1801511b0
lea r11, [rsp + 0x1310]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180134150
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1210]
mov eax, 0x1310
call fcn.18017d710
sub rsp, rax
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x1350], rbx
mov qword [rsp + 0x1358], rsi
mov rax, qword [0x1801f0008]
xor rax, rsp
mov qword [rbp + 0x1200], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], rbx
cmp qword [rcx + 0x18], 0x10
jb 0x1801341c1
mov rax, qword [rcx]
jmp 0x1801341c4
mov rax, rsi
mov byte [rax], bl
xor r8d, r8d
lea rdx, [0x1801cbebe]
call fcn.180135950
mov dword [rsp + 0x20], 1
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [r14 + rdi], 0
jne 0x1801341e1
xor edx, edx
mov r8d, 0x1000
lea rcx, [rbp + 0x200]
call fcn.1801566d0
lea rcx, [rdi + 1]
call fcn.18015beb0
mov r12, rax
test rax, rax
je 0x18013422e
lea r8, [rdi + 1]
xor edx, edx
mov rcx, rax
call fcn.1801566d0
mov r8, rdi
mov rdx, r14
mov rcx, r12
call fcn.1801542b0
jmp 0x180134242
mov r8, r14
mov edx, 0x1000
lea rcx, [rbp + 0x200]
call fcn.1801580f8
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x20]
call fcn.1801566d0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0xf0]
call fcn.1801566d0
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x180134270
test rax, rax
je 0x180134344
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov dword [rsp + 0x4c], 0x10325476
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rbx
mov byte [rbp - 0x68], 0x80
test r12, r12
je 0x1801342d9
mov r8d, edi
mov rdx, r12
jmp 0x1801342f5
lea rax, [rbp + 0x200]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1801342e4
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x40]
call fcn.180136e70
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x40]
call fcn.180136f80
lea rdi, [rbp + 0xf0]
lea r14, [rbp - 0x20]
mov r15d, 0x10
movzx r8d, byte [rdi]
lea rdx, [0x1801cbec0]
mov rcx, r14
call fcn.180133d00
add r14, 2
lea rdi, [rdi + 1]
sub r15, 1
jne 0x180134321
jmp 0x180134359
lea r8, [0x1801cbec8]
mov edx, 0x104
lea rcx, [rbp - 0x20]
call fcn.1801580f8
cmp byte [rbp - 0x20], 0
je 0x180134370
lea rax, [rbp - 0x20]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180134367
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.180135bb0
test r12, r12
je 0x18013438c
mov rcx, r12
call fcn.18015b844
mov rax, rsi
mov rcx, qword [rbp + 0x1200]
xor rcx, rsp
call fcn.1801511b0
lea r11, [rsp + 0x1310]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1801710ac
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180170f4c
call fcn.18015fb4c
mov dword [rax], 0x16
call fcn.18015be18
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180170f34
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180170f34
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x180170f7e
lock or dword [rax + 0x14], 0x10
jmp 0x180170f34
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180170f9b
mov rcx, qword [rbp + 0x10]
call fcn.18017b960
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.18016ce54
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.180170984
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x180170ff2
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x180170f34
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x18017105e
mov rcx, qword [rbp + 0x10]
call fcn.18016ce54
cmp eax, 0xffffffff
je 0x180171045
mov rcx, qword [rbp + 0x10]
call fcn.18016ce54
cmp eax, 0xfffffffe
je 0x180171045
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.18016ce54
movsxd rdi, eax
lea rsi, [0x18023ce40]
mov rcx, rbx
sar rdi, 6
call fcn.18016ce54
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x18017104c
lea rax, [0x180224310]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18017105e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x180171094
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x180171090
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x180171090
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x180170f37
jmp 0x180170f04

Function at 0x180172a6c
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x180172a49
call fcn.18015fb4c
mov dword [rax], 0x16
call fcn.18015be18
or eax, 0xffffffff
jmp 0x180172a66
sub dword [rcx + 0x10], 1
jns 0x180172a58
add rsp, 0x28
jmp fcn.1801710ac
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x180172a28