joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180146970
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
xor edi, edi
mov rbp, qword [rdx + 0x10]
lea rcx, [rbp + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
xor r8d, r8d
mov rcx, rsi
call fcn.180131ff0
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1801469d1
mov rdx, qword [rsi]
lea r9, [rbp - 2]
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r9, r9
je 0x180146a9f
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1801469f2
mov rax, qword [rbx]
movzx eax, byte [rax + rdi]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rdx], al
cmp qword [rbx + 0x18], 0xf
jbe 0x180146a11
mov rax, qword [rbx]
lea r8, [rdi + rax]
jmp 0x180146a18
lea r8, [rbx + rdi]
mov rax, rbx
movzx ecx, byte [rax + rdi + 1]
shr rcx, 4
movsx rax, byte [r8]
and eax, 3
shl rax, 4
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [rdx + 1], al
cmp qword [rbx + 0x18], 0xf
jbe 0x180146a47
mov rax, qword [rbx]
lea r8, [rax + 1]
jmp 0x180146a4e
lea r8, [rbx + 1]
mov rax, rbx
add r8, rdi
movzx ecx, byte [rax + rdi + 2]
shr rcx, 6
movsx rax, byte [r8]
and eax, 0xf
shl rax, 2
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [rdx + 2], al
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180146a7d
mov rax, qword [rbx]
movsx rax, byte [rax + rdi + 2]
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 3], al
add rdx, 4
add rdi, 3
cmp rdi, r9
jb 0x1801469e5
cmp rdi, rbp
jae 0x180146b50
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180146ab5
mov rax, qword [rbx]
movzx eax, byte [rax + rdi]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [rdx], al
lea rax, [rbp - 1]
cmp rdi, rax
jne 0x180146af5
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180146ada
mov rax, qword [rbx]
movsx rax, byte [rax + rdi]
and eax, 3
add rax, rax
movzx eax, byte [r10 + rax*8]
mov byte [rdx + 1], al
mov al, 0x3d
add rdx, 2
jmp 0x180146b4a
cmp qword [rbx + 0x18], 0xf
jbe 0x180146b05
mov rax, qword [rbx]
lea r8, [rdi + rax]
jmp 0x180146b0c
lea r8, [rdi + rbx]
mov rax, rbx
movzx ecx, byte [rax + rdi + 1]
shr rcx, 4
movsx rax, byte [r8]
and eax, 3
shl rax, 4
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [rdx + 1], al
add rdx, 2
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180146b3c
mov rax, qword [rbx]
movsx rcx, byte [rax + rdi + 1]
and ecx, 0xf
movzx eax, byte [r10 + rcx*4]
mov byte [rdx], al
mov byte [rdx + 1], 0x3d
mov rcx, rbx
call fcn.1801021b0
mov rax, rsi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1803fd0a0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180147060
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13f0
call fcn.1803fdff0
sub rsp, rax
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov r14, rdx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov dword [rsp + 0x20], esi
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rsi
mov r8d, 0x1a
lea rdx, str.0123456789ABCDEFGHabcdefgh
lea rcx, [rsp + 0x30]
call fcn.180102210
nop
call fcn.1803fa95c
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov ecx, 1
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x1801470f0
mov dword [rsp + 0x50], 0x270
mov ebp, dword [rsp + 0x40]
dec ebp
xorps xmm0, xmm0
movups xmmword [r14], xmm0
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r14], 0
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, r14
call fcn.180120ed0
mov r13d, 0x80000000
xor ebp, r13d
mov r15, qword [rsp + 0x48]
mov r12, qword [rsp + 0x30]
nop
lea rcx, [rsp + 0x50]
cmp ebp, 0x7fffffff
jne 0x180147176
call fcn.18013e480
mov ecx, eax
jmp 0x1801471b8
lea ebx, [rbp - 0x7fffffff]
call fcn.18013e480
mov edi, ebx
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jae 0x1801471b4
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x1801471b4
nop dword [rax + rax]
lea rcx, [rsp + 0x50]
call fcn.18013e480
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x1801471a0
shr rcx, 0x20
lea eax, [rcx + r13]
xor eax, r13d
lea rcx, [rsp + 0x30]
cmp r15, 0xf
cmova rcx, r12
cdqe
movzx edx, byte [rax + rcx]
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x1801471df
mov rcx, qword [r14]
mov byte [rcx + rsi], dl
inc rsi
cmp rsi, 0x10
jl 0x180147160
lea rcx, [rsp + 0x30]
call fcn.1801021b0
mov rax, r14
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1803fd0a0
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18014be70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rdx + 8], 0
mov r10, rcx
je 0x18014beb1
xor eax, eax
cmp qword [rdx + 0x18], rax
je 0x18014beb1
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rdx]
mov rcx, rax
add r8, rax
and ecx, 3
add r8, qword [r10 + 0x40]
inc rax
movzx ecx, byte [rcx + rdx + 0x20]
xor byte [r8], cl
cmp rax, qword [rdx + 0x18]
jne 0x18014be90
ret
Function at 0x18014cab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, qword [rsp + 0x90]
mov r11, r8
mov rdi, qword [r8 + 0x10]
mov ebx, edx
mov rsi, rcx
test r9b, r9b
je 0x18014cb98
cmp edx, 4
je 0x18014cc13
call fcn.18014a3b0
movzx r11d, al
test edx, edx
jne 0x18014cb63
add rcx, 0x210
xor r9d, r9d
cmp qword [rcx + 0x18], 0xf
lea rax, [rcx + 0x10]
mov rax, qword [rcx + 0x10]
jbe 0x18014cb22
mov rdx, qword [rcx]
mov rcx, rdx
add rax, rdx
jmp 0x18014cb25
add rax, rcx
cmp rcx, rax
je 0x18014cb5a
lea r10, [0x180545860]
movzx edx, byte [rcx]
movzx r8d, byte [rdx + r10]
lea edx, [r9 + 0x10]
shl edx, 4
add edx, r8d
movzx r9d, byte [rdx + r10]
cmp r9d, 1
je 0x18014cbfa
inc rcx
cmp rcx, rax
jne 0x18014cb31
test r9d, r9d
jne 0x18014cbfa
mov rcx, qword [rbp + 0x38]
xor r11b, 1
mov dword [rsp + 0x38], ebx
mov byte [rsp + 0x30], r11b
mov qword [rsp + 0x40], rdi
test rcx, rcx
je 0x18014cc6a
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], r8
lea rdx, [rsi + 0x210]
jmp 0x18014cc37
test ebx, ebx
jne 0x18014cc13
xor r9d, r9d
cmp qword [r8 + 0x18], 0xf
jbe 0x18014cbb1
mov rcx, qword [r8]
mov rax, rcx
add rcx, rdi
jmp 0x18014cbb8
lea rcx, [r8 + rdi]
mov rax, r11
cmp rax, rcx
je 0x18014cbf5
lea r10, [0x180545860]
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax]
movzx r8d, byte [rdx + r10]
lea edx, [r9 + 0x10]
shl edx, 4
add edx, r8d
movzx r9d, byte [rdx + r10]
cmp r9d, 1
je 0x18014cbfa
inc rax
cmp rax, rcx
jne 0x18014cbd0
test r9d, r9d
je 0x18014cc13
mov edx, 0x3ef
lea r8, [0x18059da90]
xor r9d, r9d
mov rcx, rsi
call fcn.18014d6b0
jmp 0x18014cc47
mov rcx, qword [rbp + 0x38]
mov dword [rsp + 0x38], ebx
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x40], rdi
test rcx, rcx
je 0x18014cc64
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov rdx, r11
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1803fd0a0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call fcn.1803f9280
int3
call fcn.1803f9280
int3
Function at 0x18014e000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov rdi, r8
mov r15, rdx
mov r14, rcx
lea rbx, [rcx + 0x70]
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call fcn.1803fa42c
test eax, eax
jne 0x18014e0fe
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x18014e0ee
mov r8, qword [r15]
mov r9, qword [r15 + 8]
sub r9, r8
mov rdx, qword [r14 + 0x60]
lea rcx, [r14 + 0x58]
call fcn.1801375d0
xor ebp, ebp
mov r9d, ebp
cmp rdi, rsi
je 0x18014e070
mov r9, rsi
sub r9, rdi
mov r8, rdi
mov rdx, qword [r14 + 0x60]
lea rcx, [r14 + 0x58]
call fcn.18014e110
lea rcx, [r14 + 0x20]
call fcn.180100000
movzx ecx, byte [rax]
test cl, cl
je 0x18014e0d0
mov r8, qword [rsp + 0x80]
test r8, r8
je 0x18014e0d0
mov r9, qword [rsp + 0x88]
nop word [rax + rax]
mov rax, qword [r14 + 0x60]
sub rax, r8
movzx edx, byte [rax + rbp]
mov rcx, rbp
and ecx, 3
xor dl, byte [rcx + r9]
mov byte [rax + rbp], dl
inc rbp
cmp rbp, r8
jne 0x18014e0b0
mov rcx, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
jmp fcn.1803fa434
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.1803fa3e4
int3
mov ecx, 5
call fcn.1803fa3e4
int3

Function at 0x180157e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, edx
mov rdi, r8
movzx r8d, byte [rcx + 4]
mov rsi, r9
movsxd rdx, edx
mov rbx, rcx
add rdx, 2
shl rdx, 4
call fcn.180159730
mov r8, qword [rbx + 0x18]
lea r9, [rbx + 0x18]
mov r10, rax
sub r8, r9
movzx ecx, byte [r8 + 0x28]
mov byte [rax + 1], 6
and cl, 3
mov byte [rax + 2], cl
movzx ecx, byte [rbx + 4]
mov byte [rax], cl
mov byte [rax + 3], 0
mov qword [rax + 0x10], rdi
mov byte [rax + 4], bpl
movzx ecx, byte [rsi + 4]
mov byte [rax + 5], cl
mov byte [rax + 6], 0
add rax, 0x18
xor rax, rsi
mov qword [r10 + 0x18], rax
test ebp, ebp
jle 0x180157efc
lea rax, [r10 + 0x2c]
mov ecx, ebp
xor edx, edx
nop word [rax + rax]
mov dword [rax], edx
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x180157ef0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18015b360
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
xor r11d, r11d
mov r9, rdx
mov r10, rcx
mov ebx, r11d
mov r8d, edx
cmp rdx, 0x20
jb 0x18015b3e8
add rdx, 0xffffffffffffffec
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff4
add r9, rax
nop word [rax + rax]
add r8d, dword [r10 + 8]
movsd xmm0, qword [r10]
mov ecx, r8d
ror ecx, 0xe
add r10, 0xc
movsd qword [rsp], xmm0
add r11d, dword [rsp]
mov rax, qword [rsp]
xor r11d, r8d
sub r11d, ecx
shr rax, 0x20
add ebx, eax
mov ecx, r11d
ror ecx, 0xb
xor ebx, r11d
sub ebx, ecx
xor r8d, ebx
mov eax, ebx
ror eax, 0x19
sub r8d, eax
sub rdx, 1
jne 0x18015b3a0
test r9, r9
je 0x18015b40f
nop dword [rax]
movzx ecx, byte [r10 + r9 - 1]
mov eax, r8d
shl eax, 5
add ecx, eax
mov eax, r8d
shr eax, 2
add ecx, eax
xor r8d, ecx
sub r9, 1
jne 0x18015b3f0
mov eax, r8d
add rsp, 0x10
pop rbx
ret

Function at 0x18015ecd0
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, edx
lea r9, [rcx + 0x18]
movzx ecx, byte [rcx + 4]
xor r9, qword [r9]
shr eax, 0x10
xor eax, edx
imul edx, eax, 0x85ebca6b
mov eax, edx
shr eax, 0xd
xor eax, edx
imul r8d, eax, 0xc2b2ae35
mov eax, 1
shl eax, cl
dec eax
cdqe
mov edx, r8d
shr rdx, 0x10
movsxd rcx, r8d
xor rdx, rcx
and rax, rdx
shl rax, 5
add rax, r9
ret
sub rsp, 0x18
mov r9d, dword [rdx + 8]
xor eax, eax
movsd xmm0, qword [rdx]
mov r11, rcx
movsd qword [rsp], xmm0
mov ecx, dword [rsp + 4]
mov edx, dword [rsp]
cmp edx, 0x80000000
lea r10, [r11 + 0x18]
cmove edx, eax
cmp ecx, 0x80000000
cmove ecx, eax
cmp r9d, 0x80000000
cmove r9d, eax
xor r10, qword [r10]
mov eax, ecx
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x127409f
movsxd r8, eax
mov eax, r9d
shr eax, 0x11
xor eax, r9d
imul eax, eax, 0x4f9ffb7
movsxd rcx, eax
mov eax, edx
shr eax, 0x11
xor r8, rcx
movzx ecx, byte [r11 + 4]
xor eax, edx
imul eax, eax, 0x466f45d
mov edx, 1
shl edx, cl
dec edx
movsxd rcx, edx
cdqe
xor rax, r8
and rax, rcx
shl rax, 5
add rax, r10
add rsp, 0x18
ret
mov r8d, dword [rdx + 0xc]
mov r9, rdx
sub r8d, 1
je 0x18015ed38
sub r8d, 1
je 0x18015ed33
sub r8d, 1
je 0x18015ed2b
sub r8d, 1
je 0x18015ed22
mov rdx, qword [rdx]
cmp r8d, 1
jne 0x18015ed2e
lea r8, [rcx + 0x18]
add rdx, 0x10
movzx ecx, byte [rcx + 4]
mov eax, 1
xor r8, qword [r8]
shl eax, cl
sub edx, dword [rdx]
dec eax
cdqe
movsxd rcx, edx
and rax, rcx
shl rax, 5
add rax, r8
ret
movsd xmm1, qword [rdx]
jmp fcn.18015ebb0
mov rdx, qword [rdx]
jmp 0x18015eb60
jmp 0x18015ec30
lea rdx, [rcx + 0x18]
mov eax, 1
movzx ecx, byte [rcx + 4]
xor rdx, qword [rdx]
shl eax, cl
movsxd rcx, dword [r9]
dec eax
cdqe
and rax, rcx
shl rax, 5
add rax, rdx
ret
Function at 0x18015f270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov esi, r8d
mov r15, rdx
mov r9, rcx
mov ebp, 1
test r8d, r8d
jne 0x18015f2af
mov rax, qword [0x18059db80]
lea rcx, [rdx + 0x18]
xor rax, rcx
mov qword [rcx], rax
xor ecx, ecx
mov edi, ecx
jmp 0x18015f32c
lea ecx, [r8 - 1]
call fcn.18015a1d0
lea edi, [rax + 1]
cmp edi, 0x1a
jg 0x18015f359
mov ecx, edi
mov esi, ebp
shl esi, cl
movabs rax, 0x7ffffffffffffff
movsxd rbx, esi
mov rcx, r9
cmp rbx, rax
ja 0x18015f353
movzx r8d, byte [r15]
mov rdx, rbx
shl rdx, 5
mov qword [rsp + 0x40], r14
lea r14, [r15 + 0x18]
call fcn.180159690
xor rax, r14
mov qword [r14], rax
test esi, esi
jle 0x18015f327
xor ecx, ecx
mov edx, ecx
nop word [rax + rax]
mov rax, r14
lea rdx, [rdx + 0x20]
xor rax, qword [r14]
mov dword [rax + rdx - 4], ecx
mov dword [rax + rdx - 0x14], ecx
sub rbx, rbp
jne 0x18015f310
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov ecx, edi
shl bpl, cl
dec bpl
mov byte [r15 + 4], dil
mov byte [r15 + 7], bpl
mov rbp, qword [rsp + 0x50]
mov dword [r15 + 0xc], esi
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
call fcn.180159300
int3
lea rdx, str.table_overflow
mov rcx, r9
call fcn.180157060
int3

Function at 0x180160200
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov rdx, rcx
mov r8d, r10d
cmp dword [rcx + 8], r10d
jle 0x18016023a
mov ecx, r10d
nop dword [rax]
nop word [rax + rax]
lea rax, [rdx + 0x28]
inc r8d
xor rax, qword [rdx + 0x28]
lea rcx, [rcx + 0x10]
mov dword [rax + rcx - 4], r10d
cmp r8d, dword [rdx + 8]
jl 0x180160220
cmp dword [rdx + 0xc], r10d
jg 0x180160244
mov dword [rdx + 0xc], r10d
lea rax, [rdx + 0x18]
xor rax, qword [rdx + 0x18]
cmp rax, qword [0x18059db80]
je 0x18016028c
movzx ecx, byte [rdx + 4]
mov eax, 1
shl eax, cl
mov dword [rdx + 0xc], eax
movsxd r9, eax
test eax, eax
jle 0x18016028c
mov rcx, r10
nop dword [rax]
lea rax, [rdx + 0x18]
xor rax, qword [rdx + 0x18]
lea rcx, [rcx + 0x20]
mov dword [rax + rcx - 0x14], r10d
mov dword [rax + rcx - 4], r10d
sub r9, 1
jne 0x180160270
mov byte [rdx + 5], 0xff
ret
Function at 0x1801611a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0xa0]
mov r13d, r9d
movsxd rdi, r8d
mov rsi, rdx
sub r13d, edi
mov ebp, r9d
mov r14, rcx
lea eax, [r13 + 1]
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
sub ebx, 1
js 0x1801611ff
nop dword [rax]
mov dword [rsp + 0x28], ebx
mov r9d, ebp
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, r14
call fcn.180160ff0
sub ebx, 1
jns 0x1801611e0
movsxd rbx, r13d
test r13d, r13d
jle 0x180161270
mov qword [rsp + 0x38], r12
lea rcx, [rsi + 0x28]
lea r12d, [rbp - 1]
mov r13, rdi
add r13, r13
lea rbp, [rdi + rbx]
shl rbp, 4
mov rax, rcx
mov dword [rsp + 0x28], 0
xor rax, qword [rcx]
mov r9d, r12d
mov r8d, edi
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, r14
movups xmm0, xmmword [rax + rbp]
movups xmm1, xmmword [rax + r13*8]
movups xmmword [rax + r13*8], xmm0
movups xmmword [rax + rbp], xmm1
call fcn.180160ff0
dec r12d
lea rbp, [rbp - 0x10]
dec rbx
lea rcx, [rsi + 0x28]
test rbx, rbx
jg 0x180161222
mov r12, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18016b360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
mov r15, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rdx
mov ecx, dword [str.RSB1]
mov dword [rsp + 0x20], ecx
movzx eax, byte [0x180552504]
mov byte [rsp + 0x24], al
mov rax, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x18016b3b4
mov rax, qword [rdx]
mov eax, dword [rax]
mov dword [rsp + 0x38], eax
xor r9d, r9d
cmp dword [reloc.WS2_32.dll_accept], 6
jl 0x18016b3ff
movd xmm3, ecx
movd xmm0, eax
xorps xmm3, xmm0
mov eax, dword [0x180554320]
movd xmm0, eax
vpmovzxbw ymm2, xmm0
vpmovzxbw ymm1, xmmword [0x180554370]
vpmullw ymm2, ymm2, ymm1
vpmovwb xmm0, ymm2
psubb xmm3, xmm0
movd dword [rsp + 0x38], xmm3
jmp 0x18016b436
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rsp + r8 + 0x20]
xor dl, byte [rsp + r8 + 0x38]
movzx eax, r9b
imul ecx, eax, 0x29
sub dl, cl
mov byte [rsp + r8 + 0x38], dl
inc r9d
lea r8, [r8 + 1]
cmp r9d, 4
jb 0x18016b410
xor ecx, ecx
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x18016b47e
xor r8d, r8d
nop dword [rax]
nop dword [rax + rax]
mov rax, rcx
and eax, 3
movzx edx, byte [rsp + rax + 0x38]
add rdx, r8
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18016b46b
mov rax, qword [rbx]
xor byte [rax + rcx], dl
inc rcx
add r8, 0x29
mov rdx, qword [rbx + 0x10]
cmp rcx, rdx
jb 0x18016b450
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18016b48b
mov rcx, qword [rbx]
mov r8d, 0x2a
call fcn.180398d20
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18016b4a3
mov rax, qword [rbx]
xorps xmm0, xmm0
mov r14d, dword [rax + 4]
movdqu xmmword [rsp + 0x40], xmm0
xor esi, esi
mov qword [rsp + 0x50], rsi
test r14, r14
je 0x18016b4f7
mov ecx, r14d
cmp r14, 0x1000
jb 0x18016b4cf
call fcn.1801022f0
jmp 0x18016b4d4
call fcn.1803fd0c0
mov rdi, rax
mov qword [rsp + 0x40], rax
lea rsi, [rax + r14]
mov qword [rsp + 0x50], rsi
mov rdx, rsi
mov rcx, rax
call fcn.18010bf90
mov qword [rsp + 0x48], rsi
jmp 0x18016b4fc
mov rdi, qword [rsp + 0x40]
mov r9, qword [rbx + 0x10]
sub r9, 8
mov r8, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18016b511
mov r8, qword [rbx]
add r8, 8
mov rdx, r14
mov rcx, rdi
call fcn.180397a70
xorps xmm0, xmm0
movups xmmword [r15], xmm0
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 0
mov r8, r14
mov rdx, rdi
mov rcx, r15
call fcn.180102210
nop
test rdi, rdi
je 0x18016b57b
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x18016b56f
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18016b5a9
mov rdx, rsi
mov rcx, rdi
call fcn.1803fd0fc
nop
mov rcx, rbx
call fcn.1801021b0
mov rax, r15
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1803fd0a0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.180403864
nop
int3
Function at 0x18018a670
Capabilities:
Hash data using fnv

Disassembly:
mov rdx, rcx
jmp 0x18018aad0
movzx r8d, byte [rdx]
movabs r9, 0x100000001b3
movzx ecx, byte [rdx + 6]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, r9
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, r9
xor rax, r8
imul rax, r9
xor rax, rcx
movzx ecx, byte [rdx + 7]
imul rax, r9
xor rax, rcx
imul rax, r9
ret
Function at 0x1801ab150
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1803fdff0
sub rsp, rax
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r9
mov rbx, rcx
cmp edx, 0x1d
je 0x1801ab187
mov eax, 0xfffffffe
jmp 0x1801ab2a9
test rbx, rbx
je 0x1801ab2a7
cmp r8d, 0x30
jne 0x1801ab2a7
mov r8d, gethostbyaddr
mov rdx, rdi
call fcn.1801ab010
test eax, eax
jle 0x1801ab2a7
movdqa xmm0, xmmword [str.6666666666666666_]
lea rdx, [rsp + 0x20]
mov r8d, 0x28
movq qword [rsp + 0x40], xmm0
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
call fcn.1801ab010
test eax, eax
je 0x1801ab2a7
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1801aae10
test eax, eax
je 0x1801ab2a7
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx + 0x14], xmm0
mov r8d, gethostbyaddr
mov rdx, rdi
movups xmmword [rbx + 0x24], xmm0
mov rcx, rbx
movups xmmword [rbx + 0x34], xmm0
movups xmmword [rbx + 0x44], xmm0
mov qword [rbx + 0x54], rax
mov dword [rbx + 0x5c], eax
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
call fcn.1801ab010
test eax, eax
jle 0x1801ab2a7
movdqa xmm0, xmmword [0x180463520]
lea rdx, [rsp + 0x20]
mov r8d, 0x28
movq qword [rsp + 0x40], xmm0
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
call fcn.1801ab010
test eax, eax
je 0x1801ab2a7
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1801ab010
test eax, eax
je 0x1801ab2a7
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x48]
call fcn.180001240
mov eax, 1
jmp 0x1801ab2a9
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1803fd0a0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x1801ab910
Capabilities:
Hash data using sha256

Disassembly:
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
mov qword [rcx + 0x60], rax
mov dword [rcx + 0x68], eax
mov eax, 1
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov dword [rcx + 0x6c], 0x18
ret