joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800331e0
Capabilities:
Get mac address on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov dword [rsp + 0x38], 0x2c0
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0x2c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x18003322d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x180033282
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x18003321b
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x1800332ca
movzx eax, byte [rdi]
movzx ecx, byte [rdi + 4]
mov byte [rsp + 0x40], al
movzx eax, byte [rdi + 2]
mov byte [rsp + 0x41], al
mov rax, rbx
movzx edx, word [rsp + 0x40]
cmp dword [rax + 0x194], 6
jne 0x1800332bb
cmp dx, word [rax + 0x198]
jne 0x1800332bb
cmp cl, byte [rax + 0x19a]
je 0x1800332c5
mov rax, qword [rax]
test rax, rax
jne 0x1800332a1
jmp 0x1800332ca
mov esi, 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1800332f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1801f5f20]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800333ad
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800333a4
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov rcx, rdi
test eax, eax
jne 0x18003336f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x1800333af
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1800333a4
nop
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov rcx, rdi
test eax, eax
je 0x180033363
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180033380
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180131f30
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x1800333d0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x40], rbp
xor r8d, r8d
mov dword [rsp + 0x38], ebp
or edx, 0xffffffff
mov qword [rsp + 0x30], rbp
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
lea r9, [0x1801ae3c0]
mov qword [rsp + 0x20], rdi
xor edx, edx
lea r8d, [rbp + 1]
lea rcx, [0x1801873c8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x180033457
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rcx, str.ROOTCIMV2
mov qword [rsp + 0x60], rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
test rax, rax
je 0x1800334b5
mov rcx, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x38], rbp
mov rdx, rax
mov qword [rsp + 0x30], rbp
mov r10, qword [rcx]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbp
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, rbx
test eax, eax
jns 0x1800334af
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1800334ee
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsi]
xor r9d, r9d
mov dword [rsp + 0x38], ebp
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
lea edx, [r9 + 0xa]
mov dword [rsp + 0x20], 3
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x180033501
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x180033506
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180033ce0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov eax, dword [rcx]
test eax, eax
jne 0x180033d2b
call fcn.180114060
mov rdi, rax
call fcn.180114044
cqo
idiv rdi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rdi
add rcx, rax
xor qword [rbx + 8], rcx
jmp 0x180033d42
cmp eax, 1
jne 0x180033d42
imul rax, qword [rcx + 8], 0x19660d
add rax, 0x3c6ef35f
mov qword [rcx + 8], rax
mov r8d, 0x20
mov rdx, qword [rbx + 8]
mov r9d, 0xf5000000
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
and rcx, r9
shr rdx, 1
xor rcx, rdx
movzx eax, cl
and al, 1
neg al
sbb rdx, rdx
and rdx, r9
shr rcx, 1
xor rdx, rcx
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
and rcx, r9
shr rdx, 1
xor rcx, rdx
movzx eax, cl
and al, 1
neg al
sbb rdx, rdx
and rdx, r9
shr rcx, 1
xor rdx, rcx
add r8d, 0xfffffffc
jne 0x180033d52
mov qword [rbx + 8], rdx
cmp dword [rbx], r8d
jne 0x180033dc5
mov ecx, edx
call fcn.180154e0c
call fcn.180154de0
movsxd rcx, eax
mov qword [rbx + 8], rcx
mov rax, rcx
jmp 0x180033dc8
mov rax, rdx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180075180
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x20], 0
mov rbx, rcx
je 0x1800751dd
mov rcx, qword [rcx]
call fcn.180073c20
mov ecx, eax
test eax, eax
jne 0x1800751fb
movups xmm1, xmmword [rbx + 0x28]
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x38], xmm1
movups xmmword [rbx + 0x28], xmm0
mov rax, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rax
jne 0x1800751c6
mov eax, ecx
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
lea rdx, [0x180075160]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.18003bec0
call fcn.180074e90
movups xmm0, xmmword [rbx + 0x38]
movups xmmword [rbx + 0x28], xmm0
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x30], rcx
jne 0x1800751fb
mov dword [rbx + 0x1c], 1
add rsp, 0x20
pop rbx
ret

Function at 0x1800850a0
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov r14d, dword [rsp + 0x70]
mov ebx, r8d
mov dword [rax - 0x18], r14d
mov rbp, r9
mov qword [rax - 0x20], r9
mov rdi, rdx
mov r9, rdx
mov byte [rcx + 0x1c], 1
mov r8, rdx
mov dword [rax - 0x28], ebx
lea rdx, str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
mov rsi, rcx
call fcn.18008d620
test ebx, ebx
jne 0x180085109
mov r9, rbp
mov dword [rsp + 0x20], r14d
mov r8, rdi
lea rdx, str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
mov rcx, rsi
call fcn.18008d620
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800a2420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r13
push r14
sub rsp, 0x38
mov rsi, qword [rcx + 0xa0]
mov r14, rcx
mov r13, qword [rcx]
mov rbx, qword [rcx + 0x10]
test rsi, rsi
je 0x1800a2628
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], r12
xor r12d, r12d
mov qword [rsp + 0x30], r15
nop dword [rax]
movsxd r8, dword [rsi + 0x10]
xor edx, edx
mov rax, qword [r13 + 0x20]
mov r9, r8
mov edi, dword [rsi + 0x14]
mov rcx, r14
shl r9, 5
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
mov r9, qword [r9 + rax + 0x18]
mov r9, qword [r9 + 0x68]
call fcn.1800a19a0
mov rax, qword [rsi + 8]
lea r15d, [rdi - 1]
movsxd rdx, dword [rbx + 0x90]
mov rbp, qword [rax]
cmp dword [rbx + 0x94], edx
jg 0x1800a24c2
xor r8d, r8d
mov dword [rsp + 0x20], r12d
mov r9d, r15d
mov rcx, rbx
lea edx, [r8 + 0x75]
call fcn.180060720
mov edx, eax
jmp 0x1800a24ed
lea rcx, [rdx + rdx*2]
lea eax, [rdx + 1]
mov dword [rbx + 0x90], eax
mov rax, qword [rbx + 0x88]
mov qword [rax + rcx*8], 0x75
mov dword [rax + rcx*8 + 8], r15d
mov dword [rax + rcx*8 + 0xc], r12d
mov qword [rax + rcx*8 + 0x10], r12
xor r9d, r9d
mov r8, rbp
mov rcx, rbx
call fcn.180061be0
mov eax, dword [rbx + 0x90]
add eax, 0xc
cmp eax, dword [rbx + 0x94]
jle 0x1800a251c
mov rcx, rbx
call fcn.1800605e0
test eax, eax
jne 0x1800a2614
movsxd rax, dword [rbx + 0x90]
lea r8, [0x1801a1b7a]
mov r10d, reloc.WS2_32.dll_inet_ntoa
lea r11, [0x1801a6900]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x88]
lea rax, [rax + rcx*8]
mov r9, rax
nop dword [rax]
movzx ecx, byte [r8 - 2]
mov byte [rax], cl
movsx ecx, byte [r8 - 1]
mov dword [rax + 4], ecx
movsx edx, byte [r8]
mov dword [rax + 8], edx
movzx ecx, byte [r8 - 2]
test byte [rcx + r11], 1
je 0x1800a2580
cmp byte [r8], r12b
jle 0x1800a2580
add edx, dword [rbx + 0x90]
mov dword [rax + 8], edx
movsx ecx, byte [r8 + 1]
add r8, 4
mov dword [rax + 0xc], ecx
mov byte [rax + 1], r12b
mov qword [rax + 0x10], r12
mov word [rax + 2], r12w
add rax, 0x18
sub r10, 1
jne 0x1800a2550
add dword [rbx + 0x90], 0xc
test r9, r9
je 0x1800a2614
mov eax, reloc.WS2_32.dll_recv
mov dword [r9 + 8], edi
mov word [r9 + 0x4a], ax
lea ecx, [rdi + 2]
lea eax, [rdi + 1]
mov dword [r9 + 0xc], ecx
mov dword [r9 + 0x68], eax
mov dword [r9 + 0x3c], edi
mov dword [r9 + 0x4c], r15d
mov dword [r9 + 0x54], edi
mov dword [r9 + 0x84], edi
mov dword [r9 + 0x94], edi
mov dword [r9 + 0xb0], ecx
mov dword [r9 + 0xac], edi
mov dword [r9 + 0xf8], edi
cmp dword [r14 + 0x34], r12d
jne 0x1800a2608
mov dword [r14 + 0x34], 1
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1800a2460
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop r13
pop rsi
pop rbx
ret
Function at 0x1800a26b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r12
push r14
sub rsp, 0x38
mov r14, qword [rcx + 0xa0]
mov rdi, rcx
mov rbx, qword [rcx + 0x10]
mov r12, qword [rcx]
test r14, r14
je 0x1800a28b2
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r13
xor r13d, r13d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x60], rbp
nop dword [rax]
movsxd rsi, dword [r14 + 0x10]
movzx eax, byte [rdi + 0x1f]
mov r15d, dword [r14 + 0x14]
shl rsi, 5
add rsi, qword [r12 + 0x20]
test al, al
jne 0x1800a2711
inc dword [rdi + 0x38]
mov ebp, dword [rdi + 0x38]
jmp 0x1800a2720
dec al
movzx eax, al
mov byte [rdi + 0x1f], al
mov ebp, dword [rdi + rax*4 + 0xe0]
movsxd rcx, dword [rbx + 0x90]
lea r8d, [r15 + 2]
lea edx, [rcx + 7]
cmp dword [rbx + 0x94], ecx
jg 0x1800a274d
mov r9d, edx
mov dword [rsp + 0x20], r15d
mov edx, 0x37
mov rcx, rbx
call fcn.180060720
jmp 0x1800a277b
lea eax, [rcx + 1]
mov dword [rbx + 0x90], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rbx + 0x88]
mov dword [rax + rcx*8], 0x37
mov dword [rax + rcx*8 + 4], r8d
mov dword [rax + rcx*8 + 8], edx
mov dword [rax + rcx*8 + 0xc], r15d
mov qword [rax + rcx*8 + 0x10], r13
mov r9, qword [rsi + 0x18]
xor edx, edx
mov r8d, dword [r14 + 0x10]
mov rcx, rdi
mov dword [rsp + 0x20], WSAStartup
mov r9, qword [r9 + 0x68]
call fcn.1800a19a0
mov eax, dword [rbx + 0x90]
add eax, 5
cmp eax, dword [rbx + 0x94]
jle 0x1800a27ba
mov rcx, rbx
call fcn.1800605e0
test eax, eax
jne 0x1800a289e
movsxd rax, dword [rbx + 0x90]
lea r8, [0x1801a2dfa]
mov r10d, 5
lea r11, [0x1801a6900]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x88]
lea rax, [rax + rcx*8]
mov r9, rax
nop word [rax + rax]
movzx ecx, byte [r8 - 2]
mov byte [rax], cl
movsx ecx, byte [r8 - 1]
mov dword [rax + 4], ecx
movsx edx, byte [r8]
mov dword [rax + 8], edx
movzx ecx, byte [r8 - 2]
test byte [rcx + r11], 1
je 0x1800a2820
cmp byte [r8], r13b
jle 0x1800a2820
add edx, dword [rbx + 0x90]
mov dword [rax + 8], edx
movsx ecx, byte [r8 + 1]
add r8, 4
mov dword [rax + 0xc], ecx
mov byte [rax + 1], r13b
mov qword [rax + 0x10], r13
mov word [rax + 2], r13w
add rax, 0x18
sub r10, 1
jne 0x1800a27f0
add dword [rbx + 0x90], 5
test r9, r9
je 0x1800a289e
mov dword [r9 + 0x3c], ebp
lea ecx, [r15 + 1]
mov dword [r9 + 4], ecx
lea eax, [r15 - 1]
mov dword [r9 + 0x34], eax
mov eax, 8
mov word [r9 + 0x4a], ax
mov dword [r9 + 0x20], ecx
mov dword [r9 + 0x50], ebp
mov dword [r9 + 0x54], ecx
test ebp, ebp
je 0x1800a2892
movzx eax, byte [rdi + 0x1f]
cmp al, 8
jae 0x1800a2892
movzx eax, al
mov dword [rdi + rax*4 + 0xe0], ebp
inc byte [rdi + 0x1f]
mov r14, qword [r14]
test r14, r14
jne 0x1800a26f0
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r14
pop r12
pop rdi
pop rbx
ret
Function at 0x1801342f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1801f5f20]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 0x30]
xor edi, edi
mov dword [rsp + 0x24], edi
mov rbx, rdx
test rcx, rcx
jne 0x18013432f
mov qword [rdx + 0x18], SafeArrayLock
mov qword [rdx + 0x10], rdi
mov byte [rdx], dil
jmp 0x1801343b7
xor eax, eax
mov word [rsp + 0x28], di
lea r8, [rsp + 0x20]
mov qword [rsp + 0x2a], rax
lea rdx, [rsp + 0x28]
mov dword [rsp + 0x32], eax
mov word [rsp + 0x36], ax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x180134371
mov qword [rbx + 0x18], SafeArrayLock
mov qword [rbx + 0x10], rdi
mov byte [rbx], dil
jmp 0x1801343b7
mov ecx, dword [rsp + 0x2c]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov qword [rbx + 0x18], SafeArrayLock
mov qword [rbx + 0x10], rdi
mov byte [rbx], dil
test rax, rax
je 0x1801343b7
cmp byte [rax], dil
je 0x1801343a9
or rdi, 0xffffffffffffffff
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1801343a0
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call fcn.180006768
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180131f30
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180136cd0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
test r8, r8
je 0x180136cf3
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor al, byte [rcx]
lea rcx, [rcx + 1]
or r9b, al
sub r8, 1
jne 0x180136ce0
movzx ecx, r9b
mov eax, 0x100
sub eax, ecx
sar eax, 8
ret
Function at 0x18013e930
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x1801f5f20]
xor rax, rbp
mov qword [rbp], rax
movzx edi, word [rcx + 0xe]
mov r12, r9
movzx r13d, word [rcx + 0xc]
mov r14, r8
mov r15, rdx
mov rbx, rcx
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x18013e985
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.180132290
sub rsp, rax
lea rsi, [rsp + 0x20]
cmp r14, rdi
ja 0x18013e9af
mov rcx, rsi
call fcn.180150e10
mov r8, rdi
lea rcx, [rsi + r14]
sub r8, r14
jmp 0x18013e9d1
call qword [rcx + reloc.WS2_32.dll_recv]
mov r8, r14
mov rdx, r15
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, rsi
mov rcx, rbx
call qword [rbx + 0x20]
mov r8, rdi
lea rcx, [rsi + r13]
sub r8, r13
xor edx, edx
call fcn.1801530a0
mov rcx, rdi
mov rax, rsi
test rdi, rdi
je 0x18013e9f0
xor byte [rax], 0x36
lea rax, [rax + 1]
sub rcx, 1
jne 0x18013e9e3
mov rcx, rbx
call qword [rbx + reloc.WS2_32.dll_recv]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r8, qword [rbp + 0x60]
mov rdx, r12
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, qword [rbp + 0x68]
test rdx, rdx
je 0x18013ea22
mov r8, qword [rbp + 0x70]
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r14, qword [rbp + 0x78]
mov rcx, rbx
mov rdx, r14
call qword [rbx + 0x20]
mov rcx, rdi
mov rax, rsi
test rdi, rdi
je 0x18013ea4d
nop word [rax + rax]
xor byte [rax], 0x6a
lea rax, [rax + 1]
sub rcx, 1
jne 0x18013ea40
mov rcx, rbx
call qword [rbx + reloc.WS2_32.dll_recv]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov r8, r13
mov rdx, r14
mov rcx, rbx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rdx, r14
mov rcx, rbx
call qword [rbx + 0x20]
movzx edx, word [rbx + 0xe]
mov rcx, rsi
call fcn.180136c80
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.180131f30
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18013eb30
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rsi
push r12
push r15
sub rsp, 0x108
mov rax, qword [0x1801f5f20]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r12, qword [rsp + 0x160]
mov r15, r8
mov qword [rsp + 0x48], r9
mov rbp, rdx
mov rsi, rcx
test rcx, rcx
je 0x18013edb5
test rdx, rdx
je 0x18013edb5
test r9, r9
je 0x18013edb5
test r12, r12
je 0x18013edb5
mov qword [r11 - 0x28], rbx
movzx ebx, word [rcx + 0xc]
mov ecx, 0xffffffff
mov eax, ebx
mov qword [r11 - 0x40], r14
mov r14, qword [rsp + 0x168]
imul rax, rcx
cmp r14, rax
jbe 0x18013ebe3
mov eax, 0x450a
mov rbx, qword [rsp + 0x100]
mov r14, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.180131f30
add rsp, 0x108
pop r15
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0xf0], r13
mov r13d, 1
test r14, r14
je 0x18013ed85
mov qword [rsp + 0xf8], rdi
nop dword [rax]
nop word [rax + rax]
mov rax, r13
mov byte [rsp + 0x43], r13b
shr rax, 0x18
mov r8, r15
mov byte [rsp + 0x40], al
mov rdx, rbp
mov rax, r13
mov rcx, rsi
shr rax, 0x10
mov byte [rsp + 0x41], al
mov rax, r13
shr rax, 8
inc r13
mov byte [rsp + 0x42], al
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], 4
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x20], rax
call fcn.18013e930
mov r8, rbx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.180150e10
mov rax, qword [rsp + 0x158]
cmp rax, 1
jbe 0x18013ed4e
lea rdi, [rax - 1]
xor edx, edx
nop
lea rax, [rsp + 0x90]
mov r8, r15
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x90]
mov qword [rsp + 0x30], rdx
mov rcx, rsi
mov qword [rsp + 0x28], rdx
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call fcn.18013e930
xor edx, edx
mov eax, edx
test rbx, rbx
je 0x18013ed44
cmp rbx, 0x20
jb 0x18013ed2b
mov rcx, rbx
and rcx, 0xffffffffffffffe0
nop dword [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x50]
movdqu xmm1, xmmword [rsp + rax + 0x90]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x50], xmm1
movdqu xmm0, xmmword [rsp + rax + 0x60]
movdqu xmm1, xmmword [rsp + rax + 0xa0]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x60], xmm1
add rax, 0x20
cmp rax, rcx
jb 0x18013ecf0
cmp rax, rbx
jae 0x18013ed44
movzx ecx, byte [rsp + rax + 0x90]
xor byte [rsp + rax + 0x50], cl
inc rax
cmp rax, rbx
jb 0x18013ed30
sub rdi, 1
jne 0x18013eca0
lea rdx, [rsp + 0x50]
mov rcx, r12
cmp r14, rbx
jb 0x18013ed75
mov r8, rbx
call fcn.180150e10
add r12, rbx
sub r14, rbx
je 0x18013ed7d
mov r9, qword [rsp + 0x48]
jmp 0x18013ec10
mov r8, r14
call fcn.180150e10
mov rdi, qword [rsp + 0xf8]
mov edx, 0x40
lea rcx, [rsp + 0x50]
call fcn.180136c80
mov edx, 0x40
lea rcx, [rsp + 0x90]
call fcn.180136c80
mov r13, qword [rsp + 0xf0]
xor eax, eax
jmp 0x18013ebb5
mov eax, 0x450b
jmp 0x18013ebc5
Function at 0x180141f70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1801f5f20]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r8, r8
je 0x18014203b
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], r14
movzx ecx, byte [rsi + 0x166]
lea r9, [rsp + 0x20]
movzx eax, byte [rsi + 0x167]
lea r8, [rsi + 0x158]
shl cx, 8
mov edx, recv
or cx, ax
inc cx
mov byte [rsi + 0x167], cl
shr cx, 8
mov byte [rsi + 0x166], cl
lea rcx, [rsi + 0x40]
call fcn.18014d030
mov r9b, reloc.WS2_32.dll_recv
cmp rbx, 0x10
jae 0x180141ff6
movzx r9d, bl
test bl, bl
je 0x180142021
lea r8, [rsp + 0x20]
movzx edx, r9b
sub r8, rdi
mov rax, rdi
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180142010
movzx eax, r9b
add rdi, rax
sub rbx, rax
jne 0x180141fa3
mov r14, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.180136c80
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180131f30
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x180142060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1801f5f20]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbp, rcx
lea rbx, [r8*8]
add rcx, 0x130
mov rdi, r9
mov r14, rdx
call fcn.18014ddf0
lea rdx, [rdi*8]
mov byte [rsp + 0x27], bl
mov rax, rbx
mov byte [rsp + 0x2f], dl
shr rax, 0x38
lea rcx, [rbp + 0x130]
mov byte [rsp + 0x20], al
mov rax, rbx
shr rax, 0x30
mov byte [rsp + 0x21], al
mov rax, rbx
shr rax, 0x28
mov byte [rsp + 0x22], al
mov rax, rbx
shr rax, 0x20
mov byte [rsp + 0x23], al
mov rax, rbx
shr rax, 0x18
mov byte [rsp + 0x24], al
mov rax, rbx
shr rax, 0x10
mov byte [rsp + 0x25], al
mov rax, rbx
shr rax, 8
mov ebx, reloc.WS2_32.dll_recv
mov byte [rsp + 0x26], al
mov r8d, ebx
mov rax, rdx
shr rax, 0x38
mov byte [rsp + 0x28], al
mov rax, rdx
shr rax, 0x30
mov byte [rsp + 0x29], al
mov rax, rdx
shr rax, 0x28
mov byte [rsp + 0x2a], al
mov rax, rdx
shr rax, 0x20
mov byte [rsp + 0x2b], al
mov rax, rdx
shr rax, 0x18
mov byte [rsp + 0x2c], al
mov rax, rdx
shr rax, 0x10
mov byte [rsp + 0x2d], al
mov rax, rdx
shr rax, 8
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x2e], al
call fcn.18014de50
lea rax, [rbp + 0x140]
sub rbp, rax
sub r14, rax
nop
movzx ecx, byte [rax + rbp + 0x168]
xor cl, byte [rax]
mov byte [r14 + rax], cl
lea rax, [rax + 1]
sub rbx, 1
jne 0x180142170
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180131f30
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180142340
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov qword [rsp + 0x50], 0
mov r8, rdx
mov rdi, rcx
xor edx, edx
call fcn.1801530a0
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1801423ad
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 2
call fcn.180154c70
mov rcx, rax
lea rdx, [0x18018b2b8]
call fcn.1801406e0
mov ecx, 1
call fcn.180166f40
int3