joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801329e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [rcx + 8]
xor r8d, r8d
mov r13, qword [rdx + 8]
dec r15
mov r12, rdx
mov r14, rcx
mov r9d, 0x811c9dc5
test r13, r13
je 0x180132a37
mov r10, qword [rdx]
nop
movzx eax, byte [r10 + r8]
inc r8
xor eax, r9d
imul r9d, eax, 0x1000193
cmp r8, r13
jb 0x180132a20
mov rcx, qword [rcx]
mov ebx, r9d
and rbx, r15
xor ebp, ebp
nop dword [rax]
nop word [rax + rax]
lea rax, [rbx + rbx*2]
mov rdi, qword [rcx + rax*8]
lea rsi, [rcx + rax*8]
test rdi, rdi
je 0x180132a8b
mov rdx, qword [r14 + 0x18]
test rdx, rdx
je 0x180132a8b
mov r8, qword [rsi + 8]
cmp r8, qword [r14 + 0x20]
jne 0x180132a87
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180132a87
mov eax, 1
jmp 0x180132a92
xor eax, eax
jmp 0x180132a92
cmp rdi, qword [r14 + 0x18]
sete al
test al, al
jne 0x180132aeb
test rdi, rdi
je 0x180132ac4
mov rdx, qword [r12]
test rdx, rdx
je 0x180132ac4
mov r8, qword [rsi + 8]
cmp r8, r13
jne 0x180132ac0
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180132ac0
mov eax, 1
jmp 0x180132acb
xor eax, eax
jmp 0x180132acb
cmp rdi, qword [r12]
sete al
test al, al
jne 0x180132af7
mov rcx, qword [r14]
inc rbx
add rbx, rbp
inc rbp
and rbx, r15
cmp rbp, r15
jbe 0x180132a50
xor eax, eax
jmp 0x180132afa
movups xmm0, xmmword [r12]
movups xmmword [rsi], xmm0
inc qword [r14 + 0x10]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180132b20
Capabilities:
Hash data using fnv

Disassembly:
push rbx
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x180132bd2
mov r10d, dword [rdx]
mov r11d, dword [rbx + 0x18]
mov edx, r10d
mov r8d, r10d
shr edx, 0x18
mov ecx, r10d
shr r8d, 0x10
shr ecx, 8
cmp r10d, r11d
je 0x180132bd2
mov r9, qword [rbx + 8]
mov rbx, qword [rbx]
dec r9
movzx ecx, cl
mov qword [rsp + 0x10], rdi
movabs rdi, 0xcbf29ce484222325
movzx eax, r10b
xor rax, rdi
movabs rdi, 0x100000001b3
imul rax, rdi
xor rax, rcx
movzx ecx, r8b
imul rax, rdi
xor rax, rcx
mov ecx, edx
imul rax, rdi
xor rax, rcx
imul rax, rdi
mov rdi, qword [rsp + 0x10]
and rax, r9
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
cmp edx, r10d
je 0x180132bd6
cmp edx, r11d
je 0x180132bd2
inc rax
add rax, rcx
inc rcx
and rax, r9
cmp rcx, r9
jbe 0x180132bb0
xor eax, eax
pop rbx
ret
mov rax, r8
pop rbx
ret
Function at 0x180132be0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rcx + 8]
mov rsi, rcx
movzx eax, byte [rdx]
mov r11, rdx
movabs rdx, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
dec r10
mov rbx, qword [rsi]
movzx ecx, byte [r11 + 2]
movzx r8d, byte [r11 + 1]
mov edi, dword [rsi + 0x18]
imul rax, rdx
xor rax, r8
imul rax, rdx
xor rax, rcx
movzx ecx, byte [r11 + 3]
imul rax, rdx
xor rax, rcx
imul rax, rdx
and rax, r10
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
mov r9d, dword [r11]
cmp edx, edi
je 0x180132c86
cmp edx, r9d
je 0x180132c8d
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x180132c50
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [r8], r9d
inc qword [rsi + 0x10]
mov rbx, qword [rsp + 8]
mov rax, r8
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180132ca0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov rdi, rcx
je 0x180132da7
mov r12d, dword [rdx + 0x80]
lea rax, [rcx + 0x18]
mov ecx, dword [rax + 0x80]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], ecx
cmp r12d, ecx
jne 0x180132cff
lea r8, [r12*4]
mov rdx, rax
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132da7
mov r15, qword [rdi + 8]
xor ebp, ebp
dec r15
mov eax, 0x811c9dc5
mov ecx, ebp
test r12, r12
je 0x180132d33
nop dword [rax]
nop dword [rax + rax]
xor eax, dword [r13 + rcx*4]
inc rcx
imul eax, eax, 0x1000193
cmp rcx, r12
jb 0x180132d20
mov ebx, eax
mov rax, qword [rdi]
and rbx, r15
mov qword [rsp + 0x78], rax
imul rsi, rbx, 0x88
add rsi, rax
mov r14d, dword [rsi + 0x80]
mov edi, r14d
shl rdi, 2
cmp r14d, r12d
jne 0x180132d6f
mov r8, rdi
mov rdx, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132da2
cmp r14d, dword [rsp + 0x60]
jne 0x180132d8a
mov rdx, qword [rsp + 0x70]
mov r8, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132da7
inc rbx
add rbx, rbp
inc rbp
and rbx, r15
cmp rbp, r15
ja 0x180132da7
mov rax, qword [rsp + 0x78]
jmp 0x180132d40
mov rax, rsi
jmp 0x180132da9
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180132dc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, qword [rcx + 8]
xor ebp, ebp
mov r13d, dword [rdx + 0x80]
dec r12
mov r14, rdx
mov eax, 0x811c9dc5
mov r8d, ebp
test r13, r13
je 0x180132e12
nop dword [rax]
xor eax, dword [rdx + r8*4]
inc r8
imul eax, eax, 0x1000193
cmp r8, r13
jb 0x180132e00
mov edi, eax
mov rax, qword [rcx]
and rdi, r12
add rcx, 0x18
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
nop dword [rax + rax]
imul rbx, rdi, 0x88
add rbx, rax
mov r15d, dword [rbx + 0x80]
mov esi, r15d
shl rsi, 2
cmp r15d, dword [rcx + 0x80]
jne 0x180132e63
mov rdx, rcx
mov r8, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132e97
cmp r15d, r13d
jne 0x180132e7a
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132ef3
inc rdi
add rdi, rbp
inc rbp
and rdi, r12
cmp rbp, r12
ja 0x180132ef8
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
jmp 0x180132e30
movups xmm0, xmmword [r14]
mov rax, qword [rsp + 0x60]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [r14 + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [r14 + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [r14 + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [r14 + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [r14 + 0x60]
movups xmmword [rbx + 0x60], xmm0
movups xmm1, xmmword [r14 + 0x70]
movups xmmword [rbx + 0x70], xmm1
mov ecx, dword [r14 + 0x80]
mov dword [rbx + 0x80], ecx
inc qword [rax + 0x10]
mov rax, rbx
jmp 0x180132efa
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180133530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rdx
mov r14, rcx
je 0x180133675
mov r15, qword [rdx]
test r15, r15
je 0x18013358f
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x18013358f
mov r8, qword [rbx + 8]
cmp r8, qword [rcx + 0x20]
jne 0x18013358b
mov rcx, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18013358b
mov eax, 1
jmp 0x180133596
xor eax, eax
jmp 0x180133596
cmp r15, qword [rcx + 0x18]
sete al
test al, al
jne 0x180133675
mov r12, qword [r14 + 8]
xor ecx, ecx
mov r13, qword [rbx + 8]
dec r12
mov edx, 0x811c9dc5
test r13, r13
je 0x1801335d5
nop word [rax + rax]
movzx eax, byte [r15 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r13
jb 0x1801335c0
mov rcx, qword [r14]
mov ebx, edx
and rbx, r12
xor ebp, ebp
nop
lea rax, [rbx + rbx*2]
mov rdi, qword [rcx + rax*8]
lea rsi, [rcx + rax*8]
test rdi, rdi
je 0x180133619
test r15, r15
je 0x180133619
mov r8, qword [rsi + 8]
cmp r8, r13
jne 0x180133615
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180133615
mov eax, 1
jmp 0x18013361f
xor eax, eax
jmp 0x18013361f
cmp rdi, r15
sete al
test al, al
jne 0x180133694
test rdi, rdi
je 0x180133652
mov rdx, qword [r14 + 0x18]
test rdx, rdx
je 0x180133652
mov r8, qword [rsi + 8]
cmp r8, qword [r14 + 0x20]
jne 0x18013364e
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18013364e
mov eax, 1
jmp 0x180133659
xor eax, eax
jmp 0x180133659
cmp rdi, qword [r14 + 0x18]
sete al
test al, al
jne 0x180133675
mov rcx, qword [r14]
inc rbx
add rbx, rbp
inc rbp
and rbx, r12
cmp rbp, r12
jbe 0x1801335e0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x180133677
Function at 0x1801336a0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x68], rbx
mov rbx, rcx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rsi
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x48], rdi
mov edi, dword [rcx + 0x18]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
lea r15, [rcx + 0x18]
mov r14, r15
test rsi, rsi
jne 0x1801336ee
mov esi, reloc.WS2_32.dll_recv
lea ecx, [rsi + 0x70]
call fcn.180383200
mov r11, rax
xor ecx, ecx
mov ebp, esi
jmp 0x180133720
xor r11d, r11d
xor ebp, ebp
add rsi, rsi
je 0x180133737
lea rcx, [rsi*8]
call fcn.180383200
xor ecx, ecx
mov r11, rax
mov rbp, rsi
test rsi, rsi
je 0x180133737
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14]
mov dword [r11 + rcx*8], eax
xor eax, eax
mov word [r11 + rcx*8 + 4], ax
inc rcx
cmp rcx, rsi
jb 0x180133720
xor esi, esi
cmp qword [rbx + 8], rsi
jbe 0x180133801
mov qword [rsp + 0x40], r12
movabs r14, 0x100000001b3
movabs r12, 0xcbf29ce484222325
nop dword [rax]
mov rax, qword [rbx]
mov r9d, dword [rax + rsi*8]
mov edx, r9d
mov r8d, r9d
mov ecx, r9d
shr edx, 0x18
shr r8d, 0x10
shr ecx, 8
cmp r9d, dword [r15]
je 0x1801337ef
movzx ecx, cl
lea r10, [rbp - 1]
movzx eax, r9b
xor rax, r12
imul rax, r14
xor rax, rcx
movzx ecx, r8b
imul rax, r14
xor rax, rcx
mov ecx, edx
imul rax, r14
xor rax, rcx
imul rax, r14
and rax, r10
xor ecx, ecx
mov r8d, dword [r11 + rax*8]
lea rdx, [r11 + rax*8]
cmp r8d, edi
je 0x1801337d8
cmp r8d, r9d
je 0x1801337db
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x1801337b1
xor edx, edx
jmp 0x1801337db
mov dword [rdx], r9d
mov rax, qword [rbx]
lea rcx, [rax + rsi*8]
mov eax, dword [rax + rsi*8]
mov dword [rdx], eax
movzx eax, word [rcx + 4]
mov word [rdx + 4], ax
inc rsi
cmp rsi, qword [rbx + 8]
jb 0x180133760
mov r12, qword [rsp + 0x40]
mov rcx, qword [rbx]
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov qword [rbx + 8], rbp
mov rbp, qword [rsp + 0x70]
mov qword [rbx], r11
mov rbx, qword [rsp + 0x68]
test rcx, rcx
je 0x180133837
add rsp, 0x58
jmp fcn.180383270
add rsp, 0x58
ret
Function at 0x18014a750
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rdi, rdx
mov rbx, rcx
mov esi, ebp
cmp qword [rdx + 0x40], rbp
jbe 0x18014a7db
mov qword [rsp + 0x40], r14
movabs r14, 0x8080808080808080
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rdi + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, qword [r8 + rsi*8]
call fcn.180149d90
inc rsi
mov r8, qword [rax]
add r8, qword [rbx + 0x38]
mov rdx, r8
mov qword [rbx + 0x40], rbp
and rdx, r14
mov rax, rdx
mov rcx, rdx
shr rax, 7
xor rdx, r8
sub rcx, rax
or rcx, rdx
mov qword [rbx + 0x38], rcx
cmp rsi, qword [rdi + 0x40]
jb 0x18014a790
mov r14, qword [rsp + 0x40]
mov rdx, qword [rdi + 0x48]
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], 1
mov r9d, 3
mov qword [rsp + 0x28], rbp
mov rcx, rbx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.18014a360
mov rbx, qword [rsp + 0x48]
xor al, al
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x18014df20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov r12, rcx
je 0x18014e002
mov r15d, dword [rdx + 8]
cmp r15d, dword [rcx + 0x20]
jne 0x18014df6f
mov rdx, qword [rcx + 0x18]
mov r8d, r15d
mov rcx, qword [r13]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014e002
mov r14, qword [r12 + 8]
xor esi, esi
dec r14
mov edx, 0x811c9dc5
mov ecx, esi
test r15, r15
je 0x18014dfa5
mov r8, qword [r13]
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r15
jb 0x18014df90
mov edi, edx
and rdi, r14
nop word [rax + rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, r15d
jne 0x18014dfd6
mov rdx, qword [r13]
mov r8d, ebp
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014e021
cmp ebp, dword [r12 + 0x20]
jne 0x18014dff1
mov rdx, qword [r12 + 0x18]
mov r8, rbp
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014e002
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x18014dfb0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbx
jmp 0x18014e004
Function at 0x18014e030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 8]
xor esi, esi
mov r15d, dword [rdx + 8]
dec r14
mov r13, rdx
mov r12, rcx
mov r9d, 0x811c9dc5
mov r8d, esi
test r15, r15
je 0x18014e087
mov r10, qword [rdx]
movzx eax, byte [r10 + r8]
inc r8
xor eax, r9d
imul r9d, eax, 0x1000193
cmp r8, r15
jb 0x18014e070
mov edi, r9d
and rdi, r14
nop dword [rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, dword [r12 + 0x20]
jne 0x18014e0b9
mov rdx, qword [r12 + 0x18]
mov r8d, ebp
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014e101
cmp ebp, r15d
jne 0x18014e0d1
mov rdx, qword [r13]
mov r8, rbp
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014e10e
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x18014e090
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movups xmm0, xmmword [r13]
movups xmmword [rbx], xmm0
inc qword [r12 + 0x10]
mov rax, rbx
jmp 0x18014e0e4
Function at 0x18016ee40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov ebp, edx
mov rdi, r8
movzx r8d, byte [rcx + 4]
mov rsi, r9
movsxd rdx, edx
mov rbx, rcx
add rdx, 2
shl rdx, 4
call fcn.180170bd0
mov rdx, qword [rbx + 8]
lea rcx, [rbx + 8]
sub rdx, rcx
mov r8, rax
movzx ecx, byte [rdx + 0x20]
mov byte [rax], 6
and cl, 3
mov byte [rax + 1], cl
movzx ecx, byte [rbx + 4]
mov byte [rax + 2], cl
mov byte [rax + 3], 0
mov qword [rax + 0x10], rdi
mov byte [rax + 4], bpl
movzx ecx, byte [rsi + 4]
mov byte [rax + 5], cl
mov byte [rax + 6], 0
add rax, 0x18
xor rax, rsi
mov qword [r8 + 0x18], rax
test ebp, ebp
jle 0x18016eecc
lea rax, [r8 + 0x2c]
mov ecx, ebp
xor edx, edx
nop dword [rax]
mov dword [rax], edx
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x18016eec0
mov rbx, qword [rsp + 0x50]
mov rax, r8
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180172a70
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
xor r10d, r10d
mov r9, rdx
mov rbx, rcx
mov r11d, r10d
mov r8d, edx
cmp rdx, 0x20
jb 0x180172afa
add rdx, 0xffffffffffffffec
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff4
add r9, rax
nop word [rax + rax]
add r8d, dword [rbx + 8]
movsd xmm0, qword [rbx]
mov ecx, r8d
ror ecx, 0xe
add rbx, 0xc
movsd qword [rsp], xmm0
add r10d, dword [rsp]
mov rax, qword [rsp]
xor r10d, r8d
sub r10d, ecx
shr rax, 0x20
add r11d, eax
mov ecx, r10d
ror ecx, 0xb
xor r11d, r10d
sub r11d, ecx
xor r8d, r11d
mov eax, r11d
rol eax, 7
sub r8d, eax
sub rdx, 1
jne 0x180172ab0
test r9, r9
je 0x180172b1f
nop
movzx ecx, byte [rbx + r9 - 1]
mov eax, r8d
shl eax, 5
add ecx, eax
mov eax, r8d
shr eax, 2
add ecx, eax
xor r8d, ecx
sub r9, 1
jne 0x180172b00
mov eax, r8d
add rsp, 0x10
pop rbx
ret
Function at 0x1801777e0
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov r8d, dword [rdx + 0xc]
mov r9, rdx
mov r11, rcx
sub r8d, 1
je 0x1801779ad
sub r8d, 1
je 0x18017795f
sub r8d, 1
je 0x1801778e4
sub r8d, 1
je 0x180177850
cmp r8d, 1
jne 0x18017795f
mov rax, qword [rdx]
lea r8, [rcx + 0x20]
movzx ecx, byte [rcx + 4]
add rax, 0x10
xor r8, qword [r8]
mov r11d, 1
shl r11d, cl
dec r11d
sub eax, dword [rax]
cdqe
movsxd rdx, r11d
and rax, rdx
shl rax, 5
add rax, r8
add rsp, 0x18
ret
mov ecx, dword [rdx + 8]
lea r10, [r11 + 0x20]
movsd xmm0, qword [rdx]
xor eax, eax
movsd qword [rsp], xmm0
mov r8d, dword [rsp]
cmp r8d, 0x80000000
mov edx, dword [rsp + 4]
cmove r8d, eax
cmp edx, 0x80000000
cmove edx, eax
cmp ecx, 0x80000000
cmove ecx, eax
xor r10, qword [r10]
mov eax, ecx
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x4f9ffb7
movsxd r9, eax
mov eax, r8d
shr eax, 0x11
xor eax, r8d
imul eax, eax, 0x466f45d
movsxd rcx, eax
mov eax, edx
shr eax, 0x11
xor r9, rcx
movzx ecx, byte [r11 + 4]
xor eax, edx
imul eax, eax, 0x127409f
mov r11d, 1
shl r11d, cl
dec r11d
movsxd rcx, r11d
cdqe
xor rax, r9
and rax, rcx
shl rax, 5
add rax, r10
add rsp, 0x18
ret
movsd xmm0, qword [rdx]
lea r10, [r11 + 0x20]
xor r10, qword [r10]
movsd qword [rsp + 0x28], xmm0
mov rax, qword [rsp + 0x28]
mov rdx, rax
shr rdx, 0x20
btr edx, 0x1f
mov ecx, edx
shr ecx, 0x12
xor ecx, eax
imul r9d, ecx, 0x5bd1e995
movzx ecx, byte [r11 + 4]
mov eax, r9d
shr eax, 0x16
xor eax, edx
imul r8d, eax, 0x5bd1e995
mov eax, 1
shl eax, cl
dec eax
cdqe
mov ecx, r8d
shr ecx, 0x11
xor ecx, r9d
imul edx, ecx, 0x5bd1e995
shr edx, 0x13
xor edx, r8d
imul ecx, edx, 0x5bd1e995
movsxd rdx, ecx
and rax, rdx
shl rax, 5
add rax, r10
add rsp, 0x18
ret
mov ecx, dword [rdx]
lea r9, [r11 + 0x20]
xor r9, qword [r9]
shr ecx, 0x10
xor ecx, dword [rdx]
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
mov eax, 1
imul r8d, ecx, 0xc2b2ae35
movzx ecx, byte [r11 + 4]
shl eax, cl
dec eax
cdqe
mov edx, r8d
shr rdx, 0x10
movsxd rcx, r8d
xor rdx, rcx
and rax, rdx
shl rax, 5
add rax, r9
add rsp, 0x18
ret
lea rdx, [rcx + 0x20]
mov eax, 1
movzx ecx, byte [rcx + 4]
xor rdx, qword [rdx]
shl eax, cl
movsxd rcx, dword [r9]
dec eax
cdqe
and rax, rcx
shl rax, 5
add rax, rdx
add rsp, 0x18
ret
Function at 0x180177ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov edi, r8d
mov r15, rdx
mov r9, rcx
mov ebp, 1
test r8d, r8d
jne 0x180177ce1
mov rax, qword [0x18047b618]
lea rcx, [rdx + 0x20]
xor rax, rcx
mov qword [rcx], rax
xor ecx, ecx
mov r14d, ecx
jmp 0x180177d7c
lea eax, [r8 - 1]
mov ecx, 0xffffffff
cmp eax, 0x100
jb 0x180177cfe
add ecx, 8
shr eax, 8
cmp eax, 0x100
jae 0x180177cf1
lea rdx, [0x18043f7e0]
movzx eax, byte [rax + rdx]
lea r14d, [rcx + 1]
add r14d, eax
cmp r14d, 0x1a
jg 0x180177dab
mov ecx, r14d
mov edi, ebp
shl edi, cl
movabs rax, 0x7ffffffffffffff
movsxd rbx, edi
mov rcx, r9
cmp rbx, rax
ja 0x180177da5
movzx r8d, byte [r15 + 2]
mov rdx, rbx
shl rdx, 5
mov qword [rsp + 0x40], rsi
lea rsi, [r15 + 0x20]
call fcn.180170aa0
xor rax, rsi
mov qword [rsi], rax
test edi, edi
jle 0x180177d77
xor ecx, ecx
mov edx, ecx
nop
mov rax, rsi
lea rdx, [rdx + 0x20]
xor rax, qword [rsi]
mov dword [rax + rdx - 4], ecx
mov dword [rax + rdx - 0x14], ecx
sub rbx, rbp
jne 0x180177d60
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov ecx, r14d
shl bpl, cl
dec bpl
mov byte [r15 + 4], r14b
mov byte [r15 + 5], bpl
mov rbp, qword [rsp + 0x50]
mov dword [r15 + 0xc], edi
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
call fcn.180170960
int3
lea rdx, str.table_overflow
mov rcx, r9
call fcn.18016dfc0
int3

Function at 0x180178d00
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
mov rdx, rcx
mov r8d, r10d
cmp dword [rcx + 8], r10d
jle 0x180178d3a
mov ecx, r10d
nop dword [rax]
nop word [rax + rax]
lea rax, [rdx + 0x10]
inc r8d
xor rax, qword [rdx + 0x10]
lea rcx, [rcx + 0x10]
mov dword [rax + rcx - 4], r10d
cmp r8d, dword [rdx + 8]
jl 0x180178d20
cmp dword [rdx + 0xc], r10d
jg 0x180178d44
mov dword [rdx + 0xc], r10d
lea rax, [rdx + 0x20]
xor rax, qword [rdx + 0x20]
cmp rax, qword [0x18047b618]
je 0x180178d8c
movzx ecx, byte [rdx + 4]
mov eax, 1
shl eax, cl
mov dword [rdx + 0xc], eax
movsxd r9, eax
test eax, eax
jle 0x180178d8c
mov rcx, r10
nop dword [rax]
lea rax, [rdx + 0x20]
xor rax, qword [rdx + 0x20]
lea rcx, [rcx + 0x20]
mov dword [rax + rcx - 0x14], r10d
mov dword [rax + rcx - 4], r10d
sub r9, 1
jne 0x180178d70
mov byte [rdx + 6], 0xff
ret
Function at 0x180181790
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x180476ea8]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor esi, esi
mov dword [rbp - 0x29], esi
call fcn.1803825d4
lea rcx, str.calibri_workspace
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], reloc.WS2_32.dll_recvfrom
lea r8, [rbp - 0x29]
mov edx, eax
lea rcx, [rbp + 7]
call fcn.18017f230
nop
lea rcx, str.localappdata
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x180181800
call fcn.1803825d4
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rbx
lea r8, [rbp - 0x29]
mov edx, eax
lea rcx, [rbp - 0x19]
call fcn.18017f230
mov dword [rbp - 0x29], reloc.WS2_32.dll_ntohs
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.18017f940
mov dword [rbp - 0x29], 0x1f
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x27]
call fcn.18017f4c0
nop
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x180181891
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18018188c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18018188c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18038323c
movdqa xmm0, xmmword [0x18044ba40]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], si
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1801818e5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801818e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801818e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18038323c
movdqa xmm0, xmmword [0x18044ba40]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], si
lea rcx, [rbp + 0x27]
call fcn.180180a30
test al, al
jne 0x18018191e
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rcx, qword [rbp + 0x27]
call fcn.180382abc
shr rax, 0x20
test eax, eax
jne 0x180181986
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x180181961
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18018195c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18018195c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18038323c
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1803831e0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea r8, [rbp + 0x27]
mov edx, eax
lea rcx, str.create_directory
call fcn.1801802e0
int3