joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002d60
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1800983f0
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [rcx + 0x58]
mov ebx, r9d
and eax, 0x1000200
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
cmp eax, 0x200
je 0x1800984c0
mov r9d, 4
lea rdx, [0x18012e040]
lea r8d, [r9 + 0x18]
call fcn.180098c30
test eax, eax
jne 0x1800984b3
test rdi, rdi
je 0x180098466
lea r8, [rsp + 0x48]
xor edx, edx
mov rcx, rdi
call fcn.180001645
test eax, eax
jne 0x1800984c0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x40], eax
jmp 0x18009846e
mov dword [rsp + 0x40], 0
movups xmm0, xmmword [rbp + 8]
movups xmmword [rsp + 0x30], xmm0
test ebx, ebx
je 0x180098486
cmp ebx, 1
jne 0x1800984c0
lea r8d, [rbx + 0xb]
jmp 0x18009848c
mov r8d, reloc.WS2_32.dll_listen
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x30]
mov edx, 0x29
mov dword [rsp + 0x20], socket
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x1800984bc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.180001f37
jmp 0x1800984c5
xor eax, eax
jmp 0x1800984c5
mov eax, 0xfffff019
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180002752
mov rbx, qword [rsp + 0xa8]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x180002e73
Capabilities:
Hash data using sha512

Disassembly:
jmp 0x1800b65a0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
add rcx, 0x40
xor edx, edx
mov r8d, 0x140
call sub.VCRUNTIME140.dll_memset
movabs rsi, 0x1f83d9abfb41bd6b
movabs rbp, 0x5be0cd19137e2179
mov qword [rdi + 0x30], rsi
movabs rcx, 0x6a09e667f3bcc908
mov qword [rdi + 0x38], rbp
movabs rdx, 0xbb67ae8584caa73b
mov qword [rdi], rcx
movabs r8, 0x3c6ef372fe94f82b
mov qword [rdi + 8], rdx
movabs r9, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x10], r8
movabs r10, 0x510e527fade682d1
mov qword [rdi + 0x18], r9
movabs r11, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x20], r10
mov qword [rdi + 0x28], r11
mov rax, qword [rbx]
xor rax, rcx
mov qword [rdi], rax
mov rax, qword [rbx + 8]
xor rax, rdx
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor rax, r8
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor rax, r9
mov qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor rax, r10
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor rax, r11
mov qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor rax, rsi
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
mov rbx, qword [rsp + 0x30]
xor rax, rbp
mov rbp, qword [rsp + 0x38]
mov qword [rdi + 0x38], rax
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x180002eaf
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1800901d0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
sub dword [rdx + 0x7c], 1
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
jne 0x18009020f
mov eax, dword [rdx + 0x58]
test al, 1
jne 0x18009020f
test al, 0x40
je 0x18009020f
and eax, 0xffffffbf
mov dword [rdx + 0x58], eax
test al, 0x20
je 0x18009020f
mov rax, qword [rdx + 8]
dec dword [rax + 8]
mov rcx, qword [r8 + 0x18]
xor edi, edi
mov rax, qword [r8 + 0x10]
mov qword [rcx], rax
mov rcx, qword [r8 + 0x10]
mov rax, qword [r8 + 0x18]
mov qword [rcx + 8], rax
mov ecx, dword [r8 + 0x40]
test ecx, ecx
js 0x1800902a1
mov rcx, qword [rbx + 0x110]
xor r9d, r9d
mov edx, 0xffff
mov dword [rsp + 0x20], edi
mov r8d, 0x7010
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x180090299
mov qword [rbx + 0xc0], rdi
or dword [rbx + 0x58], 0x19000
mov dword [rbx + 0x100], edi
mov qword [rbx + 0xf0], rdi
mov qword [rbx + 0xf8], 0xffffffffffffffff
mov dword [rbx + 0x88], select
mov qword [rbx + 0x80], rbx
mov qword [rbx + 0x108], rdi
inc dword [rbp + 0xa8]
jmp 0x1800902a8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1800902a6
call fcn.180004205
mov edi, eax
mov ecx, edi
call fcn.180001f37
mov edx, eax
mov rcx, rsi
call qword [rsi + reloc.WS2_32.dll_WSASetLastError]
mov ecx, dword [rbx + 0x78]
mov eax, dword [rbx + 0x58]
dec ecx
mov dword [rbx + 0x78], ecx
test al, 1
je 0x1800902e0
test ecx, ecx
jne 0x1800902e0
test al, 8
jne 0x1800902e0
or eax, 8
mov dword [rbx + 0x58], eax
mov rax, qword [rbp + 0x50]
mov qword [rbx + 0x50], rax
mov qword [rbp + 0x50], rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180002ec8
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x1800b3e40
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, r9
mov rbx, r8
mov rsi, rdx
lea r9, [0x1800eded8]
mov rdi, rcx
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1800027f7
lea r8, [rbx + 0x10]
mov rdx, rsi
lea r9, [rsp + 0x20]
mov rcx, rdi
call fcn.180003972
mov edx, 0x20
lea rcx, [rsp + 0x20]
mov ebx, eax
call fcn.1800015a0
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x180002f1d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18002dc80
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x18002de14
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x18002de14
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x18002dd1b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x18002de3b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x18002dd32
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x18002dd32
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x18002dd45
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x18002dd92
mov r8d, eax
cmp eax, 0x800
jae 0x18002dd5f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x18002dd92
cmp eax, 0x10000
jae 0x18002dd79
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x18002dd92
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x18002de14
add qword [r14], 2
test sil, sil
jne 0x18002ddb3
cmp r10d, 3
jae 0x18002ddbf
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x18002ddf1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x18002ddd0
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x18002dccf
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x18002de22
Function at 0x180002f40
Capabilities:
Write file on windows

Disassembly:
jmp 0x1800a8c90
push rbx
push rbp
sub rsp, 0x58
mov rbx, rcx
mov ecx, dword [rcx + 0x150]
mov rbp, qword [rbx + 0x180]
cmp ecx, 0xffffffff
jne 0x1800a8cc8
mov dword [rbx + 0x14c], 6
mov qword [rbx + 0x88], 0xfffffffffffff00d
add rsp, 0x58
pop rbp
pop rbx
ret
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1800a8d04
lea ecx, [rax + 7]
mov dword [rbx + 0x14c], 6
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
mov r15, qword [rsp + 0x50]
add rsp, 0x58
pop rbp
pop rbx
ret
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
xor edi, edi
mov qword [rsp + 0x88], r14
cmp rbp, 0xffffffffffffffff
je 0x1800a8d35
xorps xmm0, xmm0
lea r14, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x1800a8d38
mov r14, rdi
mov esi, edi
nop word [rax + rax]
cmp rbp, 0xffffffffffffffff
je 0x1800a8d57
mov eax, esi
add rax, rbp
mov dword [rsp + 0x40], eax
shr rax, 0x20
mov dword [rsp + 0x44], eax
mov rax, qword [rbx + 0x178]
lea r9, [rsp + 0x70]
mov ecx, edi
add rcx, rcx
mov qword [rsp + 0x20], r14
mov r8d, dword [rax + rcx*8]
mov rdx, qword [rax + rcx*8 + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
add esi, dword [rsp + 0x70]
inc edi
test eax, eax
je 0x1800a8dbb
cmp edi, dword [rbx + 0x170]
jb 0x1800a8d40
mov eax, esi
mov qword [rbx + 0x88], rax
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x50]
add rsp, 0x58
pop rbp
pop rbx
ret
test esi, esi
jne 0x1800a8d91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rbx + 0x14c], eax
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
jmp 0x1800a8d9a
Function at 0x180003382
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x1800b3f10
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r9
mov rbp, r8
mov r8, qword [rsp + 0xb8]
lea r9, [0x1800edef0]
mov rsi, rdx
mov rdi, rcx
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800027f7
lea rax, [rsp + 0x30]
mov r8, rbp
mov qword [rsp + 0x28], rax
lea r9, [rbx + 0x10]
mov rax, qword [rsp + 0xb0]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.180002d7e
mov edx, 0x20
lea rcx, [rsp + 0x30]
mov ebx, eax
call fcn.1800015a0
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180002752
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800034e0
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x1800ae0f0
sub rsp, 0x478
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov ecx, 0x202
lea rdx, [rsp + 0x2c0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800ae21c
lea r8, [0x18012e070]
xor edx, edx
lea rcx, str.0.0.0.0
call fcn.180003b25
test eax, eax
jne 0x1800ae215
lea r8, [0x18012e040]
xor edx, edx
lea rcx, [0x1800eddd4]
call fcn.180001645
test eax, eax
jne 0x1800ae215
mov qword [rsp + 0x480], rbx
lea ecx, [rax + 2]
mov qword [rsp + 0x470], rdi
xor r8d, r8d
mov edi, 1
mov edx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800ae202
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x1800ae22b
mov eax, dword [0x18012e084]
mov rcx, rbx
test dword [rsp + 0x40], 0x20000
cmove eax, edi
mov dword [0x18012e084], eax
call qword [sym.imp.WS2_32.dll_closesocket]
mov rbx, qword [rsp + 0x480]
mov rdi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180002752
add rsp, 0x478
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
call fcn.1800ad930
test eax, eax
je 0x1800ae240
jmp 0x1800ae1da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
lea rdx, str.WSAStartup
mov ecx, eax
call fcn.180002982
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.getsockopt
call fcn.180002982
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
lea rdx, str.socket
call fcn.180002982
int3
Function at 0x180003972
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x1800b5860
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x1800b59fc
movzx eax, byte [r8]
mov ecx, 8
movups xmm0, xmmword [r9]
mov byte [rbp - 0x29], al
movzx eax, byte [r8 + 1]
movups xmm1, xmmword [r9 + 0x10]
mov byte [rbp - 0x28], al
movzx eax, byte [r8 + 2]
mov byte [rbp - 0x27], al
movzx eax, byte [r8 + 3]
mov byte [rbp - 0x26], al
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x25], al
movzx eax, byte [r8 + 5]
mov byte [rbp - 0x24], al
movzx eax, byte [r8 + 6]
mov byte [rbp - 0x23], al
movzx eax, byte [r8 + 7]
mov byte [rbp - 0x22], al
mov eax, ecx
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm1
nop dword [rax + rax]
cmp rax, 0x10
jae 0x1800b5a1f
mov byte [rbp + rax - 0x29], 0
inc ecx
inc rax
cmp ecx, 0x10
jb 0x1800b58f0
cmp rbx, 0x40
jb 0x1800b59b5
mov qword [rsp + 0xb8], rsi
mov rsi, rbx
shr rsi, 6
imul rax, rsi, 0xffffffffffffffc0
add rbx, rax
nop dword [rax]
lea r9, [0x1800edf30]
mov rcx, rdi
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x29]
call fcn.18000379c
movzx eax, byte [rbp - 0x20]
add rdi, 0x40
movzx ecx, byte [rbp - 0x21]
inc ecx
mov byte [rbp - 0x21], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1f]
mov byte [rbp - 0x20], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1e]
mov byte [rbp - 0x1f], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1d]
mov byte [rbp - 0x1e], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1c]
mov byte [rbp - 0x1d], cl
shr ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1b]
mov byte [rbp - 0x1c], cl
shr ecx, 8
add ecx, eax
mov byte [rbp - 0x1b], cl
shr ecx, 8
add byte [rbp - 0x1a], cl
sub rsi, 1
jne 0x1800b5930
mov rsi, qword [rsp + 0xb8]
test rbx, rbx
je 0x1800b59e0
lea r9, [0x1800edf30]
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 7]
call fcn.18000379c
test ebx, ebx
je 0x1800b59e0
mov r8d, ebx
lea rdx, [rbp + 7]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov edx, 0x40
lea rcx, [rbp + 7]
call fcn.1800015a0
mov edx, 0x20
lea rcx, [rbp - 0x19]
call fcn.1800015a0
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180002752
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800033be
int3
Function at 0x1800039bd
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x18009f580
push rbx
sub rsp, 0x50
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
btr ecx, 8
mov eax, ecx
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], ecx
jne 0x18009f5c8
test cl, 1
jne 0x18009f5c8
test cl, 0x40
je 0x18009f5c8
and eax, 0xffffffbf
mov dword [rbx + 0x58], eax
test al, 0x20
je 0x18009f5c8
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov eax, dword [rbx + 0x58]
and eax, 0x2020000
cmp eax, 0x2020000
jne 0x18009f61a
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x20]
xor eax, eax
lea rdx, [rsp + 0x28]
xorps xmm0, xmm0
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x28], xmm0
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x18009f61a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rbx
ret
mov rcx, qword [rbx + 0x118]
test rcx, rcx
je 0x18009f637
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x118], 0
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rbx
ret

Function at 0x180003a80
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x1800b5170
push rbx
sub rsp, 0x50
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, r8
mov rbx, rcx
mov r8, rdx
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.18000214e
test eax, eax
je 0x1800b51b7
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rbx
ret
lea r9, [0x1800edf08]
mov rcx, rbx
lea r8, [rsp + 0x20]
lea rdx, [0x1800edf18]
call fcn.1800027f7
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rbx
ret

Function at 0x180003ae4
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
jmp 0x1800afd50
sub rsp, 0x28
mov rax, rdx
mov r9, rcx
lea rdx, [rcx + 0x10]
mov rcx, rax
call fcn.1800afab0
movdqu xmm0, xmmword [r9 + 0x10]
lea rax, [r9 + 0x20]
mov edx, reloc.WS2_32.dll_listen
nop word [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rdx, 1
jne 0x1800afd80
aesenclast xmm0, xmmword [r9 + 0xf0]
movdqu xmmword [r9], xmm0
xor eax, eax
add rsp, 0x28
ret

Function at 0x180003ff8
Capabilities:
Delete directory

Disassembly:
jmp 0x1800a7ad0
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x150]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrmdir]
movsxd rdx, eax
mov qword [rbx + 0x88], rdx
cmp rdx, 0xffffffffffffffff
jne 0x1800a7b13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
mov ecx, dword [rax]
mov dword [rbx + 0x14c], ecx
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x1800040ac
Capabilities:
Create directory

Disassembly:
jmp 0x1800a6a40
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x150]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
movsxd rdx, eax
mov qword [rbx + 0x88], rdx
cmp rdx, 0xffffffffffffffff
jne 0x1800a6a83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
mov ecx, dword [rax]
mov dword [rbx + 0x14c], ecx
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x1800040ca
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
jmp 0x1800910c0
sub rsp, 0x28
mov rax, qword [rcx + 0x110]
cmp rax, 0xffffffffffffffff
jne 0x1800910db
mov eax, 0xfffff019
add rsp, 0x28
ret
mov ecx, dword [rcx + 0x118]
test ecx, ecx
jne 0x1800910fa
mov rcx, rax
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x180091103
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
add rsp, 0x28
jmp fcn.180001f37
xor eax, eax
add rsp, 0x28
ret
Function at 0x18000d960
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1800178e0
jmp 0x18000d5e0
jmp 0x18000d960
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [section..data]
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
test eax, eax
je 0x18000d9ba
mov ecx, dword [section..data]
mov eax, dword [section..data]
inc eax
mov dword [section..data], eax
cmp ecx, 1
jne 0x18000d9b0
call fcn.18000db50
mov dword [section..data], 0
jmp 0x18000d9ba
mov eax, dword [section..data]
test eax, eax
jne 0x18000d9b0
lea r10, [0x180123620]
not rbx
test rsi, rsi
je 0x18000d9f0
nop dword [rax]
test dil, 7
je 0x18000d9f0
movzx eax, byte [rdi]
inc rdi
xor rax, rbx
shr rbx, 8
movzx ecx, al
xor rbx, qword [r10 + rcx*8]
sub rsi, 1
jne 0x18000d9d0
cmp rsi, 8
jb 0x18000daa6
mov r9, rsi
shr r9, 3
imul rax, r9, 0xfffffffffffffff8
add rsi, rax
nop dword [rax + rax]
xor rbx, qword [rdi]
add rdi, 8
mov rax, rbx
shr rax, 0x30
movzx edx, al
mov rax, rbx
shr rax, 0x28
movzx ecx, al
mov rax, rbx
shr rax, 0x20
mov r8, qword [r10 + rdx*8 + 0x800]
xor r8, qword [r10 + rcx*8 + 0x1000]
movzx ecx, al
mov rax, rbx
shr rax, 0x18
xor r8, qword [r10 + rcx*8 + 0x1800]
movzx ecx, al
mov rax, rbx
shr rax, 0x10
xor r8, qword [r10 + rcx*8 + 0x2000]
movzx ecx, al
mov rax, rbx
shr rax, 8
xor r8, qword [r10 + rcx*8 + 0x2800]
movzx ecx, al
mov rax, rbx
shr rax, 0x38
xor r8, qword [r10 + rcx*8 + 0x3000]
xor r8, qword [r10 + rax*8]
movzx eax, bl
mov rbx, r8
xor rbx, qword [r10 + rax*8 + 0x3800]
sub r9, 1
jne 0x18000da10
test rsi, rsi
je 0x18000dacb
nop dword [rax + rax]
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
xor rax, rbx
shr rbx, 8
movzx ecx, al
xor rbx, qword [r10 + rcx*8]
sub rsi, 1
jne 0x18000dab0
mov rsi, qword [rsp + 0x38]
not rbx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r10, r8
mov rax, rdx
test r8, r8
je 0x1800178fe
test r9d, r9d
je 0x1800178fe
mov r8d, r9d
mov rdx, r10
mov rcx, rax
jmp 0x1800044df
ret
Function at 0x18000db50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, 0x100
mov r9, rcx
mov edi, r10d
xor r11d, r11d
mov rbx, rcx
movabs rsi, 0xc96c5795d7870f42
nop dword [rax + rax]
movzx eax, r11b
lea rbx, [rbx + 8]
mov rdx, r11
shr rdx, 1
mov rcx, rdx
xor rcx, rsi
and al, 1
cmove rcx, rdx
mov rax, rcx
shr rax, 1
mov rdx, rax
xor rdx, rsi
and cl, 1
cmove rdx, rax
mov rax, rdx
shr rax, 1
mov rcx, rax
xor rcx, rsi
and dl, 1
cmove rcx, rax
mov rax, rcx
shr rax, 1
mov rdx, rax
xor rdx, rsi
and cl, 1
cmove rdx, rax
mov rax, rdx
shr rax, 1
mov rcx, rax
xor rcx, rsi
and dl, 1
cmove rcx, rax
mov rax, rcx
shr rax, 1
mov rdx, rax
xor rdx, rsi
and cl, 1
cmove rdx, rax
mov rax, rdx
shr rax, 1
mov r8, rax
xor r8, rsi
and dl, 1
cmove r8, rax
mov rcx, r8
shr rcx, 1
mov rax, rcx
xor rax, rsi
and r8b, 1
cmove rax, rcx
inc r11
mov qword [rbx - 8], rax
sub rdi, 1
jne 0x18000d790
lea rax, [r9 + 0x1000]
nop dword [rax + rax]
mov rdx, qword [rax - 0x1000]
lea rax, [rax + 8]
movzx ecx, dl
shr rdx, 8
xor rdx, qword [r9 + rcx*8]
movzx ecx, dl
mov qword [rax - 0x808], rdx
shr rdx, 8
xor rdx, qword [r9 + rcx*8]
movzx ecx, dl
mov qword [rax - 8], rdx
shr rdx, 8
xor rdx, qword [r9 + rcx*8]
movzx ecx, dl
mov qword [rax + 0x7f8], rdx
shr rdx, 8
xor rdx, qword [r9 + rcx*8]
movzx ecx, dl
mov qword [rax + 0xff8], rdx
shr rdx, 8
xor rdx, qword [r9 + rcx*8]
movzx ecx, dl
mov qword [rax + 0x17f8], rdx
shr rdx, 8
xor rdx, qword [r9 + rcx*8]
mov qword [rax + 0x1ff8], rdx
movzx ecx, dl
shr rdx, 8
xor rdx, qword [r9 + rcx*8]
mov qword [rax + 0x27f8], rdx
sub r10, 1
jne 0x18000d850
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
lea rcx, [0x180123620]
jmp 0x18000d760
Function at 0x18002dc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18002dc80
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x18002de14
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x18002de14
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x18002dd1b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x18002de3b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x18002dd32
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x18002dd32
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x18002dd45
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x18002dd92
mov r8d, eax
cmp eax, 0x800
jae 0x18002dd5f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x18002dd92
cmp eax, 0x10000
jae 0x18002dd79
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x18002dd92
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x18002de14
add qword [r14], 2
test sil, sil
jne 0x18002ddb3
cmp r10d, 3
jae 0x18002ddbf
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x18002ddf1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x18002ddd0
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x18002dccf
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x18002de22