joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180053be0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x180053c88
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x180053c23
mov rdx, qword [rdi + 8]
mov r8, rdx
mov rdx, qword [rdx]
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x180053ca0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x180053c55
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.1800f2580
mov rcx, rbx
test rbx, rbx
jne 0x180053c40
mov rax, qword [rdi + 8]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
call fcn.180023300
nop
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rbp, r8
mov r15, rdx
mov rdx, rcx
mov qword [rsp + 0x38], rcx
cmp r15, r8
je 0x180053e3d
lea r14, [rcx + 8]
mov r13, qword [r14]
mov r8, qword [rcx + 0x18]
mov qword [rsp + 0x40], r8
mov qword [r11 - 0x48], r14
mov rax, qword [r15 + 8]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x40], rax
mov rsi, r15
mov qword [r11 - 0x38], r15
mov rax, qword [r15 + 8]
mov qword [rsp + 0x30], rax
movzx ecx, byte [r15 + 0x10]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
movzx eax, byte [r15 + 0x11]
xor rcx, rax
imul rcx, r9
mov r12, qword [rdx + 0x30]
and r12, rcx
shl r12, 4
add r12, r8
mov rax, qword [r12]
mov qword [rsp + 0x20], rax
mov rax, qword [r12 + 8]
mov qword [rsp + 0x28], rax
cmp rsi, rax
sete bl
mov rcx, rsi
mov rdi, qword [rsi]
mov rsi, rdi
mov qword [rsp + 0x60], rdi
mov edx, 0x18
call fcn.1800f2580
dec qword [r14 + 8]
test bl, bl
jne 0x180053d94
cmp rdi, rbp
mov rax, qword [rsp + 0x28]
jne 0x180053d50
cmp qword [rsp + 0x20], r15
jne 0x180053e31
mov qword [r12], rdi
jmp 0x180053e31
cmp qword [rsp + 0x20], r15
jne 0x180053da4
mov qword [r12], r13
mov rax, r13
jmp 0x180053da9
mov rax, qword [rsp + 0x30]
mov qword [r12 + 8], rax
cmp rdi, rbp
je 0x180053e31
movzx r12d, byte [rsi + 0x10]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rdx, 0x100000001b3
imul r12, rdx
movzx eax, byte [rsi + 0x11]
xor r12, rax
imul r12, rdx
mov rax, qword [rsp + 0x38]
and r12, qword [rax + 0x30]
shl r12, 4
add r12, qword [rsp + 0x40]
mov r15, qword [r12 + 8]
nop word [rax + rax]
cmp rsi, r15
sete dil
mov rcx, rsi
mov rbx, qword [rsi]
mov rsi, rbx
mov qword [rsp + 0x60], rbx
mov edx, 0x18
call fcn.1800f2580
dec qword [r14 + 8]
test dil, dil
jne 0x180053e5e
cmp rbx, rbp
jne 0x180053e00
mov qword [r12], rbx
mov rax, qword [rsp + 0x48]
mov qword [rax], rsi
mov qword [rsi + 8], rax
mov rax, rbp
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [r12], r13
mov qword [r12 + 8], r13
cmp rbx, rbp
jmp 0x180053db1
Function at 0x180053ca0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x180053c88
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x180053c23
mov rdx, qword [rdi + 8]
mov r8, rdx
mov rdx, qword [rdx]
mov rcx, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp 0x180053ca0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x180053c55
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.1800f2580
mov rcx, rbx
test rbx, rbx
jne 0x180053c40
mov rax, qword [rdi + 8]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
call fcn.180023300
nop
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rbp, r8
mov r15, rdx
mov rdx, rcx
mov qword [rsp + 0x38], rcx
cmp r15, r8
je 0x180053e3d
lea r14, [rcx + 8]
mov r13, qword [r14]
mov r8, qword [rcx + 0x18]
mov qword [rsp + 0x40], r8
mov qword [r11 - 0x48], r14
mov rax, qword [r15 + 8]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x40], rax
mov rsi, r15
mov qword [r11 - 0x38], r15
mov rax, qword [r15 + 8]
mov qword [rsp + 0x30], rax
movzx ecx, byte [r15 + 0x10]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
movzx eax, byte [r15 + 0x11]
xor rcx, rax
imul rcx, r9
mov r12, qword [rdx + 0x30]
and r12, rcx
shl r12, 4
add r12, r8
mov rax, qword [r12]
mov qword [rsp + 0x20], rax
mov rax, qword [r12 + 8]
mov qword [rsp + 0x28], rax
cmp rsi, rax
sete bl
mov rcx, rsi
mov rdi, qword [rsi]
mov rsi, rdi
mov qword [rsp + 0x60], rdi
mov edx, 0x18
call fcn.1800f2580
dec qword [r14 + 8]
test bl, bl
jne 0x180053d94
cmp rdi, rbp
mov rax, qword [rsp + 0x28]
jne 0x180053d50
cmp qword [rsp + 0x20], r15
jne 0x180053e31
mov qword [r12], rdi
jmp 0x180053e31
cmp qword [rsp + 0x20], r15
jne 0x180053da4
mov qword [r12], r13
mov rax, r13
jmp 0x180053da9
mov rax, qword [rsp + 0x30]
mov qword [r12 + 8], rax
cmp rdi, rbp
je 0x180053e31
movzx r12d, byte [rsi + 0x10]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rdx, 0x100000001b3
imul r12, rdx
movzx eax, byte [rsi + 0x11]
xor r12, rax
imul r12, rdx
mov rax, qword [rsp + 0x38]
and r12, qword [rax + 0x30]
shl r12, 4
add r12, qword [rsp + 0x40]
mov r15, qword [r12 + 8]
nop word [rax + rax]
cmp rsi, r15
sete dil
mov rcx, rsi
mov rbx, qword [rsi]
mov rsi, rbx
mov qword [rsp + 0x60], rbx
mov edx, 0x18
call fcn.1800f2580
dec qword [r14 + 8]
test dil, dil
jne 0x180053e5e
cmp rbx, rbp
jne 0x180053e00
mov qword [r12], rbx
mov rax, qword [rsp + 0x48]
mov qword [rax], rsi
mov qword [rsi + 8], rax
mov rax, rbp
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [r12], r13
mov qword [r12 + 8], r13
cmp rbx, rbp
jmp 0x180053db1
Function at 0x180054160
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180054302
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18001fba0
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x20], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1800542c0
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r9d, byte [rcx + 0x10]
xor r9, rbp
imul r9, rdi
movzx eax, byte [rcx + 0x11]
xor r9, rax
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18005423a
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1800542b4
mov rax, qword [r11 + 8]
movzx r8d, word [rcx + 0x10]
cmp r8w, word [rax + 0x10]
jne 0x180054279
mov r8, qword [rax]
cmp r8, rcx
je 0x180054273
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1800542b4
cmp r9, rax
je 0x180054290
nop
mov rax, qword [rax + 8]
cmp r8w, word [rax + 0x10]
je 0x1800542dc
cmp r9, rax
jne 0x180054280
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180054200
mov qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x1800542b4
lea rcx, str.invalid_hash_bucket_count
call fcn.1800f0448
int3

Function at 0x180054320
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x38
mov rbx, qword [0x1801925d0]
lea rdi, [rsp + 0x58]
test rbx, rbx
jne 0x18005436f
mov ecx, 0x1400000
call fcn.1800f25f0
xor edx, edx
mov qword [0x1801925d0], rax
mov r8d, 0xa00000
mov rcx, rax
mov rbx, rax
call fcn.1800f4bb0
lea r8, [0x18016b468]
mov edx, 0xa00000
mov rcx, rbx
call fcn.18010f3f0
mov rbx, qword [0x1801925d0]
call fcn.18002c3b0
mov r9, qword [rsp + 0x50]
lea rdx, [rbx + 0xc]
mov qword [rsp + 0x28], rdi
mov r8d, 0x9ffffa
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call fcn.180107ba0
mov rcx, qword [0x1801925d0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x1800543d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x38
mov rbx, qword [0x1801925c8]
lea rdi, [rsp + 0x58]
test rbx, rbx
jne 0x18005441f
mov ecx, 0xa00000
call fcn.1800f25f0
xor edx, edx
mov qword [0x1801925c8], rax
mov r8d, 0xa00000
mov rcx, rax
mov rbx, rax
call fcn.1800f4bb0
lea r8, str.Debug:
mov edx, 0xa00000
mov rcx, rbx
call fcn.18010f458
mov rbx, qword [0x1801925c8]
call fcn.18002c3b0
mov r9, qword [rsp + 0x50]
lea rdx, [rbx + 6]
mov qword [rsp + 0x28], rdi
mov r8d, 0x9ffffa
mov qword [rsp + 0x20], 0
mov rcx, qword [rax]
call fcn.180107778
mov rcx, qword [0x1801925c8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x180055410
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14d, r9d
mov rsi, r8
mov rbp, rdx
mov r13, rcx
mov qword [rsp + 0x30], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 7
mov word [rcx], bx
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rbx
mov qword [rcx + 0x38], 7
mov word [rcx + 0x20], bx
mov dword [rsp + 0x20], 1
mov qword [rcx + 0x40], rbx
mov dword [rcx + 0x48], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
cmp r14d, 0xffffffff
cmovne r15d, r14d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x50], rbx
lea rdx, [rsp + 0x40]
lea rcx, [0x180055150]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
cmp rdi, r12
je 0x180055594
lea rbx, [rdi + 0x38]
nop dword [rax]
cmp r15d, dword [rbx + 0x10]
je 0x1800554ef
test r14d, r14d
jne 0x180055576
test rbp, rbp
je 0x180055533
test rsi, rsi
je 0x18005555c
cmp qword [rbx - 8], 0
jbe 0x180055576
cmp qword [rbx - 0x28], 0
jbe 0x180055576
lea rcx, [rbx - 0x18]
cmp qword [rbx], 8
jb 0x180055514
mov rcx, qword [rcx]
mov rdx, rbp
call fcn.1800f4704
test rax, rax
je 0x180055576
mov rcx, rdi
cmp qword [rbx - 0x20], 8
jb 0x18005552e
mov rcx, qword [rdi]
mov rdx, rsi
jmp 0x18005556c
test rsi, rsi
je 0x180055576
mov rcx, rdi
cmp qword [rbx - 0x20], 8
jb 0x180055545
mov rcx, qword [rdi]
mov rdx, rsi
call fcn.1800f4704
test rax, rax
jne 0x180055588
test rsi, rsi
jne 0x180055576
test rbp, rbp
je 0x180055576
lea rcx, [rbx - 0x18]
cmp qword [rbx], 8
jb 0x180055569
mov rcx, qword [rcx]
mov rdx, rbp
call fcn.1800f4704
test rax, rax
jne 0x180055588
add rdi, 0x50
add rbx, 0x50
cmp rdi, r12
je 0x180055594
jmp 0x1800554e0
mov rdx, rdi
mov rcx, r13
call fcn.180055650
nop
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x18005561b
mov rdi, qword [rsp + 0x48]
cmp rbx, rdi
je 0x1800555be
mov rcx, rbx
call fcn.180038380
add rbx, 0x50
cmp rbx, rdi
jne 0x1800555a8
mov rbx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
sub rax, rbx
sar rax, 4
movabs rcx, 0xcccccccccccccccd
imul rax, rcx
lea rdx, [rax + rax*4]
shl rdx, 4
mov rax, rbx
cmp rdx, 0x1000
jb 0x180055601
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180055643
mov rcx, rbx
call fcn.1800f2580
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
mov rax, r13
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800f21e0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800f9714
int3
Function at 0x18005a1b0
Capabilities:
Get local ipv4 addresses
List tcp connections and listeners

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ebp, ebp
lea rdx, [rsp + 0x34]
mov dword [rsp + 0x28], ebp
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x20], 5
mov r13d, eax
lea r9d, [rbp + 2]
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
mov ecx, dword [rsp + 0x34]
call fcn.18011a69c
lea r9d, [rbp + 2]
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov dword [rsp + 0x20], 5
lea rdx, [rsp + 0x34]
mov rcx, rax
mov r14, rax
call qword [sym.imp.IPHLPAPI.DLL_GetExtendedTcpTable]
test eax, eax
jne 0x18005a2e4
mov r15d, ebp
mov r12d, ebp
mov edi, ebp
cmp dword [r14], ebp
jbe 0x18005a2d5
mov qword [rsp + 0x70], rsi
nop dword [rax]
mov eax, edi
lea rcx, [rax + rax*2]
cmp dword [r14 + rcx*8 + 0x18], r13d
lea rsi, [r14 + rcx*8]
jne 0x18005a2c4
movzx ecx, word [rsi + 0x14]
inc r12d
mov ebx, dword [rsi + 0x10]
call qword [sym.imp.WS2_32.dll_ntohs]
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_htonl]
lea ecx, [rax - 0xa000000]
cmp ecx, 0xffffff
jbe 0x18005a2af
lea ecx, [rax + 0x53f00000]
cmp ecx, 0xfffff
jbe 0x18005a2af
lea ecx, [rax + 0x3f580000]
cmp ecx, 0xffff
jbe 0x18005a2af
add eax, 0x81000000
cmp eax, 0xffffff
ja 0x18005a2b2
inc r15d
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_inet_ntoa]
movzx ecx, word [rsi + 0x14]
call qword [sym.imp.WS2_32.dll_ntohs]
inc edi
cmp edi, dword [r14]
jb 0x18005a250
mov rsi, qword [rsp + 0x70]
cmp r12d, r15d
jne 0x18005a2e4
mov rcx, r14
call fcn.18010d08c
mov al, 1
jmp 0x18005a3db
mov rcx, r14
call fcn.18010d08c
xor r9d, r9d
mov dword [rsp + 0x34], ebp
lea rax, [rsp + 0x34]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x10]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
cmp eax, 0x6f
jne 0x18005a3d9
mov ecx, dword [rsp + 0x34]
call fcn.18011a69c
mov rdi, rax
xor r8d, r8d
lea rax, [rsp + 0x34]
mov r9, rdi
xor ecx, ecx
mov qword [rsp + 0x20], rax
lea edx, [r8 + 0x10]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
test eax, eax
jne 0x18005a3c4
mov rbx, rdi
test rdi, rdi
je 0x18005a3d1
cmp dword [rbx + 0x68], 1
jne 0x18005a3ab
cmp dword [rbx + 0x64], 6
jne 0x18005a3ab
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x18005a3ab
lea rdx, str.VMware
call fcn.1800f4704
test rax, rax
jne 0x18005a3ab
mov rcx, qword [rbx + 0x40]
lea rdx, str.XyNetTunne
inc ebp
call fcn.1800f4704
test rax, rax
jne 0x18005a2dd
mov rcx, qword [rbx + 0x40]
lea rdx, str.Netease_UU
call fcn.1800f4704
test rax, rax
jne 0x18005a2dd
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x18005a351
mov rcx, rdi
call fcn.18010d08c
cmp ebp, 1
setg al
jmp 0x18005a3db
test rdi, rdi
je 0x18005a3d1
mov rcx, rdi
call fcn.18010d08c
cmp ebp, 1
setg al
jmp 0x18005a3db
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800f21e0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18005f620
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
movsxd r12, edx
mov r15d, r9d
mov rbp, r8
mov r14, rcx
test rcx, rcx
je 0x18005f780
test r8, r8
je 0x18005f780
mov rdi, qword [rsp + 0x60]
test rdi, rdi
je 0x18005f780
mov qword [rsp + 0x40], rbx
mov ecx, 0x100
mov qword [rsp + 0x48], rsi
call fcn.1800f25f0
xor ecx, ecx
mov r10, rax
mov edx, ecx
mov r8, rax
nop
mov byte [r8], dl
lea r8, [r8 + 1]
inc edx
cmp edx, 0x100
jl 0x18005f680
mov r9d, ecx
mov r11d, ecx
mov rbx, r10
nop word [rax + rax]
movzx esi, byte [rbx]
mov eax, r11d
cdq
idiv r15d
movsxd rax, edx
movzx edx, byte [rax + rbp]
add r9d, edx
add r9d, esi
and r9d, 0x800000ff
jge 0x18005f6cd
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rdx, r9d
inc r11d
movzx eax, byte [rdx + r10]
mov byte [rbx], al
inc rbx
mov byte [rdx + r10], sil
cmp r11d, 0x100
jl 0x18005f6a0
mov rsi, qword [rsp + 0x48]
mov r8d, ecx
mov rbx, r12
test r12d, r12d
jle 0x18005f764
sub r14, rdi
nop dword [rax]
inc ecx
and ecx, 0x800000ff
jge 0x18005f714
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd r9, ecx
movzx r11d, byte [r9 + r10]
add r8d, r11d
and r8d, 0x800000ff
jge 0x18005f735
dec r8d
or r8d, 0xffffff00
inc r8d
movsxd rdx, r8d
movzx eax, byte [rdx + r10]
mov byte [r9 + r10], al
mov byte [rdx + r10], r11b
movzx eax, byte [r9 + r10]
add eax, r11d
movzx edx, al
movzx eax, byte [rdx + r10]
xor al, byte [r14 + rdi]
mov byte [rdi], al
inc rdi
sub rbx, 1
jne 0x18005f700
mov rax, qword [rsp + 0x68]
mov rcx, r10
mov dword [rax], r12d
call fcn.1800f2580
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
jmp 0x18005f782
xor eax, eax
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x180060200
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rsp + 0x38], rax
movsxd rsi, ecx
mov dword [rsp + 0x2b], 0x38373635
mov word [rsp + 0x21], 0x4342
mov dword [rsp + 0x24], 0x31304645
lea rcx, [rsi + 1]
mov word [rsp + 0x29], 0x3433
mov byte [rsp + 0x23], 0x44
mov word [rsp + 0x2f], 0x39
mov byte [rsp + 0x28], 0x32
mov byte [rsp + 0x20], 0x41
call fcn.1800f25f0
lea r8, [rsi + 1]
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.1800f4bb0
test rsi, rsi
jle 0x1800602b3
mov qword [rsp + 0x68], rbp
mov rbx, rdi
mov qword [rsp + 0x70], r14
lea rbp, section.vmp3
mov r14d, 0x41
mov ecx, 0x11
call rbp
movsxd rcx, eax
lea rbx, [rbx + 1]
movzx eax, byte [rsp + rcx + 0x20]
test al, al
cmove eax, r14d
mov byte [rbx - 1], al
sub rsi, 1
jne 0x180060287
mov r14, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800f21e0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800602d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180189e48]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
mov ecx, 0x10
mov qword [0x180192720], rax
xorps xmm0, xmm0
mov byte [0x180192728], al
mov r8d, eax
mov dword [rbp - 0x30], ecx
mov byte [rbp - 0x1c], 0xfd
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
movups xmmword [0x180192710], xmm0
movdqa xmm0, xmmword [0x18016c560]
movdqu xmmword [rbp - 0x2c], xmm0
test ecx, ecx
je 0x18006035b
nop dword [rax]
mov ecx, r8d
lea rdx, [rbp - 0x2c]
add rdx, rcx
lea ecx, [r8 - 0x13]
inc r8d
xor byte [rdx], cl
mov ecx, dword [rbp - 0x30]
cmp r8d, ecx
jb 0x180060340
xor edx, edx
mov byte [rbp + rcx - 0x2c], al
mov ecx, 8
mov dword [rbp - 0x3c], 0xc6dbdcdd
mov dword [rbp - 0x40], ecx
mov dword [rbp - 0x38], 0xb1b0b3c9
mov byte [rbp - 0x34], 0xf5
mov word [rbp - 0x33], dx
mov byte [rbp - 0x31], dl
mov ecx, eax
lea rdx, [rbp - 0x3c]
add rdx, rcx
lea ecx, [rax - 0x13]
inc eax
xor byte [rdx], cl
mov ecx, dword [rbp - 0x40]
cmp eax, ecx
jb 0x180060382
mov byte [rbp + rcx - 0x3c], 0
lea rbx, section.vmp3
mov ecx, 0x11
mov byte [rbp - 0x16], 0
call rbx
movsxd rcx, eax
movzx eax, byte [rbp + rcx - 0x2c]
mov ecx, 9
mov byte [rbp - 0x18], al
call rbx
movsxd rcx, eax
movzx eax, byte [rbp + rcx - 0x3c]
mov ecx, 2
mov byte [rbp - 0x17], al
call fcn.180060200
mov ecx, 2
mov r14, rax
call fcn.180060200
mov ecx, 2
mov rsi, rax
call fcn.180060200
mov ecx, 2
mov rdi, rax
call fcn.180060200
mov ecx, 2
mov rbx, rax
call fcn.180060200
mov qword [rsp + 0x38], r14
lea r8, [rbp - 0x18]
mov qword [rsp + 0x30], rsi
lea rdx, str._s_s_s_s_s_s
mov qword [rsp + 0x28], rdi
lea rcx, [0x180192710]
mov r9, rax
mov qword [rsp + 0x20], rbx
call sym.dll.dll_sprintf
lea rax, [0x180192710]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800f21e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret