joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov rbp, rcx
xor r14d, r14d
test rdx, rdx
jne 0x180007c17
xor al, al
jmp 0x180007dec
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180007c25
mov rdx, qword [rdx]
movabs r9, 0xcbf29ce484222325
mov rcx, r14
test r8, r8
je 0x180007c54
movabs r10, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180007c41
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.18003e7b0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180007ca7
cmp rcx, qword [rbp + 8]
je 0x180007ca7
mov qword [rsp + 0x58], rdi
mov rdx, qword [rcx + 0x38]
cmp rdx, qword [rcx + 0x40]
je 0x180007c8f
mov rbx, r14
mov qword [rdx], rdi
add qword [rcx + 0x38], 8
jmp 0x180007ca2
lea r8, [rsp + 0x58]
add rcx, 0x30
call fcn.18003e350
mov rbx, qword [rsp + 0x58]
jmp 0x180007d93
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.180033e70
mov rsi, qword [rax]
mov ecx, 0x30
call fcn.18006243c
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r14b
mov qword [rax + 0x28], r14
mov qword [rsp + 0x58], rax
mov rdx, qword [rsi + 0x38]
cmp rdx, qword [rsi + 0x40]
je 0x180007d06
mov rbx, r14
mov qword [rdx], rax
add qword [rsi + 0x38], 8
jmp 0x180007d19
lea r8, [rsp + 0x58]
lea rcx, [rsi + 0x30]
call fcn.18003e350
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x180007d74
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180007d58
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180007d53
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180007dff
mov rcx, r8
call fcn.180062350
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov edx, 0x30
mov rcx, rbx
call fcn.180062350
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.180033e70
mov rcx, qword [rax]
mov rax, qword [rcx + 0x38]
mov rbx, qword [rax - 8]
mov qword [rax - 8], rdi
test rbx, rbx
je 0x180007dea
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180007dce
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180007dc9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180007dff
mov rcx, r8
call fcn.180062350
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov edx, 0x30
mov rcx, rbx
call fcn.180062350
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180008030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rax, qword [0x180084080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
mov rbp, qword [0x180098c98]
test rbp, rbp
jne 0x1800080ac
mov rdx, qword [rcx + 0x18]
cmp rdx, 0xf
jbe 0x18000809e
inc rdx
mov rcx, qword [rcx]
cmp rdx, 0x1000
jb 0x180008099
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800080a5
mov rcx, r8
call fcn.180062350
xor eax, eax
jmp 0x1800081e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180023510
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rdx, rax
mov r14, qword [rax + 0x18]
cmp r14, 0xf
jbe 0x1800080d0
mov rdx, qword [rax]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180008103
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800080f0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.18003e7b0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18000815f
cmp rcx, qword [rbp + 8]
je 0x18000815f
lea rbp, [rcx + 0x30]
cmp r14, 0xf
jbe 0x18000819a
mov rcx, qword [rdi]
lea rdx, [r14 + 1]
cmp rdx, 0x1000
jb 0x180008158
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000821d
mov rcx, r8
call fcn.180062350
jmp 0x18000819a
mov rdx, r14
cmp r14, 0xf
jbe 0x180008198
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x180008193
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000821d
mov rcx, r8
call fcn.180062350
xor ebp, ebp
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1800081e3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800081de
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180008224
mov rcx, r8
call fcn.180062350
mov rax, rbp
mov byte [rbx], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180062330
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180008970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180084080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov r8, qword [rcx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x1800089a2
mov rdx, qword [rcx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1800089d3
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800089c0
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.18003e6d0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180008a08
cmp rcx, qword [0x180098cc8]
je 0x180008a08
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.180033be0
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x30]
jmp 0x180008a0a
xor edi, edi
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180008a40
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180008a3b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180008a6e
mov rcx, r8
call fcn.180062350
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180062330
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180018a10
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x180084080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, r8
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], r8
xor ebp, ebp
mov ecx, 0x48
call fcn.18006243c
mov rdi, rax
mov qword [rsp + 0x40], rax
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov ecx, 0x50
call fcn.18006243c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi], rax
mov rcx, qword [rsi]
mov qword [rdi], rcx
mov qword [rsi], rax
mov rcx, qword [rdi + 8]
mov rax, qword [rsi + 8]
mov qword [rdi + 8], rax
mov qword [rsi + 8], rcx
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], rbp
mov rax, qword [r14 + 8]
test rax, rax
je 0x180018aa9
lock inc dword [rax + 8]
mov rax, qword [r14]
mov qword [rdi + 0x10], rax
mov rax, qword [r14 + 8]
mov qword [rdi + 0x18], rax
lea rcx, [rdi + 0x20]
mov rdx, rbx
call fcn.180023510
nop
lea rax, [0x1800139f0]
mov qword [rdi + 0x40], rax
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebp
mov r9, rdi
lea r8, [0x1800478f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180018c05
cmp dword [rsp + 0x38], 0
je 0x180018bf9
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x180018bf9
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180018b76
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x180018b71
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180018bf2
mov rcx, r8
call fcn.180062350
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rbx, qword [r14 + 8]
test rbx, rbx
je 0x180018bbb
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x180018bbb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x180018bbb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + htons]
nop
mov r8, qword [rsi]
mov r8, qword [r8 + 8]
mov rdx, rsi
mov rcx, rsi
call fcn.1800402e0
mov edx, 0x50
mov rcx, qword [rsi]
call fcn.180062350
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180062330
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x18001d990
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x148
mov rax, qword [0x180084080]
xor rax, rsp
mov qword [rsp + 0x130], rax
cmp edx, 1
jne 0x18001da01
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, str.dinput8.dll
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x18001da1e
lea rdx, [0x18006b808]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1803249a0], rax
call fcn.18001ce80
mov eax, 1
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180062330
add rsp, 0x148
ret
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180062330
add rsp, 0x148
ret

Function at 0x18001da40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rcx
lea rax, vtable.VFTHookTemplate_struct_EntryHook_.0
mov qword [rcx], rax
mov rbx, qword [rcx + 8]
test rbx, rbx
je 0x18001db9c
mov rdx, rbx
mov r8, qword [rbx]
mov rax, qword [rbx + 0x30]
cmp qword [rax], r8
jne 0x18001da8d
mov rdx, rax
mov rax, qword [rax + 0x30]
cmp qword [rax], r8
je 0x18001da81
mov rdi, qword [rdx + 8]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18001daaa
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [rdi + 0x4c], 0x7fffffff
jne 0x18001dac6
mov dword [rdi + 0x4c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov rcx, qword [rbx + 0x40]
mov rsi, qword [rbx + 0x30]
mov rax, qword [rcx - 0x50]
cmp qword [rbx], rax
jne 0x18001db16
lea r15, [rcx - 0x20]
lea r9, [rsp + 0x40]
mov edx, 8
mov r8d, 0x40
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18001db16
mfence
mov qword [r15], rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x40]
mov edx, 8
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbp, qword [rbx + 0x40]
mov rax, qword [rsi]
lea r9, [rsp + 0x40]
mov edx, 8
mov r8d, 0x40
cmp qword [rbx], rax
jne 0x18001db4d
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18001db78
mfence
mov qword [rsi + 0x40], rbp
lea rcx, [rsi + 0x40]
jmp 0x18001db63
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18001db78
mfence
mov qword [rsi], rbp
mov rcx, rsi
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x40]
mov edx, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rcx, rbx
call fcn.180008e30
xor edx, edx
mov r8d, 0x8000
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18001dcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, qword [rsp + 0x48]
xor r14d, r14d
mov rbx, qword [rsp + 0x60]
mov r12, r9
mov rcx, qword [rsp + 0x50]
mov r13, r8
mov rbp, qword [rsp + 0x58]
mov r15, rdx
mov qword [rsi], r8
mov qword [rbx], rcx
mov rax, qword [rsi]
cmp rax, r9
je 0x18001de65
cmp rcx, rbp
je 0x18001de65
mov r9d, 1
movzx edx, word [r15]
xor dil, dil
movzx ecx, word [rax]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp r9w, dx
jae 0x18001dd6c
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x18001de8c
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x18001dd83
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x18001dd83
shl eax, 0xa
mov dil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x18001dd96
movzx r8d, al
mov r10d, r14d
mov r11d, r14d
jmp 0x18001dde3
mov r8d, eax
cmp eax, 0x800
jae 0x18001ddb0
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x18001dde3
cmp eax, 0x10000
jae 0x18001ddca
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x18001dde3
shr r8d, 0x12
mov r10d, 3
movzx r11d, dil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, rbp
sub rdx, qword [rbx]
mov ecx, r9d
cmp rdx, rcx
jl 0x18001de65
add qword [rsi], 2
test dil, dil
jne 0x18001de04
cmp r10d, 3
jae 0x18001de10
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jle 0x18001de3e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop
sub ecx, 6
mov edx, eax
shr edx, cl
dec r9d
and dl, 0x3f
or dl, 0x80
mov byte [r8], dl
inc qword [rbx]
mov r8, qword [rbx]
test r9d, r9d
jg 0x18001de20
shr eax, 0xa
mov r9d, 1
test dil, dil
mov ecx, r9d
cmovne ecx, eax
mov word [r15], cx
mov rax, qword [rsi]
cmp rax, r12
je 0x18001de65
cmp qword [rbx], rbp
jne 0x18001dd2d
cmp r13, qword [rsi]
sete r14b
mov eax, r14d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
mov eax, 2
jmp 0x18001de6f
Function at 0x18001e920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180084080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, r8
mov rdi, rdx
mov rbx, qword [rcx + 0x38]
cmp qword [r8 + 8], 0x4000
jb 0x18001ea15
movups xmm0, xmmword [rdx]
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x18001e9a4
movabs r10, 0x100000001b3
mov r8, qword [rsp + 0x40]
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, rdx
jb 0x18001e990
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x48]
call fcn.180041610
mov rax, qword [rax + 8]
test rax, rax
jne 0x18001e9c4
mov rax, qword [rbx + 0x50]
cmp rax, qword [rbx + 0x50]
jne 0x18001e9d1
xor al, al
jmp 0x18001eaa4
mov rax, qword [rax + 0x20]
mov rdi, qword [rax + 8]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x18001ea0e
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18001ea06
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x30], xmm0
xor r9d, r9d
mov r8b, 1
lea rdx, [rsp + 0x30]
mov rcx, qword [rcx + 0x68]
call fcn.1800246c0
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x18001e9e1
mov al, 1
jmp 0x18001eaa4
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8, qword [r8 + 8]
mov rdx, qword [rsi]
lea rcx, [rsp + 0x50]
call fcn.180034950
mov dword [rsp + 0x70], 1
mov byte [rsp + 0x74], 0
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm0
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.180026800
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18001eaa1
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ea9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001ea9c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180062350
movzx eax, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180062330
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret

Function at 0x180021790
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800217c4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800217b0
ret
Function at 0x1800219c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x180084080]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
call fcn.180008ea0
cmp qword [rbx + 0x18], 0xf
jbe 0x180021a0a
mov rsi, qword [rbx]
mov rbp, rsi
mov rdi, rsi
add rbp, qword [rbx + 0x10]
jmp 0x180021a17
mov rdi, rbx
mov rbp, qword [rbx + 0x10]
add rbp, rbx
mov rsi, rbx
cmp rdi, rbp
je 0x180021a34
sub rsi, rdi
nop
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbp
jne 0x180021a20
mov r9, qword [rbx + 0x10]
mov r8, rbx
mov rbp, qword [rbx + 0x18]
cmp rbp, 0xf
jbe 0x180021a48
mov r8, qword [rbx]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r9, r9
je 0x180021a84
movabs r10, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r9
jb 0x180021a70
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [r14 + 8]
je 0x180021aea
mov r14, qword [rax + rcx*8]
mov rsi, r9
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180021ac2
mov rdx, qword [rdx]
mov rcx, rbx
cmp rbp, 0xf
jbe 0x180021ace
mov rcx, qword [rbx]
cmp rsi, rax
jne 0x180021adf
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180021aec
cmp rdi, r14
je 0x180021aea
mov rdi, qword [rdi + 8]
jmp 0x180021ab0
xor edi, edi
test rdi, rdi
setne dil
cmp rbp, 0xf
jbe 0x180021b26
lea rdx, [rbp + 1]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180021b21
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180021b5d
mov rcx, r8
call fcn.180062350
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
movzx eax, dil
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180062330
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180021b70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x180084080]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
call fcn.180008ea0
cmp qword [rdi + 0x18], 0xf
jbe 0x180021bbf
mov rsi, qword [rdi]
mov rbp, rsi
add rbp, qword [rdi + 0x10]
mov rbx, rsi
jmp 0x180021bcc
mov rsi, rdi
mov rbp, qword [rdi + 0x10]
add rbp, rdi
mov rbx, rdi
cmp rbx, rbp
je 0x180021be8
sub rsi, rbx
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rbp
jne 0x180021bd4
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180021bf9
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180021c33
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180021c20
mov r8, rdi
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.18003e7b0
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x180021c5b
cmp rbx, qword [r14 + 8]
je 0x180021c5b
mov rbx, qword [rbx + 0x30]
jmp 0x180021d30
mov rbx, qword [r14 + 0x48]
sub rbx, qword [r14 + 0x40]
sar rbx, 6
mov r8, rdi
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.180036780
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movdqa xmm6, xmmword [0x1800739b0]
movdqu xmmword [rsp + 0x38], xmm6
mov byte [rsp + 0x28], 0
mov rsi, qword [r14 + 0x48]
cmp rsi, qword [r14 + 0x50]
je 0x180021cdc
mov rdx, rdi
mov rcx, rsi
call fcn.180023510
mov qword [rsi + 0x30], 0
mov qword [rsi + 0x38], 0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm6
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
add qword [r14 + 0x48], 0x40
jmp 0x180021cf5
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rsi
lea rcx, [r14 + 0x40]
call fcn.180041190
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x180021d30
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180021d2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180021d2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180062350
shl rbx, 6
add rbx, qword [r14 + 0x40]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x180021d6e
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x180021d69
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180021dac
mov rcx, r8
call fcn.180062350
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rax, [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180062330
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
movaps xmm6, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1800224f0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x180022511
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18002253e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180022540
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180022599
test ecx, ecx
jle 0x180022579
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180022599
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180022599
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret