joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18037afa0
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, r8
mov rdi, rdx
mov r13, rcx
cmp r8, 4
jb 0x18037b0fd
inc rdi
lea rdx, str.0123456789abcdefABCDEF:.
mov rcx, rdi
sub rbx, 2
call fcn.18040e070
cmp rbx, rax
je 0x18037b0aa
cmp byte [rdi + rax], 0x25
lea r14, [rdi + rax]
mov rbx, rax
jne 0x18037b0fd
mov r8d, 2
lea rdx, [0x180524f28]
lea rcx, [r14 + 1]
xor ebp, ebp
lea rsi, [r14 + 1]
call fcn.180416660
test eax, eax
jne 0x18037b034
movzx eax, byte [r14 + 3]
lea rcx, [r14 + 3]
test al, al
je 0x18037b034
cmp al, 0x5d
cmovne rsi, rcx
movzx edx, byte [rsi]
test dl, dl
je 0x18037b0fd
mov rax, rbp
movzx ecx, dl
cmp dl, 0x5d
je 0x18037b066
cmp rax, 0xf
jge 0x18037b066
inc rsi
mov byte [rsp + rax + 0x20], cl
inc ebp
inc rax
movzx ecx, byte [rsi]
movzx edx, cl
test cl, cl
jne 0x18037b045
test ebp, ebp
je 0x18037b0fd
cmp byte [rsi], 0x5d
jne 0x18037b0fd
movsxd rax, ebp
cmp rax, 0x10
jae 0x18037b11e
lea rcx, [rsp + 0x20]
mov byte [rsp + rax + 0x20], 0
call qword [case.0x18033d89c.1]
mov qword [r13 + 0x28], rax
test rax, rax
jne 0x18037b0a4
mov eax, 7
jmp 0x18037b102
mov word [r14], 0x5d
lea r8, [rsp + 0x20]
mov byte [rbx + rdi], 0
mov rdx, rdi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x18037b0fd
mov r9, rbx
lea rdx, [rsp + 0x20]
mov r8, rdi
mov ecx, reloc.WS2_32.dll_socket
call fcn.1803234d2
test rax, rax
je 0x18037b0f5
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], 0
jne 0x18037b0e7
mov byte [rbx + rdi + 1], 0
mov byte [rbx + rdi], 0x5d
xor eax, eax
jmp 0x18037b102
mov eax, reloc.WS2_32.dll_shutdown
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1803fd0a0
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1803fd368
int3
Function at 0x18037bf60
Capabilities:
Resolve dns

Disassembly:
push rdi
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor edi, edi
mov qword [r9], rdi
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x18037c0fe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, qword [rsp + 0x68]
test rsi, rsi
je 0x18037c0de
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rsi + 0x18]
test rax, rax
je 0x18037bfce
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x18037bfc0
inc rbx
jmp 0x18037bfd0
xor ebx, ebx
mov eax, dword [rsi + 4]
cmp eax, 2
jne 0x18037bfdf
mov ebp, reloc.WS2_32.dll_recv
jmp 0x18037bfed
cmp eax, 0x17
jne 0x18037c085
mov ebp, 0x1c
cmp qword [rsi + 0x20], 0
je 0x18037c085
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x18037c085
cmp rax, rbp
jb 0x18037c085
lea rcx, [rbp + 0x30]
add rcx, rbx
call qword [fcn.180404ac0]
mov r14, rax
test rax, rax
je 0x18037c094
mov ecx, dword [rsi]
mov r8, rbp
mov dword [rax], ecx
mov ecx, dword [rsi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [r14 + 0x30]
mov dword [rax + 0x10], ebp
xor eax, eax
mov qword [r14 + 0x18], rax
mov qword [r14 + 0x28], rax
mov qword [r14 + 0x20], rcx
mov rdx, qword [rsi + 0x20]
call fcn.1804365b0
test rbx, rbx
je 0x18037c072
mov rcx, qword [r14 + 0x20]
mov r8, rbx
add rcx, rbp
mov qword [r14 + 0x18], rcx
mov rdx, qword [rsi + 0x18]
call fcn.1804365b0
test rdi, rdi
cmove rdi, r14
test r15, r15
je 0x18037c082
mov qword [r15 + 0x28], r14
mov r15, r14
mov rsi, qword [rsi + 0x28]
test rsi, rsi
jne 0x18037bfb0
jmp 0x18037c09a
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x58]
test rcx, rcx
je 0x18037c0b4
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x18037c0d9
test rdi, rdi
je 0x18037c0d5
nop
mov rbx, qword [rdi + 0x28]
mov rcx, rdi
call qword [fcn.18040eed4]
mov rdi, rbx
test rbx, rbx
jne 0x18037c0c0
xor edi, edi
jmp 0x18037c0ed
test rdi, rdi
jne 0x18037c0ed
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rsi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rdi
add rsp, 0x28
pop r15
pop r13
pop r12
pop rdi
ret
Function at 0x18037c210
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebp, edx
lea r8, [rsp + 0x20]
mov rdx, rcx
mov rsi, rcx
mov r14d, 2
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x18037c2d9
mov rbx, 0xffffffffffffffff
nop dword [rax]
cmp byte [rsi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x18037c260
lea rdx, [rbx + 0x41]
mov ecx, 1
call qword [fcn.18040ea28]
mov rdi, rax
test rax, rax
jne 0x18037c287
jmp 0x18037c377
add rax, 0x30
lea r8, [rbx + 1]
mov rdx, rsi
mov qword [rdi + 0x20], rax
lea rcx, [rax + 0x10]
mov qword [rdi + 0x18], rcx
call fcn.1804365b0
mov rbx, qword [rdi + 0x20]
movzx ecx, bp
mov dword [rdi + 4], r14d
mov dword [rdi + 8], 1
mov dword [rdi + reloc.WS2_32.dll_recv], 0x10
mov eax, dword [rsp + 0x20]
mov dword [rbx + 4], eax
mov word [rbx], r14w
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbx + 2], ax
mov rax, rdi
jmp 0x18037c377
mov r14d, reloc.WS2_32.dll_socket
lea r8, [rsp + 0x28]
mov ecx, r14d
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x18037c375
mov rbx, 0xffffffffffffffff
nop
cmp byte [rsi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x18037c300
lea rdx, [rbx + 0x4d]
mov ecx, 1
call qword [fcn.18040ea28]
mov rdi, rax
test rax, rax
jne 0x18037c324
jmp 0x18037c377
add rax, 0x30
lea r8, [rbx + 1]
mov rdx, rsi
mov qword [rdi + 0x20], rax
lea rcx, [rax + 0x1c]
mov qword [rdi + 0x18], rcx
call fcn.1804365b0
mov rbx, qword [rdi + 0x20]
movzx ecx, bp
mov dword [rdi + 4], r14d
mov dword [rdi + 8], 1
mov dword [rdi + 0x10], 0x1c
movups xmm0, xmmword [rsp + 0x28]
mov word [rbx], r14w
movups xmmword [rbx + 8], xmm0
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbx + 2], ax
mov rax, rdi
jmp 0x18037c377
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1803fd0a0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1803849d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x180
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x50], rcx
mov r15, r8
mov rcx, rdx
mov r12, rdx
xor ebp, ebp
xor ebx, ebx
call fcn.180332d50
mov r13, rax
test rax, rax
jne 0x180384a50
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.18035cdf0
mov r9, rax
lea rdx, str.schannel:_invalid_path_name_for_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.180333640
xor ecx, ecx
mov ebx, 0x4d
call qword [fcn.18040eed4]
jmp 0x180384c08
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
mov rcx, r13
mov qword [rsp + 0x170], r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x180384ac6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.18035cdf0
mov r9, rax
lea rdx, str.schannel:_failed_to_open_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.180333640
xor ecx, ecx
mov ebx, 0x4d
jmp 0x180384bf2
lea rdx, [rsp + 0x48]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x180384b0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.18035cdf0
mov r9, rax
lea rdx, str.schannel:_failed_to_determine_size_of_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.180333640
mov ebx, 0x4d
jmp 0x180384be6
mov qword [rsp + 0x178], rdi
mov rdi, qword [rsp + 0x48]
cmp rdi, 0x100000
jle 0x180384b44
mov r8d, 0x100000
lea rdx, str.schannel:_CA_file_exceeds_max_size_of__u_bytes
mov rcx, r15
call fcn.180333640
mov ebx, 0x4d
jmp 0x180384bde
lea rcx, [rdi + 1]
call qword [fcn.180404ac0]
mov rbp, rax
test rax, rax
jne 0x180384b60
mov ebx, 0x1b
jmp 0x180384bde
mov qword [rsp + 0x1c8], rsi
test rdi, rdi
je 0x180384bb8
nop dword [rax]
mov r8d, edi
mov dword [rsp + 0x40], 0
sub r8d, ebx
mov esi, ebx
lea rdx, [rbx + rbp]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180384c2a
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x180384baf
mov edi, esi
jmp 0x180384bb1
add ebx, eax
mov eax, ebx
cmp rax, rdi
jb 0x180384b70
mov rcx, qword [rsp + 0x50]
mov r9, r12
mov r8, rdi
mov byte [rdi + rbp], 0
mov rdx, rbp
mov qword [rsp + 0x20], r15
call fcn.180384740
mov ebx, eax
mov rsi, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x178]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbp
call qword [fcn.18040eed4]
mov rcx, r13
call fcn.18040eed4
mov r14, qword [rsp + 0x170]
mov eax, ebx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1803fd0a0
add rsp, 0x180
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.18035cdf0
mov r9, rax
lea rdx, str.schannel:_failed_to_read_from_CA_file__s:__s
mov r8, r12
mov rcx, r15
call fcn.180333640
mov ebx, 0x4d
jmp 0x180384bd6
Function at 0x18038a0e0
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov edx, ebx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x18038a11b
mov edx, 0x2e
mov rcx, rdi
call fcn.1803ff4f0
test rax, rax
je 0x18038a119
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18038e250
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [fcn.180404ac0]
mov rbx, rax
test rax, rax
jne 0x18038e293
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x18038e2e0
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x18038e342
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x18038e300
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x18038e381
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x18052793a]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x18052793b]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x18038e350
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x18038e570
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x18038e5bc
mov eax, 0x1b
jmp 0x18038e68f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x18038e600
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x18038e68f
mov rcx, rbp
call fcn.180333270
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x18038e66b
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18038e67b
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18038e68d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1803fd0a0
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x18038e6b0
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x18038e715
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x18038e6c0
ret
Function at 0x18038e720
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180594240]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x18038e7a3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x18038e7c5
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1803fd0a0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.180333270
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x18038e824
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18038e834
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18038e846
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x18038e7a8
Function at 0x180398d20
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 8
mov r10, rdx
mov r9, rcx
cmp rdx, 0x10
jb 0x180398dc9
mov qword [rsp], rbx
lea r11d, [r8 - 0x7a143589]
lea rbx, [rdx - 0xf]
add rbx, rcx
lea edx, [r8 + 0x24234428]
lea eax, [r8 + 0x61c8864f]
imul ecx, dword [r9], 0x7a143589
sub edx, ecx
imul ecx, dword [r9 + 4], 0x7a143589
rol edx, 0xd
imul edx, edx, 0x9e3779b1
sub r11d, ecx
imul ecx, dword [r9 + 8], 0x7a143589
rol r11d, 0xd
imul r11d, r11d, 0x9e3779b1
sub r8d, ecx
imul ecx, dword [r9 + 0xc], 0x7a143589
rol r8d, 0xd
add r9, 0x10
imul r8d, r8d, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp r9, rbx
jb 0x180398d54
mov rbx, qword [rsp]
rol eax, 0x12
rol r8d, 0xc
add eax, r8d
rol r11d, 7
add eax, r11d
rol edx, 1
add eax, edx
jmp 0x180398dd0
lea eax, [r8 + 0x165667b1]
add eax, r10d
and r10d, 0xf
cmp r10, 4
jb 0x180398e0e
mov r8d, r10d
shr r8, 2
imul rcx, r8, 0xfffffffffffffffc
add r10, rcx
nop dword [rax + rax]
mov ecx, dword [r9]
add r9, 4
imul edx, ecx, 0x3d4d51c3
sub eax, edx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
sub r8, 1
jne 0x180398df0
test r10, r10
je 0x180398e3f
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
imul edx, ecx, 0x165667b1
add eax, edx
rol eax, 0xb
imul eax, eax, 0x9e3779b1
sub r10, 1
jne 0x180398e20
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul edx, ecx, 0xc2b2ae3d
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 8
ret
Function at 0x180398e70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov qword [rsp + 0x28], r15
movabs r15, 0x7a1435883d4d519d
mov r10, rdx
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
cmp rdx, 0x20
jb 0x180398fd6
mov qword [rsp + 0x18], rbx
lea rcx, [rdx - 0x1f]
mov qword [rsp + 0x20], rdi
lea r11, [r8 + rbp]
movabs rdi, 0x60ea27eeadc0b5d6
add rcx, r9
add rdi, r8
movabs rbx, 0x61c8864e7a143579
add rbx, r8
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
imul rax, rbp
add rdi, rax
mov rax, qword [r9 + 8]
imul rax, rbp
rol rdi, 0x1f
add r11, rax
mov rax, qword [r9 + 0x10]
imul rax, rbp
imul rdi, rsi
add r8, rax
rol r11, 0x1f
mov rax, qword [r9 + 0x18]
add r9, 0x20
imul rax, rbp
imul r11, rsi
add rbx, rax
rol r8, 0x1f
rol rbx, 0x1f
imul rbx, rsi
imul r8, rsi
cmp r9, rcx
jb 0x180398ef0
mov rdx, rbx
mov rax, r8
rol rdx, 0x12
mov rcx, rdi
rol rax, 0xc
add rdx, rax
rol rdi, 1
mov rax, r11
imul rcx, rbp
imul r11, rbp
imul rbx, rbp
imul r8, rbp
rol rax, 7
add rdx, rax
rol rcx, 0x1f
add rdx, rdi
rol r11, 0x1f
mov rdi, qword [rsp + 0x20]
movabs rax, 0x85ebca77c2b2ae63
imul rcx, rsi
imul r11, rsi
xor rdx, rcx
rol rbx, 0x1f
imul rdx, rsi
imul rbx, rsi
sub rdx, r15
rol r8, 0x1f
xor rdx, r11
imul rdx, rsi
imul r8, rsi
sub rdx, r15
xor rdx, r8
imul rdx, rsi
sub rdx, r15
xor rdx, rbx
mov rbx, qword [rsp + 0x18]
imul rdx, rsi
add rax, rdx
jmp 0x180398fda
lea rax, [r8 + r14]
add rax, r10
and r10d, 0x1f
cmp r10, 8
jb 0x180399027
mov edx, r10d
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add r10, rcx
nop word [rax + rax]
mov rcx, qword [r9]
add r9, 8
imul rcx, rbp
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
sub rdx, 1
jne 0x180399000
mov r15, qword [rsp + 0x28]
movabs r8, 0x165667b19e3779f9
cmp r10, 4
jb 0x180399059
mov edx, dword [r9]
add r9, 4
imul rdx, rsi
xor rax, rdx
rol rax, 0x17
imul rax, rbp
add rax, r8
sub r10, 4
test r10, r10
je 0x18039907d
nop
movzx ecx, byte [r9]
lea r9, [r9 + 1]
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
sub r10, 1
jne 0x180399060
mov rcx, rax
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x30]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r14
pop rsi
ret
Function at 0x1803990b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rbx, qword [rcx]
mov rdi, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rbx, 0x20
jb 0x180399198
mov r8, qword [rcx + 8]
mov r10, qword [rcx + 0x20]
mov rdx, r8
mov r9, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov rax, r9
rol rax, 0xc
mov r11, rcx
rol r11, 7
add r11, rax
rol r8, 1
mov rax, r10
imul rdx, rbp
imul rcx, rbp
imul r9, rbp
imul r10, rbp
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
add r11, r8
rol rcx, 0x1f
imul rdx, rsi
imul rcx, rsi
rol r9, 0x1f
movabs rax, 0x85ebca77c2b2ae63
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r9, rsi
imul r10, rsi
sub r11, r15
xor r11, rcx
imul r11, rsi
sub r11, r15
xor r11, r9
imul r11, rsi
sub r11, r15
xor r11, r10
imul r11, rsi
add rax, r11
jmp 0x18039919f
mov rax, qword [rcx + 0x18]
add rax, r14
add rax, rbx
lea r8, [rdi + 0x28]
and ebx, 0x1f
cmp rbx, 8
jb 0x1803991e7
mov edx, ebx
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add rbx, rcx
nop dword [rax]
mov rcx, qword [r8]
add r8, 8
imul rcx, rbp
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
sub rdx, 1
jne 0x1803991c0
movabs r9, 0x165667b19e3779f9
cmp rbx, 4
jb 0x180399214
mov edx, dword [r8]
add r8, 4
imul rdx, rsi
xor rax, rdx
rol rax, 0x17
imul rax, rbp
add rax, r9
sub rbx, 4
test rbx, rbx
je 0x18039923d
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
sub rbx, 1
jne 0x180399220
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r9
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret
Function at 0x1803fbea4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1803fbede
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1803fbee3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1803fbf2c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1803fbf2c
dec r8
sub rdx, 1
jne 0x1803fbf12
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret