joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800164f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x120], rax
or esi, 0xffffffff
test ecx, ecx
lea rcx, [rsp + 0x20]
mov ebx, esi
je 0x180016629
lea rdx, str.c63w
call fcn.1800160a0
xor edi, edi
test eax, eax
jne 0x18001658a
lea r8d, [rsi + 0x21]
lea rdx, [0x180086600]
lea rcx, [rsp + 0x20]
call fcn.180015800
test eax, eax
jne 0x18001658a
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
call fcn.180015c60
test eax, eax
jne 0x18001658a
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
call fcn.180015c60
test eax, eax
cmove ebx, edi
lea rcx, [rsp + 0x20]
call fcn.180016130
test eax, eax
cmovne ebx, esi
test ebx, ebx
jne 0x180016700
mov r10, rdi
lea r9, [0x180000000]
nop dword [rax + rax]
movzx eax, byte [rsp + r10 + 0xa3]
movzx r8d, byte [r10 + r9 + 0x86623]
movzx ecx, byte [r10 + r9 + 0x86622]
movzx edx, byte [r10 + r9 + 0x86620]
xor r8d, eax
movzx eax, byte [rsp + r10 + 0xa2]
xor ecx, eax
movzx eax, byte [rsp + r10 + 0xa1]
add r10, 4
or r8d, ecx
movzx ecx, byte [r10 + r9 + 0x8661d]
xor ecx, eax
or r8d, ecx
movzx ecx, byte [rsp + r10 + 0x9c]
xor edx, ecx
or r8d, edx
or edi, r8d
cmp r10, 0x80
jl 0x1800165b0
test edi, edi
je 0x180016700
mov eax, esi
jmp 0x180016702
lea rdx, [0x1800866a0]
call fcn.1800160a0
xor edi, edi
test eax, eax
jne 0x180016674
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
call fcn.180015c60
test eax, eax
jne 0x180016674
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x20]
mov r8d, pe_nt_image_headers64
call fcn.180015c60
test eax, eax
cmove ebx, edi
lea rcx, [rsp + 0x20]
call fcn.180016130
test eax, eax
cmovne ebx, esi
test ebx, ebx
jne 0x180016700
mov r10, rdi
lea r9, [0x180000000]
movzx eax, byte [rsp + r10 + 0xa3]
movzx r8d, byte [r10 + r9 + 0x866d3]
movzx ecx, byte [r10 + r9 + 0x866d2]
movzx edx, byte [r10 + r9 + 0x866d0]
xor r8d, eax
movzx eax, byte [rsp + r10 + 0xa2]
xor ecx, eax
movzx eax, byte [rsp + r10 + 0xa1]
add r10, 4
or r8d, ecx
movzx ecx, byte [r10 + r9 + 0x866cd]
xor ecx, eax
or r8d, ecx
movzx ecx, byte [rsp + r10 + 0x9c]
xor edx, ecx
or r8d, edx
or edi, r8d
cmp r10, 0x80
jl 0x180016691
test edi, edi
cmovne ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.18002cf50
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180019ac0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov r8d, dword [rcx + 4]
mov rbx, rcx
lea rsi, [rcx + 0xc]
mov ecx, dword [rcx]
mov rbp, rdx
lea eax, [rcx + r8]
mov dword [rbx + 4], eax
cmp eax, r8d
jae 0x180019af9
inc dword [rbx + 8]
mov byte [rcx + rsi], pe_nt_image_headers64
inc dword [rbx]
mov ecx, dword [rbx]
xor r12d, r12d
mov edi, reloc.WS2_32.dll_recv
cmp ecx, 0x38
jbe 0x180019b5e
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rsi
call fcn.180030f50
mov dword [rbx], 0x40
mov rdx, rsi
mov r8d, edi
nop dword [rax]
mov eax, dword [rdx]
add rdx, 4
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
dec r8
mov dword [rdx - 4], ecx
jne 0x180019b30
mov rcx, rbx
call fcn.180018840
mov dword [rbx], r12d
mov ecx, dword [rbx]
mov r8d, gethostname
xor edx, edx
sub r8d, ecx
add rcx, rsi
call fcn.180030f50
mov r11d, dword [rbx + 4]
mov eax, dword [rbx + 8]
mov ecx, r11d
mov rdx, rsi
shr ecx, 0x1d
lea ecx, [rcx + rax*8]
lea eax, [r11*8]
mov dword [rbx + 4], eax
mov dword [rbx + 8], ecx
mov eax, dword [rdx]
add rdx, 4
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
dec rdi
mov dword [rdx - 4], ecx
jne 0x180019b94
mov eax, dword [rbx + 8]
mov rcx, rbx
mov dword [rsi + 0x38], eax
mov eax, dword [rbx + 4]
mov dword [rsi + 0x3c], eax
call fcn.180018840
mov eax, dword [rbx + 0x4c]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x50]
mov dword [rbx + 0x4c], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x54]
mov dword [rbx + 0x50], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x58]
mov dword [rbx + 0x54], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x5c]
mov dword [rbx + 0x58], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x5c], ecx
mov rax, qword [rbx + 0x4c]
mov qword [rbp], rax
mov rax, qword [rbx + 0x54]
mov qword [rbp + 8], rax
mov eax, dword [rbx + 0x5c]
mov dword [rbp + 0x10], eax
mov rbp, qword [rsp + 0x38]
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov dword [rbx + 0x5c], 0xc3d2e1f0
mov qword [rbx], r12
mov dword [rbx + 8], r12d
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop r12
ret
Function at 0x18001a470
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.18001a350
test eax, eax
jne 0x18001a5c1
mov eax, dword [rbx]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 4]
mov dword [rbx], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 8]
mov dword [rbx + 4], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0xc]
mov dword [rbx + 8], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x10]
mov dword [rbx + 0xc], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x14]
mov dword [rbx + 0x10], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x18]
mov dword [rbx + 0x14], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov eax, dword [rbx + 0x1c]
mov dword [rbx + 0x18], ecx
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov dword [rbx + 0x1c], ecx
mov rax, qword [rbx]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
mov qword [rdi + 0x18], rax
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
xor eax, eax
mov qword [rbx + 0x60], rax
mov dword [rbx + 0x68], eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18001a5d0
Capabilities:
Hash data using sha512

Disassembly:
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x18], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x20], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x28], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x30], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x38], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x40], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x48], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x50], rax
xor eax, eax
mov dword [rcx], eax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
ret
Function at 0x18001b4a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
mov r13, rdx
mov rsi, rcx
lea r12, [rcx + 0x58]
test r8d, r8d
je 0x18001b5ac
movabs r15, 0xff00ff00ff00ff
nop dword [rax]
mov ecx, dword [rsi]
mov edi, pe_nt_image_headers64
mov rdx, r13
sub edi, dword [rsi]
cmp ebp, edi
cmovb edi, ebp
add rcx, r12
mov r8d, edi
mov ebx, edi
call fcn.18002d8c0
add dword [rsi], edi
add r13, rbx
sub ebp, edi
cmp dword [rsi], 0x80
jne 0x18001b5a4
mov r8, r12
mov r9d, reloc.WS2_32.dll_recv
movabs r14, 0xffff0000ffff
nop word [rax + rax]
mov rcx, qword [r8]
add r8, 8
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r15
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shl rdx, 0x10
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
and rcx, r14
xor rcx, rdx
rol rcx, 0x20
dec r9
mov qword [r8 - 8], rcx
jne 0x18001b530
mov rcx, rsi
xor r14d, r14d
call fcn.18001a650
test eax, eax
jne 0x18001b5ae
mov rcx, qword [rsi + 8]
lea rax, [rcx + 0x80]
mov qword [rsi + 8], rax
cmp rax, rcx
jae 0x18001b5a1
inc qword [rsi + 0x10]
mov dword [rsi], r14d
test ebp, ebp
jne 0x18001b4e0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18001b990
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.18001b5d0
test eax, eax
jne 0x18001ba68
mov rax, qword [rbx + 0x18]
mov qword [rdi], rax
mov rax, qword [rbx + 0x20]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x28]
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x30]
mov qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x38]
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x40]
mov qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x48]
mov qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x50]
mov qword [rdi + 0x38], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rbx + 0x18], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rbx + 0x20], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbx + 0x28], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx + 0x30], rax
movabs rax, 0x510e527fade682d1
mov qword [rbx + 0x38], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x40], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x48], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0x50], rax
xor eax, eax
mov dword [rbx], eax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800205e0
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
push r13
sub rsp, 0xa0
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov r13, rdx
mov dword [rsp + 0x6c], 0x67452301
mov dword [rsp + 0x70], 0xefcdab89
mov dword [rsp + 0x74], 0x98badcfe
mov dword [rsp + 0x78], 0x10325476
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
test ecx, ecx
jle 0x1800206ed
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov r12d, ecx
nop dword [rax + rax]
mov esi, 0x40
mov rbp, r13
nop dword [rax + rax]
mov edi, 0x40
lea rcx, [rsp + rax + 0x2c]
mov rdx, rbp
sub edi, eax
cmp esi, edi
cmovb edi, esi
mov r8d, edi
mov ebx, edi
call fcn.18002d8c0
mov eax, dword [rsp + 0x20]
add rbp, rbx
add eax, edi
sub esi, edi
mov dword [rsp + 0x20], eax
cmp eax, 0x40
jne 0x1800206bc
lea rcx, [rsp + 0x20]
call fcn.180013eb0
mov r11d, dword [rsp + 0x24]
mov eax, r11d
add r11d, 0x40
mov dword [rsp + 0x24], r11d
cmp r11d, eax
jae 0x1800206b6
inc dword [rsp + 0x28]
xor eax, eax
mov dword [rsp + 0x20], eax
test esi, esi
jne 0x180020660
dec r12
jne 0x180020650
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0xa0
pop r13
ret

Function at 0x180020710
Capabilities:
Hash data using sha1

Disassembly:
push rdi
sub rsp, 0x90
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov rdi, rdx
mov dword [rsp + 0x6c], 0x67452301
mov dword [rsp + 0x70], 0xefcdab89
mov dword [rsp + 0x74], 0x98badcfe
mov dword [rsp + 0x78], 0x10325476
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x7c], 0xc3d2e1f0
test ecx, ecx
jle 0x180020790
mov qword [rsp + 0xa0], rbx
mov ebx, ecx
nop
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov rdx, rdi
call fcn.1800199e0
dec rbx
jne 0x180020770
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x90
pop rdi
ret

Function at 0x1800207b0
Capabilities:
Hash data using sha256

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xa0
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov dword [rsp + 0x3c], 0x5be0cd19
mov qword [r11 - 0x28], rax
mov dword [r11 - 0x20], eax
mov rdi, rdx
test ecx, ecx
jle 0x180020850
mov qword [r11 + 8], rbx
mov ebx, ecx
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov rdx, rdi
call fcn.18001a260
dec rbx
jne 0x180020830
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0xa0
pop rdi
ret
Function at 0x180020870
Capabilities:
Hash data using sha512

Disassembly:
push rdi
sub rsp, 0x110
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x100], rax
movabs rax, 0x6a09e667f3bcc908
mov rdi, rdx
mov qword [rsp + 0x38], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x40], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x48], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x50], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x58], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x60], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x68], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x70], rax
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
test ecx, ecx
jle 0x180020950
mov qword [rsp + 0x120], rbx
mov ebx, ecx
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov r8d, 0x40
mov rdx, rdi
call fcn.18001b4a0
dec rbx
jne 0x180020930
mov rbx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x110
pop rdi
ret

Function at 0x180020970
Capabilities:
Hash data using sha1

Disassembly:
mov r11, rsp
push r13
sub rsp, 0xa0
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
mov r13, rdx
mov dword [rsp + 0x2c], 0x67452301
mov dword [rsp + 0x30], 0xefcdab89
mov dword [rsp + 0x34], 0x98badcfe
mov dword [rsp + 0x38], 0x10325476
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x3c], 0xc3d2e1f0
test ecx, ecx
jle 0x180020a7d
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r12
mov r12d, ecx
mov esi, 0x40
mov rbp, r13
nop dword [rax + rax]
mov edi, 0x40
lea rcx, [rsp + rax + 0x40]
mov rdx, rbp
sub edi, eax
cmp esi, edi
cmovb edi, esi
mov r8d, edi
mov ebx, edi
call fcn.18002d8c0
mov eax, dword [rsp + 0x20]
add rbp, rbx
add eax, edi
sub esi, edi
mov dword [rsp + 0x20], eax
cmp eax, 0x40
jne 0x180020a4c
lea rcx, [rsp + 0x20]
call fcn.180016730
mov r11d, dword [rsp + 0x24]
mov eax, r11d
add r11d, 0x40
mov dword [rsp + 0x24], r11d
cmp r11d, eax
jae 0x180020a46
inc dword [rsp + 0x28]
xor eax, eax
mov dword [rsp + 0x20], eax
test esi, esi
jne 0x1800209f0
dec r12
jne 0x1800209e3
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0xa0
pop r13
ret
Function at 0x180020aa0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x80], rax
movsxd rbp, dword [rsp + 0x100]
movsxd r14, r9d
movsxd r13, r8d
lea eax, [r14 + r13 + 1]
mov r15, rdx
mov rsi, rcx
cmp eax, ebp
jle 0x180020b0e
mov eax, 1
sub ebp, r14d
mov r8, rdx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x108]
lea rdx, [rsp + 0x40]
mov r9d, ebp
mov dword [rsp + 0x20], eax
call qword [rsi + 0x78]
mov eax, 0xfffffecf
jmp 0x180020cdb
mov qword [rsp + 0xa0], rdi
xor edi, edi
lea r10d, [r13 + 1]
mov qword [rsp + 0x98], r12
mov r12, rbp
mov r8d, edi
test r10d, r10d
jle 0x180020b89
mov rcx, rbp
movzx r9d, r13b
sub rcx, r13
lea rdx, [rcx + rdx - 1]
mov ecx, r10d
movzx eax, byte [rdx]
inc rdx
xor eax, r9d
or r8d, eax
dec rcx
jne 0x180020b41
test r8d, r8d
je 0x180020b89
mov eax, 1
sub ebp, r14d
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x108]
mov r8, r15
mov r9d, ebp
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [rsi + 0x78]
mov eax, 0xfffffecf
jmp 0x180020ccb
mov eax, 1
mov qword [rsp + 0xa8], rbx
sub ebp, r14d
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x108]
mov ebx, ebp
sub ebx, r13d
lea rdx, [rsp + 0x40]
mov r8, r15
lea r9d, [rbx - 1]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call qword [rsi + 0x78]
mov r10d, 1
mov r11d, eax
mov dword [rsp + 0x30], eax
mov r8d, r10d
lea eax, [rbp - 0x2a]
cdq
and edx, 0x3f
add eax, edx
mov r9d, eax
and eax, 0x3f
sar r9d, 6
cmp eax, edx
lea eax, [rbx - 0x2b]
mov rbx, qword [rsp + 0xa8]
cmove r8d, edi
cdq
and edx, 0x3f
add eax, edx
mov ecx, eax
and eax, 0x3f
sar ecx, 6
cmp eax, edx
cmove r10d, edi
sub r9d, ecx
sub r9d, r10d
add r9d, r8d
je 0x180020c79
movzx r8d, byte [rsi + 0x28c]
dec r8d
je 0x180020c69
dec r8d
je 0x180020c5c
sub r8d, 2
je 0x180020c4f
sub r8d, 2
je 0x180020c42
dec r8d
jne 0x180020c79
mov rdx, rsi
mov ecx, r9d
call fcn.180020970
jmp 0x180020c74
mov rdx, rsi
mov ecx, r9d
call fcn.180020870
jmp 0x180020c74
mov rdx, rsi
mov ecx, r9d
call fcn.1800207b0
jmp 0x180020c74
mov rdx, rsi
mov ecx, r9d
call fcn.180020710
jmp 0x180020c74
mov rdx, rsi
mov ecx, r9d
call fcn.1800205e0
mov r11d, dword [rsp + 0x30]
mov rdx, rdi
test r14d, r14d
jle 0x180020cc1
sub r12, r13
lea rax, [rsp + 0x40]
sub r12, r14
sub r12, rax
lea r9, [r12 + r15 - 1]
nop word [rax + rax]
lea rax, [rsp + rdx + 0x40]
inc rdx
movzx ecx, byte [r9 + rax]
movzx eax, byte [rax]
xor ecx, eax
or edi, ecx
cmp rdx, r14
jl 0x180020ca0
test edi, edi
jne 0x180020b7f
neg r11d
sbb eax, eax
and eax, 0xfffffecf
mov rdi, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0xb0
pop r15
pop r14
pop r13
pop rsi
pop rbp
ret
Function at 0x180020eb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov rsi, rcx
mov rcx, qword [rsp + 0x100]
movzx eax, byte [rsi + 0x28b]
movzx r12d, byte [rsi + 0x28f]
mov r13, rdx
mov r10d, r9d
mov qword [rsp + 0x30], rcx
mov edx, ebx
mov ebp, ebx
mov r14d, ebx
movsxd r15, r12d
movsxd rdi, r8d
cmp al, 1
jne 0x18002100c
movzx r9d, word [rsi + 0x394]
mov eax, 0x2000
test ax, r9w
je 0x180020f2c
movzx edx, word [rsi + 0x286]
movsxd rax, edx
mov ecx, r8d
mov r14d, 1
sub rcx, rax
mov eax, 0x1000
mov dword [rsp + 0x38], r14d
movzx ebp, byte [rcx + r13 - 1]
test ax, r9w
je 0x180020f7c
sub r8d, edx
mov dword [rsp + 0x28], r10d
mov r9d, r12d
mov dword [rsp + 0x20], r8d
mov rdx, r13
mov rcx, rsi
mov r8d, ebp
call fcn.180020aa0
test eax, eax
je 0x180021079
jmp 0x18002109a
sub r8d, r12d
mov r14d, ebx
lea eax, [r8 - 1]
cmp ebp, eax
jbe 0x180020f92
mov ebp, ebx
mov r14d, 1
sub r8d, ebp
lea rdx, [rsp + 0x40]
mov rcx, rsi
lea r9d, [r8 - 1]
mov r8, r13
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r10d
call qword [rsi + 0x78]
mov r11d, eax
test r12d, r12d
jle 0x180020ff8
mov ecx, ebp
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x40]
sub rdi, rcx
mov r8, r12
sub rdi, r15
sub rdi, rax
lea r9, [rdi + r13 - 1]
nop dword [rax]
movzx ecx, byte [r9 + rdx]
movzx eax, byte [rdx]
inc rdx
xor ecx, eax
or ebx, ecx
dec r8
jne 0x180020fe0
test ebx, ebx
jne 0x180021002
test r11d, r11d
jne 0x180021002
test r14d, r14d
je 0x180021074
mov eax, 0xfffffecf
jmp 0x18002109a
test al, al
jne 0x18002107e
sub r8d, r12d
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r9d
mov r9d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r8, r13
call qword [rsi + 0x78]
mov r11d, eax
test r12d, r12d
jle 0x180021068
lea rax, [rsp + 0x40]
sub rdi, r15
lea rdx, [rsp + 0x40]
sub rdi, rax
mov r8, r12
lea r9, [rdi + r13]
movzx ecx, byte [r9 + rdx]
movzx eax, byte [rdx]
inc rdx
xor ecx, eax
or ebx, ecx
dec r8
jne 0x180021050
test ebx, ebx
jne 0x180021002
test r11d, r11d
je 0x180021079
mov eax, 0xfffffecf
jmp 0x18002109a
mov r14d, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
cmp byte [rsi + 0x28b], 2
jne 0x180021090
movzx eax, word [rsi + 0x288]
jmp 0x180021096
lea eax, [r12 + r14]
add eax, ebp
mov dword [rcx], eax
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18002cf50
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180028f90
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
push r13
push r14
sub rsp, 0x60
mov rax, qword [0x180093030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x10]
xor ebx, ebx
mov rsi, rcx
movsxd r14, dword [rax + 8]
mov edx, ebx
test r14d, r14d
jle 0x180028fe0
nop word [rax + rax]
mov rax, qword [rcx + 0x10]
inc rdx
mov byte [rdx + rax + 0x74], bl
cmp rdx, r14
jl 0x180028fd0
mov r13, qword [rcx + 0x10]
mov r12, qword [rcx + 0x30]
add r13, 0x75
test r12, r12
je 0x180029155
test r13, r13
je 0x180029155
cmp r14d, 0x10000
ja 0x180029155
cmp byte [r12 + 0x18], 1
je 0x18002901d
mov eax, 0xffffff39
jmp 0x18002915a
mov rcx, qword [r12]
mov r8d, r14d
mov rdx, r13
call fcn.180015c60
mov r11d, eax
cmp eax, 3
jne 0x180029102
lea ecx, [rax - 2]
call fcn.1800164f0
test eax, eax
jne 0x180029111
lea r9d, [rax + 1]
lea rcx, [r12 + 8]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0x20], 0xf0000000
mov qword [rsp + 0xa0], r15
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov edi, reloc.WLDAP32.dll_Ordinal_32
test eax, eax
je 0x1800290de
mov rcx, qword [r12 + 8]
lea r8, [rsp + 0x30]
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1800290de
mov rcx, qword [r12 + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [r12]
lea rdx, [rsp + 0x30]
mov r8d, edi
call fcn.180015800
test eax, eax
jne 0x1800290de
mov rcx, qword [r12]
xor r8d, r8d
xor edx, edx
call fcn.180015c60
mov r11d, eax
test eax, eax
jne 0x1800290e4
mov rcx, qword [r12]
mov r8d, r14d
mov rdx, r13
call fcn.180015c60
mov r11d, eax
jmp 0x1800290e4
mov r11d, 2
mov r15, qword [rsp + 0xa0]
lea rax, [rsp + 0x30]
mov byte [rax], bl
inc rax
dec edi
jne 0x1800290f1
mov rdi, qword [rsp + 0x98]
test r11d, r11d
jne 0x18002910b
mov eax, ebx
jmp 0x180029129
cmp r11d, 4
jne 0x18002911e
mov eax, 0xffffff2f
mov byte [r12 + 0x18], 3
jmp 0x180029129
mov eax, 0xffffff39
mov byte [r12 + 0x18], 2
test eax, eax
jne 0x18002915a
test r14d, r14d
jle 0x180029151
nop word [rax + rax]
mov rax, qword [rsi + 0x10]
inc rbx
mov byte [rbx + rax + 0x74], 0
cmp rbx, r14
jl 0x180029140
xor eax, eax
jmp 0x18002915a
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18002cf50
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret