joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005324
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
lea rbx, [rdx + 0x22]
lea rsi, [rcx + 0xcf90]
mov rdi, rcx
movzx ecx, word [rbx + 0xe]
mov rdx, rsi
add rcx, rbx
call fcn.1800220bc
test eax, eax
jne 0x1800054ef
movzx eax, word [rbx + 0xa]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
add dword [rdi + 0xce88], eax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1800053db
mov edx, dword [rbx + 2]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx edx, word [rbx + 0xc]
mov r8d, dword [rsp + 0x50]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
add rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800054ef
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180005452
mov edx, dword [rbx + 2]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx edx, word [rbx + 0xc]
mov r8d, dword [rsp + 0x50]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
add rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [rdi + 0xd7c0], 0
jmp 0x1800054ef
mov edx, 0x3e8
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800054cb
mov edx, dword [rbx + 2]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
movzx edx, word [rbx + 0xc]
mov r8d, dword [rsp + 0x50]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x50]
add rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
jmp 0x180005440
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0xd7c0], eax
test eax, eax
je 0x1800054ef
lea rcx, str.0x02___d_failed_:0x_x
mov r8d, eax
mov edx, 0x11
call fcn.180002148
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov eax, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1800061bc
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x1800061dd
dec edx
je 0x1800061da
mov r9d, edx
add r9, rcx
mov al, byte [r9 - 1]
xor byte [r9], al
lea r9, [r9 - 1]
dec edx
jne 0x1800061cb
xor byte [rcx], 0xad
ret
Function at 0x1800068ac
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 8], rcx
push rbp
lea rbp, [rax - 0x358]
sub rsp, 0x450
mov rbx, rdx
xor edi, edi
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x30], di
call fcn.18001cca0
mov edx, dword [rbx]
lea r8, [rsp + 0x30]
mov r9d, 0x104
lea eax, [rdx + 1]
mov rcx, 0xffffffff80000003
mov dword [rbx], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1800069c7
lea r8d, [rax + 8]
lea rdx, [rsp + 0x30]
lea rcx, str.S_1_5_21
call fcn.18001ec98
test eax, eax
jne 0x1800068e6
lea rdx, str.Classes
lea rcx, [rsp + 0x30]
call fcn.18001e02c
test rax, rax
jne 0x1800068e6
lea rcx, [rbp + 0x142]
xor edx, edx
mov r8d, 0x206
mov qword [rbp + 0x360], rdi
mov word [rbp + 0x140], di
call fcn.18001cca0
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x140]
mov edx, 0x104
call fcn.18001dfa4
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea rcx, [rbp + 0x140]
mov edx, 0x104
call fcn.18001e904
lea rax, [rbp + 0x360]
lea rdx, [rbp + 0x140]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x360]
test eax, eax
cmovne rcx, rdi
mov rax, rcx
jmp 0x1800069c9
xor eax, eax
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1800069e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x970]
sub rsp, 0xa70
xor edi, edi
mov r14, rcx
lea rcx, [rsp + 0x32]
lea r8d, [rdi + 0x26]
xor edx, edx
mov dword [rbp + 0x9b8], edi
mov word [rsp + 0x30], di
call fcn.18001cca0
lea rcx, [rbp + 0x172]
xor edx, edx
mov r8d, 0x7fe
mov word [rbp + 0x170], di
call fcn.18001cca0
lea r15, str.HTTPS
lea rdx, [rbp + 0x9b8]
call fcn.1800068ac
mov rsi, rax
test rax, rax
je 0x180006c5e
lea rax, [rbp + 0x9a8]
lea rdx, str.ProxyEnable
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x9b0]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x9a8], 4
mov dword [rbp + 0x9b0], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180006c5e
cmp dword [rbp + 0x9b0], edi
je 0x180006c5e
lea rax, [rbp + 0x9a8]
lea rdx, str.ProxyServer
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x170]
xor r8d, r8d
mov rcx, rsi
mov dword [rbp + 0x9a8], 0x400
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x180006c5e
lea r8, [0x180038400]
lea edx, [rbx + 0x14]
lea rcx, [rsp + 0x30]
mov r9, r15
call fcn.18001d8d8
lea edx, [rbx + 0x14]
lea rcx, [rsp + 0x30]
call fcn.18001ec44
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x170]
call fcn.18001e02c
mov rbx, rax
test rax, rax
jne 0x180006b71
lea rdx, [0x180038408]
lea rcx, [rbp + 0x170]
call fcn.18001e02c
test rax, rax
jne 0x180006a42
lea rdx, [0x18003558c]
lea rcx, [rbp + 0x170]
call fcn.18001e02c
test rax, rax
je 0x180006a42
jmp 0x180006bf2
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], di
call fcn.18001cca0
lea rcx, [rsp + 0x30]
call fcn.18001d570
lea rcx, [rsp + 0x60]
lea r8, [rbx + rax*2]
mov ebx, 0x104
mov edx, ebx
call fcn.18001dfa4
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0x170]
mov edx, ebx
call fcn.18001dfa4
lea rcx, [rbp + 0x170]
mov esi, edi
call fcn.18001d570
test eax, eax
jle 0x180006bf2
lea rbx, [rbp + 0x170]
cmp word [rbx], 0x3b
jne 0x180006bdc
mov word [rbx], di
lea rcx, [rbp + 0x170]
inc esi
add rbx, 2
call fcn.18001d570
cmp esi, eax
jl 0x180006bd3
lea rcx, [rbp + 0x170]
mov edi, 1
call fcn.18001d570
cmp rax, 0x28
jbe 0x180006c20
lea rdx, [rbp + 0x170]
lea rcx, str.0x04__IE_proxy__s_too_long
call fcn.180002394
xor eax, eax
jmp 0x180006c60
lea rax, [rbp + 0x170]
lea r8, str._s_s:___s
mov r9, r15
mov qword [rsp + 0x28], rax
mov edx, gethostbyname
mov rcx, r14
mov qword [rsp + 0x20], r15
call fcn.18001d8d8
lea r8, [rbp + 0x170]
lea rcx, str.0x04___s_p__s
mov rdx, r15
call fcn.180002394
mov eax, edi
mov rbx, qword [rsp + 0xaa0]
add rsp, 0xa70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180006c78
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov dword [rax + 0x18], r8d
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
and dword [rax + 0x18], 0
mov rsi, rdx
mov dword [rax + 8], 0x400
jmp 0x180006cd4
lea rax, [rsp + 0x40]
lea rdx, str.AutoConfigURL
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x180006cf8
lea rdx, [rsp + 0x50]
call fcn.1800068ac
mov rdi, rax
test rax, rax
jne 0x180006ca0
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rcx, str.0x03__P__s.
mov rdx, rsi
call fcn.180002394
mov eax, 1
jmp 0x180006ce8
Function at 0x1800075d0
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
and dword [rsp + 0x20], 0
mov rdi, rdx
mov rbx, rcx
add rcx, 0x64
xor edx, edx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx + 0x270], rax
test rax, rax
je 0x18000760e
mov rdx, rdi
mov rcx, rbx
call fcn.1800071ec
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x18000761c
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
test r8d, r8d
jne 0x18000763b
call fcn.18001d570
test rax, rax
jne 0x18000764b
mov rcx, rbx
call fcn.1800069e0
test eax, eax
jne 0x18000764b
xor eax, eax
jmp 0x180007674
and dword [rsp + 0x20], 0
xor r9d, r9d
lea rcx, [rbx + 0x64]
lea edx, [r9 + 3]
mov r8, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
test rax, rax
je 0x180007647
mov rdx, rdi
mov rcx, rbx
call fcn.1800071ec
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180007680
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
test r8d, r8d
jne 0x18000769f
call fcn.18001d570
test rax, rax
jne 0x1800076af
mov rcx, rbx
call fcn.180006d10
test eax, eax
jne 0x1800076af
xor eax, eax
jmp 0x1800076df
and dword [rsp + 0x20], 0
xor r9d, r9d
lea rcx, [rbx + 0x64]
lea edx, [r9 + 3]
mov r8, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx + 0x270], rax
test rax, rax
je 0x1800076ab
mov rdx, rdi
mov rcx, rbx
call fcn.1800071ec
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800076ec
Capabilities:
Initialize winhttp library

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r14
push rbp
lea rbp, [rax - 0x7e8]
sub rsp, 0x8e0
xor r14d, r14d
mov rdi, rdx
mov rbx, rcx
lea edx, [r14 + 1]
add rcx, 0x64
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbx + 0x270], rax
test rax, rax
jne 0x18000773f
xor eax, eax
jmp 0x180007851
xor edx, edx
lea rcx, [rsp + 0x72]
mov word [rsp + 0x70], r14w
lea r8d, [rdx + 0x62]
call fcn.18001cca0
lea rcx, [rbp - 0x1e]
xor edx, edx
mov r8d, 0x7fe
mov word [rbp - 0x20], r14w
call fcn.18001cca0
lea rdx, [rbp - 0x20]
call fcn.180006c78
lea rcx, [rbp - 0x20]
call fcn.18001d570
test rax, rax
je 0x180007738
lea r8, str.https:__
lea rcx, [rsp + 0x70]
mov edx, gethostbyname
call fcn.18001dfa4
lea rcx, [rsp + 0x70]
mov r8, rdi
mov edx, gethostbyname
call fcn.18001e904
mov rcx, qword [rbx + 0x270]
xor eax, eax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x5c], rax
mov dword [rsp + 0x64], eax
lea rax, [rbp - 0x20]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x48], 2
mov qword [rsp + 0x50], rax
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x180007738
cmp dword [rsp + 0x30], 3
jne 0x180007826
mov rcx, qword [rbx + 0x270]
mov r9d, 0x18
lea r8, [rsp + 0x30]
lea edx, [r9 + 0xe]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180007836
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180007846
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rdx, rdi
mov rcx, rbx
call fcn.1800071ec
lea r11, [rsp + 0x8e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r14, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180007ae8
Capabilities:
Initialize winhttp library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xa0
xor esi, esi
mov r15, r8
mov r14, rdx
mov rbp, rcx
cmp dword [rsp + 0xe0], esi
je 0x180007c06
lea r8d, [rsi + 0x62]
lea rcx, [rsp + 0x32]
xor edx, edx
mov word [rsp + 0x30], si
call fcn.18001cca0
lea rbx, [rbp + 0x332]
lea r8d, [rsi + 0x64]
mov rcx, rbx
xor edx, edx
call fcn.18001cca0
lea rdi, [rbp + 0x396]
lea r8d, [rsi + 0x64]
mov rcx, rdi
xor edx, edx
call fcn.18001cca0
lea rax, [rsp + 0x30]
or r9d, 0xffffffff
mov r8, r15
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], gethostname
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [r15 + 0x32]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], gethostname
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [r15 + 0x64]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], gethostname
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.HTTP
lea rcx, [rsp + 0x30]
call fcn.18001e02c
test rax, rax
je 0x180007bd5
xor eax, eax
jmp 0x180007c3d
lea r8, [rsp + 0x30]
mov edx, gethostbyname
mov rcx, rbp
call fcn.18001dfa4
lea rdx, [0x180038818]
mov rcx, rbp
call fcn.18001e02c
lea rcx, str.0x03__P__s
lea rdx, [rax + 4]
call fcn.180002394
xor r9d, r9d
lea rcx, [rbp + 0x64]
mov r8, rbp
lea edx, [r9 + 3]
mov dword [rsp + 0x20], esi
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rbp + 0x270], rax
test rax, rax
je 0x180007bd1
mov rdx, r14
mov rcx, rbp
call fcn.1800071ec
test eax, eax
setne sil
mov eax, esi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180008d10
Capabilities:
Read http header

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x60
xor edi, edi
mov rbx, rcx
lea rcx, [rax - 0x36]
lea r8d, [rdi + 0x26]
xor edx, edx
mov dword [rax + 8], edi
mov word [rax - 0x38], di
call fcn.18001cca0
mov rcx, qword [rbx + 0x290]
lea rax, [rsp + 0x70]
lea edx, [rdi + 0x13]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x180008d6b
xor eax, eax
jmp 0x180008d9d
mov rcx, qword [rbx + 0x290]
xor r8d, r8d
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x30]
lea edx, [r8 + 0x13]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
lea rcx, [rsp + 0x30]
call fcn.18001eec8
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x180008dcc
Capabilities:
Receive http response

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
and dword [rax + 0x18], ebx
mov rbp, rcx
mov rcx, qword [rbp + 0x290]
mov r8d, edi
mov edx, ebx
lea r9, [rsp + 0x40]
sub r8d, ebx
add rdx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x180008e21
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x180008e1d
add ebx, eax
cmp ebx, edi
jb 0x180008dee
mov eax, ebx
jmp 0x180008e37
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.0x02__R_failed_0x_x.
mov edx, eax
call fcn.180002148
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180009110
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, 0x460
mov rbx, rcx
call fcn.18001cca0
xor r8d, r8d
movabs rax, 0x6a09e667f3bcc908
mov qword [rbx], r8
mov qword [rbx + 8], r8
mov qword [rbx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
mov dword [rbx + 0x1d0], r8d
mov qword [rbx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rbx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx + 0x28], rax
movabs rax, 0x510e527fade682d1
mov qword [rbx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0x48], rax
movsxd rax, dword [rbx + 0x1d8]
cmp eax, 0x14
jge 0x1800091e7
mov rcx, rax
add rax, 0xf
lea rdx, [0x180017100]
shl rcx, 5
shl rax, 5
mov qword [rax + rbx], rdx
mov qword [rcx + rbx + 0x1e8], r8
mov qword [rcx + rbx + 0x1f8], 0x80
inc dword [rbx + 0x1d8]
movsxd rax, dword [rbx + 0x1d8]
cmp eax, 0x14
jge 0x180009227
mov rcx, rax
add rax, 0xf
lea rdx, [0x180017190]
shl rcx, 5
shl rax, 5
mov qword [rax + rbx], rdx
mov qword [rcx + rbx + 0x1e8], r8
mov qword [rcx + rbx + 0x1f8], 0x20
inc dword [rbx + 0x1d8]
add rsp, 0x20
pop rbx
ret
Function at 0x180009230
Capabilities:
Hash data using sha512

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x18003db28]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, r9
mov r12, r8
movzx edi, dl
mov rsi, rcx
cmp r9, 0x40
jbe 0x18000935a
mov ebx, 0x1d8
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, ebx
call fcn.18001cca0
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
movabs rax, 0x3c6ef372fe94f82b
mov dword [rsp + 0x200], 0
mov qword [rsp + 0x50], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x58], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x60], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x68], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x70], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x78], rax
test r14, r14
je 0x180009328
lea rcx, [rsp + 0x30]
mov r8, r14
mov rdx, r12
call fcn.1800163d0
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x30]
call fcn.1800164b0
lea rax, [rsp + 0x30]
nop
mov byte [rax], 0
lea rax, [rax + 1]
dec rbx
jne 0x180009340
lea r12, [rsp + 0x210]
mov r14d, 0x40
mov r15d, dword [rsi]
mov byte [rsp + 0x20], dil
mov ebp, 2
add qword [rsi], rbp
and r15d, 0x7f
mov edi, 0x80
sub edi, r15d
mov byte [rsp + 0x21], r14b
lea rbx, [rsp + 0x20]
cmp qword [rsi], rbp
jae 0x180009389
inc qword [rsi + 8]
test r15d, r15d
je 0x1800093f9
cmp rdi, rbp
ja 0x1800093f9
mov eax, r15d
lea rcx, [rsi + 0x50]
lea rdx, [rsp + 0x20]
add rcx, rax
mov r8, rdi
call fcn.18001cfc0
lea rdx, [rsi + 0x50]
mov rcx, rsi
call fcn.180015e40
lea rbx, [rsp + 0x20]
sub rbp, rdi
add rbx, rdi
xor r15d, r15d
cmp rbp, 0x80
jb 0x1800093f4
mov rdi, rbp
shr rdi, 7
imul rax, rdi, 0xffffffffffffff80
add rbp, rax
nop dword [rax + rax]
mov rdx, rbx
mov rcx, rsi
call fcn.180015e40
sub rbx, 0xffffffffffffff80
dec rdi
jne 0x1800093e0
test rbp, rbp
je 0x18000940e
mov eax, r15d
lea rcx, [rsi + 0x50]
mov r8, rbp
add rcx, rax
mov rdx, rbx
call fcn.18001cfc0
test r14, r14
je 0x180009421
mov r8, r14
mov rdx, r12
mov rcx, rsi
call fcn.1800163d0
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180023020
add rsp, 0x260
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800099b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x18003db28]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov qword [rsp + 0x20], rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rbp + 0xb0]
xor edx, edx
mov r8d, 0x1a0
call fcn.18001cca0
mov r14d, 0x120
lea rcx, [rsp + 0x30]
mov r8d, r14d
xor edx, edx
call fcn.18001cca0
mov rax, rdi
lea rcx, [rbp + 0xc8]
shr rax, 0x18
mov r8, rdi
mov rdx, rbx
mov byte [rbp + 0xc0], al
mov rax, rdi
mov byte [rbp + 0xc3], dil
shr rax, 0x10
mov byte [rbp + 0xc7], gethostbyname
mov byte [rbp + 0xc1], al
mov rax, rdi
shr rax, 8
mov byte [rbp + 0xc2], al
call fcn.18001cfc0
xor esi, esi
mov eax, esi
mov byte [rbp + rdi + 0xc8], 0x80
lea r13, [rdi + 0x19]
lea rcx, [rbp + 0x90]
mov byte [rcx], al
inc eax
lea rcx, [rcx + 1]
cmp eax, 0x20
jl 0x180009a72
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.180011b90
movzx r15d, byte [rbp + 0xb3]
mov r12d, 0x10
nop
xor eax, eax
mov rdi, r13
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
test r13, r13
je 0x180009b0c
lea rbx, [rbp + 0xb0]
lea rax, [rbp + 0x50]
sub rbx, rax
lea rax, [rbp + 0x50]
mov rdx, r12
nop word [rax + rax]
movzx ecx, byte [rbx + rax]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x180009ad0
mov rax, rdi
add rbx, r12
cmp rdi, r12
cmovae rax, r12
lea r9, [rbp + 0x50]
lea r8, [rbp + 0x50]
lea rcx, [rsp + 0x30]
mov edx, 1
sub rdi, rax
call fcn.180011ff0
test rdi, rdi
jne 0x180009ac0
movups xmm0, xmmword [rbp + 0x50]
inc r15b
mov byte [rbp + 0xb3], r15b
movups xmmword [rbp + rsi + 0x60], xmm0
add rsi, r12
cmp rsi, 0x30
jl 0x180009aa0
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.180011b90
mov r12, qword [rsp + 0x20]
mov ebx, 3
nop dword [rax]
nop dword [rax + rax]
lea r9, [rbp + 0x80]
lea r8, [rbp + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
call fcn.180011ff0
lea r12, [r12 + 0x10]
movups xmm0, xmmword [rbp + 0x80]
movups xmmword [r12 - 0x10], xmm0
dec rbx
jne 0x180009b50
lea rax, [rsp + 0x30]
nop dword [rax]
mov byte [rax], 0
lea rax, [rax + 1]
dec r14
jne 0x180009b90
xor eax, eax
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.180023020
mov rbx, qword [rsp + 0x3b8]
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180009bd0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18003db28]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor eax, eax
mov ebx, 1
mov esi, 3
mov r15, rdx
mov r14, rcx
lea rdi, [r11 - 0x68]
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x60], rax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
sub rbx, rcx
mov ebp, esi
nop
lea rax, [r14 + 0xf]
inc byte [rax]
jne 0x180009c44
dec rax
lea rcx, [rbx + rax]
test rcx, rcx
jg 0x180009c34
lea rcx, [r14 + 0x28]
mov r9, rdi
mov r8, r14
mov edx, 1
call fcn.180011ff0
add rdi, 0x10
dec rbp
jne 0x180009c30
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
sub r15, rcx
nop
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [r15 + rax]
lea rax, [rax + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
dec rsi
jne 0x180009c70
lea rdx, [rsp + 0x20]
lea rcx, [r14 + 0x28]
call fcn.180011b90
xor eax, eax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180023020
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret