joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180069cc0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
mov rsi, qword [rdx + 0x10]
lea rcx, [rsi + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
xor r8d, r8d
mov rcx, rdi
call fcn.18003dfa0
mov r8, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x180069d22
mov r8, qword [rdi]
xor edx, edx
lea r9, [rsi - 2]
lea r10, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r9, r9
je 0x180069dfe
nop dword [rax + rax]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180069d4d
mov rax, qword [rbx]
movzx eax, byte [rax + rdx]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [r8], al
cmp qword [rbx + 0x18], 0xf
jbe 0x180069d6d
mov rax, qword [rbx]
lea rcx, [rdx + rax]
jmp 0x180069d74
lea rcx, [rbx + rdx]
mov rax, rbx
movsx rcx, byte [rcx]
and ecx, 3
shl rcx, 4
movzx eax, byte [rax + rdx + 1]
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [r8 + 1], al
cmp qword [rbx + 0x18], 0xf
jbe 0x180069da4
mov rax, qword [rbx]
lea rcx, [rax + 1]
jmp 0x180069dab
lea rcx, [rbx + 1]
mov rax, rbx
add rcx, rdx
movsx rcx, byte [rcx]
and ecx, 0xf
shl rcx, 2
movzx eax, byte [rax + rdx + 2]
shr rax, 6
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [r8 + 2], al
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180069ddb
mov rax, qword [rbx]
movsx rax, byte [rax + rdx + 2]
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [r8 + 3], al
add r8, 4
add rdx, 3
cmp rdx, r9
jb 0x180069d40
cmp rdx, rsi
jae 0x180069eb4
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180069e14
mov rax, qword [rbx]
movzx eax, byte [rax + rdx]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [r8], al
lea rax, [rsi - 1]
cmp rdx, rax
jne 0x180069e56
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180069e3a
mov rax, qword [rbx]
movsx rax, byte [rax + rdx]
and eax, 3
add rax, rax
movzx eax, byte [r10 + rax*8]
mov byte [r8 + 1], al
mov al, 0x3d
add r8, 2
jmp 0x180069eac
cmp qword [rbx + 0x18], 0xf
jbe 0x180069e66
mov rax, qword [rbx]
lea rcx, [rdx + rax]
jmp 0x180069e6d
lea rcx, [rbx + rdx]
mov rax, rbx
movsx rcx, byte [rcx]
and ecx, 3
shl rcx, 4
movzx eax, byte [rax + rdx + 1]
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [r8 + 1], al
add r8, 2
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x180069e9e
mov rax, qword [rbx]
movsx rax, byte [rax + rdx + 1]
and eax, 0xf
movzx eax, byte [r10 + rax*4]
mov byte [r8], al
mov byte [r8 + 1], 0x3d
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180069eea
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180069ee5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180069f1d
mov rcx, r8
call fcn.1800d0680
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], select
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d0660
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.1800d939c
int3
Function at 0x180069f30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x180069f91
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180069f50
mov ecx, dword [r9]
jmp 0x18006a07b
cmp ecx, 0x4e0
jb 0x18006a07b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180069fb0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18006a000
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x18006d530
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x13f0
call fcn.1800d10c0
sub rsp, rax
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
movsxd rsi, r8d
mov rdi, rdx
mov qword [rsp + 0x28], rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea ecx, [rbx + 0x20]
call fcn.1800d07a8
mov rbp, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.0123456789ABCDEFGHabcdefgh]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x180101758]
movsd qword [rax + 0x10], xmm0
movzx eax, word [0x180101760]
mov word [rbp + 0x18], ax
mov byte [rbp + 0x1a], bl
call fcn.1800d019c
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rbx + 1]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x18006d5d0
mov dword [rsp + 0x50], 0x270
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], select
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.1800486a4
test rsi, rsi
jle 0x18006d67e
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.180069f30
mov ecx, eax
imul rax, rcx, 0x1a
cmp eax, 0x15
ja 0x18006d65b
lea rcx, [rsp + 0x28]
call fcn.180069f30
mov ecx, eax
imul rax, rcx, 0x1a
cmp eax, 0x16
jb 0x18006d646
shr rax, 0x20
movsxd rcx, eax
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18006d66f
mov rax, qword [rdi]
movzx ecx, byte [rcx + rbp]
mov byte [rbx + rax], cl
inc rbx
cmp rbx, rsi
jl 0x18006d631
mov edx, 0x20
mov rcx, rbp
call fcn.1800d0680
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1800d0660
mov rbx, qword [rsp + 0x1410]
add rsp, 0x13f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x180072f10
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xe0
mov rax, qword [0x180150340]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, r8
mov rdi, rdx
mov qword [rbp - 0x59], rdx
mov rsi, qword [rbp + 0x7f]
xor r14d, r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x35], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x25], xmm1
mov dword [rbp - 0x15], r14d
mov qword [rbp - 0x41], 0x408
mov dword [rbp - 0x39], 1
lea r10, [rbp + 0x2c]
test r9d, r9d
jns 0x180072fc0
neg r9d
nop dword [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r9b, cl
add r9b, 0x30
mov byte [r10], r9b
mov r9d, edx
test edx, edx
jne 0x180072f80
dec r10
mov byte [r10], 0x2d
jmp 0x180072fea
dec r10
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r9b, cl
add r9b, 0x30
mov byte [r10], r9b
mov r9d, edx
test edx, edx
jne 0x180072fc0
lea r9, [rbp - 0x61]
lea r8, [rbp + 0x2c]
mov rdx, r10
lea rcx, [rbp - 9]
call fcn.1800305d8
nop
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rdx, qword [rbp - 9]
cmp qword [rbx + 0x18], 0xf
jbe 0x180073017
mov rbx, qword [rbx]
lea r9, [rbp - 0x51]
lea r8, [rbp - 0x41]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x180073080
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x400
lea rbx, [0x180152790]
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x12ff
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x180073062
mov rdx, rbx
mov rcx, rsi
call fcn.18004eabc
mov rbx, r14
mov qword [rbp - 0x51], rbx
jmp 0x180073084
mov rbx, qword [rbp - 0x51]
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov rax, qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov qword [rbp - 0x59], rax
mov qword [rbp + 0x17], rbx
lea rax, [rbp - 0x59]
mov qword [rbp + 0x1f], rax
mov byte [rbp + 0x27], 1
mov ecx, 0x20
call fcn.1800d07a8
mov rcx, rax
mov qword [rbp - 0x11], rax
test rax, rax
je 0x1800730e8
mov rax, qword [rbp - 0x59]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rcx + 8], 1
mov dword [rcx + 0xc], 1
lea rdx, vtable.std::_Ref_count_resource_struct_addrinfo____ptr64__void____cdecl___struct_addrinfo____ptr64__.0
mov qword [rcx], rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rbx
jmp 0x1800730eb
mov rcx, r14
mov qword [rdi], rbx
mov qword [rdi + 8], rcx
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x180073129
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180073124
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180073150
call fcn.1800d0680
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800d0660
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.1800d939c
int3
Function at 0x18007d4e0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rsi
mov rdi, rcx
mov rsi, qword [rcx + 8]
mov rbp, r9
sub rsi, rcx
mov r14, r8
sub rsi, 0x10
mov ecx, 0x2000000
sar rsi, 2
mov r15d, edx
call fcn.1800975d0
test eax, eax
je 0x18007d531
mov rcx, rdi
shr rcx, 2
and ecx, 3
je 0x18007d531
mov eax, 4
sub eax, ecx
jmp 0x18007d533
xor eax, eax
cmp eax, esi
je 0x18007d56b
mov qword [rsp + 0x40], rbx
mov ebx, eax
mov eax, dword [rdi]
add rbx, 4
inc eax
shl eax, 4
movsxd r8, eax
mov eax, esi
lea rbx, [rdi + rbx*4]
add rax, 4
mov rcx, rbx
lea rdx, [rdi + rax*4]
call fcn.1800f9180
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x40]
mov ecx, 0x2000000
call fcn.1800975d0
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
test eax, eax
je 0x18007d59d
mov r9, rbp
mov r8, r14
mov edx, r15d
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.180097260
mov r8, rbp
mov rdx, r14
cmp r15d, 1
jne 0x18007d5bc
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.18007f440
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.18007ec50
Function at 0x1800938b0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x180108f30]
mov r14, rdx
mov rcx, rbx
test rsi, rsi
je 0x18009390e
cmp qword [0x180108f30], 0
je 0x18009390e
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x180093901
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.1800f9c60
test eax, eax
je 0x180093929
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x1800938e8
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
test rbx, rbx
je 0x18009390e
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
xor eax, eax
jmp 0x180093913

Function at 0x1800939e0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x180108d00]
mov r14, r8
mov r15, rdx
mov rcx, rbx
test rsi, rsi
je 0x180093a46
cmp qword [0x180108d00], 0
je 0x180093a46
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x180093a39
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.1800f9c60
test eax, eax
je 0x180093a66
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x180093a20
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
test rbx, rbx
je 0x180093a46
mov eax, dword [rbx + 0x20]
mov dword [r15], eax
mov eax, dword [rbx + 0x24]
mov dword [r14], eax
xor eax, eax
jmp 0x180093a4b
Function at 0x180096700
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
xor eax, eax
movabs r8, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
test edx, edx
mov qword [rcx + 8], rax
movabs rax, 0x6a09e667f3bcc908
cmovne rax, r8
movabs r8, 0x629a292a367cd507
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
cmovne rax, r8
movabs r8, 0x9159015a3070dd17
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
cmovne rax, r8
movabs r8, 0x152fecd8f70e5939
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
cmovne rax, r8
movabs r8, 0x67332667ffc00b31
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
cmovne rax, r8
movabs r8, 0x8eb44a8768581511
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
cmovne rax, r8
movabs r8, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
cmovne rax, r8
movabs r8, 0x47b5481dbefa4fa4
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
cmovne rax, r8
mov qword [rcx + 0x48], rax
xor eax, eax
mov dword [rcx + 0xd0], edx
ret
Function at 0x180096aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [rdx]
aeskeygenassist xmm0, xmm1, 1
pshufd xmm3, xmm0, 0xff
xorps xmm3, xmm1
movups xmmword [rcx], xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x10], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x20], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x30], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x40], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x50], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x60], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
movdqa xmm3, xmm2
xorps xmm0, xmm1
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x70], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x80], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x90], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm1, xmm3
xorps xmm1, xmm0
pslldq xmm3, 4
xorps xmm1, xmm3
movdqu xmmword [rcx + 0xa0], xmm1
ret
Function at 0x180097260
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [r8]
mov rax, qword [rcx + 8]
mov r8d, dword [rcx]
dec r8d
xorps xmm0, xmmword [rax]
add rax, 0x10
test edx, edx
jne 0x18009729b
test r8d, r8d
je 0x18009728f
nop
aesdec xmm0, xmmword [rax]
add rax, 0x10
add r8d, 0xffffffff
jne 0x180097280
aesdeclast xmm0, xmmword [rax]
movups xmmword [r9], xmm0
xor eax, eax
ret
test r8d, r8d
je 0x1800972af
aesenc xmm0, xmmword [rax]
add rax, 0x10
add r8d, 0xffffffff
jne 0x1800972a0
aesenclast xmm0, xmmword [rax]
movups xmmword [r9], xmm0
xor eax, eax
ret

Function at 0x180097640
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movsxd rax, r8d
shl rax, 4
add rax, rdx
movdqu xmm0, xmmword [rax]
sub rax, 0x10
movdqu xmmword [rcx], xmm0
add rcx, 0x10
cmp rax, rdx
jbe 0x180097676
nop
aesimc xmm0, xmmword [rax]
sub rax, 0x10
movdqu xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
cmp rax, rdx
ja 0x180097660
movdqu xmm0, xmmword [rax]
movdqu xmmword [rcx], xmm0
ret
Function at 0x18009d710
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
xor eax, eax
mov r8d, 0xc1059ed8
mov qword [rcx], rax
test edx, edx
mov eax, 0x6a09e667
cmovne eax, r8d
mov r8d, 0x367cd507
mov dword [rcx + 8], eax
mov eax, 0xbb67ae85
cmovne eax, r8d
mov r8d, 0x3070dd17
mov dword [rcx + 0xc], eax
mov eax, 0x3c6ef372
cmovne eax, r8d
mov r8d, 0xf70e5939
mov dword [rcx + 0x10], eax
mov eax, 0xa54ff53a
cmovne eax, r8d
mov r8d, 0xffc00b31
mov dword [rcx + 0x14], eax
mov eax, 0x510e527f
cmovne eax, r8d
mov r8d, 0x68581511
mov dword [rcx + 0x18], eax
mov eax, 0x9b05688c
cmovne eax, r8d
mov r8d, 0x64f98fa7
mov dword [rcx + 0x1c], eax
mov eax, 0x1f83d9ab
cmovne eax, r8d
mov r8d, 0xbefa4fa4
mov dword [rcx + 0x20], eax
mov eax, 0x5be0cd19
cmovne eax, r8d
mov dword [rcx + 0x24], eax
xor eax, eax
mov dword [rcx + 0x68], edx
ret
Function at 0x18009ede0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r15
mov rax, qword [rdx + 8]
mov r15, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 8], rax
je 0x18009ee09
mov eax, 0xfffffffc
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov r11d, dword [rcx]
mov eax, dword [rdx]
sar eax, 1
mov qword [rsp + 0x18], rbx
and eax, 1
sar r11d, 1
and r11d, 1
mov qword [rsp + 0x28], r14
xor eax, r11d
mov ebx, eax
and ebx, r11d
mov dword [r8], ebx
mov r14, qword [rcx + 8]
test r14, r14
je 0x18009ef00
mov qword [rsp + 0x20], rbp
mov ebp, 1
sub ebp, r11d
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov r10d, 1
sub r10d, eax
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
and ecx, r8d
shr r9, 0x3f
and r9d, edx
or r9d, ecx
and r10d, r9d
or eax, r9d
and r10d, r11d
or r10d, ebx
mov ebx, 1
mov dword [r15], r10d
sub ebx, eax
mov rcx, qword [rsi + 0x10]
and ebx, ebp
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
shr r9, 0x3f
and ecx, r8d
and r9d, edx
or r9d, ecx
and ebx, r9d
or eax, r9d
or ebx, r10d
mov dword [r15], ebx
sub r14, 1
jne 0x18009ee50
mov rbp, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret

Function at 0x1800a3a30
Capabilities:
Encode data using add xor sub operations
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rcx]
mov r10, rcx
mov ebx, dword [rcx + 4]
test rdx, rdx
je 0x1800a3a92
sub r8, r9
nop word [rax + rax]
lea eax, [r11 + 1]
movzx r11d, al
lea r9, [r9 + 1]
movzx ecx, byte [r11 + r10 + 8]
lea eax, [rbx + rcx]
movzx ebx, al
movzx eax, byte [rbx + r10 + 8]
mov byte [r11 + r10 + 8], al
add al, cl
mov byte [rbx + r10 + 8], cl
movzx eax, al
movzx ecx, byte [rax + r10 + 8]
xor cl, byte [r9 + r8 - 1]
mov byte [r9 - 1], cl
sub rdx, 1
jne 0x1800a3a50
mov dword [r10 + 4], ebx
xor eax, eax
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret
Function at 0x1800a45d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
xor r15d, r15d
mov r12, r9
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
test rdx, rdx
je 0x1800a462e
mov r10, rbx
mov rcx, r9
sub r10, r9
mov rdx, qword [rdi + 0x80]
cmp rdx, 0x40
jae 0x1800a462e
movzx eax, byte [r10 + rcx]
inc r15
xor al, byte [rdx + rdi + 0x40]
mov byte [rcx], al
inc rcx
inc qword [rdi + 0x80]
sub rbp, 1
jne 0x1800a4603
lea rsi, [rdi + 0x40]
cmp rbp, 0x40
jb 0x1800a4739
mov qword [rsp + 0x60], r13
mov r12, rbp
mov qword [rsp + 0x20], r14
mov r13, rbx
shr r12, 6
lea rbx, [r9 + 1]
imul rax, r12, 0xffffffffffffffc0
mov r14, rdi
sub r13, r9
sub r14, r15
add rbp, rax
sub r14, r9
mov rax, r12
shl rax, 6
add rbx, r15
add r14, 0x40
add r15, rax
nop dword [rax + rax]
mov rdx, rsi
mov rcx, rdi
call fcn.1800a3e00
inc dword [rdi + 0x30]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rbx - 1]
xor al, byte [rbx + r13 - 1]
mov byte [rbx - 1], al
movzx eax, byte [r14 + rbx]
xor al, byte [rbx + r13]
mov byte [rbx], al
movzx eax, byte [r14 + rbx + 1]
xor al, byte [rbx + r13 + 1]
mov byte [rbx + 1], al
movzx eax, byte [r14 + rbx + 2]
xor al, byte [rbx + r13 + 2]
mov byte [rbx + 2], al
movzx eax, byte [r14 + rbx + 3]
xor al, byte [rbx + r13 + 3]
mov byte [rbx + 3], al
movzx eax, byte [r14 + rbx + 4]
xor al, byte [rbx + r13 + 4]
mov byte [rbx + 4], al
movzx eax, byte [r14 + rbx + 5]
xor al, byte [rbx + r13 + 5]
mov byte [rbx + 5], al
movzx eax, byte [r14 + rbx + 6]
xor al, byte [rbx + r13 + 6]
mov byte [rbx + 6], al
add rbx, 8
sub rcx, 1
jne 0x1800a46a0
sub r14, 0x40
sub r12, 1
jne 0x1800a4680
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test rbp, rbp
je 0x1800a477d
mov rdx, rsi
mov rcx, rdi
call fcn.1800a3e00
inc dword [rdi + 0x30]
mov rcx, rbp
sub r15, rdi
lea rdx, [r15 + rbx]
lea r8, [r15 + r12]
nop word [rax + rax]
movzx eax, byte [rsi + rdx - 0x40]
xor al, byte [rsi]
mov byte [r8 + rsi - 0x40], al
lea rsi, [rsi + 1]
sub rcx, 1
jne 0x1800a4760
mov qword [rdi + 0x80], rbp
xor eax, eax
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret