joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180082090
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x170], rax
and dword [rsp + 0x20], 0
mov rsi, rdx
xor edx, edx
mov ebp, r8d
mov rdi, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0x31]
mov rbx, r9
mov byte [rsp + 0x30], 0
call fcn.18009e990
mov r8d, dword [rsp + 0x1d0]
mov rdx, rbx
cmp r8d, 0x40
jbe 0x180082181
and dword [rsp + 0xc0], 0
and dword [rsp + 0x104], 0
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x7380166f
mov dword [rsp + 0xa4], 0x4914b2b9
mov dword [rsp + 0xa8], 0x172442d7
mov dword [rsp + 0xac], 0xda8a0600
mov dword [rsp + 0xb0], 0xa96f30bc
mov dword [rsp + 0xb4], 0x163138aa
mov dword [rsp + 0xb8], 0xe38dee4d
mov dword [rsp + 0xbc], 0xb0fb0e4e
call fcn.18009481c
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x110]
call fcn.1800948dc
mov r8d, 0x20
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
call fcn.18009ab10
xor edx, edx
lea r8d, [rdx + 0x40]
mov cl, byte [rsp + rdx + 0x30]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x9f], cl
mov byte [rsp + rdx + 0x10f], al
jne 0x180082191
and dword [rsp + 0x50], r8d
and dword [rsp + 0x94], r8d
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
mov ebx, 0x172442d7
mov r8d, 0x40
mov dword [rsp + 0x30], 0x7380166f
mov dword [rsp + 0x34], 0x4914b2b9
mov dword [rsp + 0x3c], 0xda8a0600
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x40], 0xa96f30bc
mov dword [rsp + 0x44], 0x163138aa
mov dword [rsp + 0x48], 0xe38dee4d
mov dword [rsp + 0x4c], 0xb0fb0e4e
call fcn.18009481c
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rsi
call fcn.18009481c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x110]
call fcn.1800948dc
and dword [rsp + 0x50], 0
and dword [rsp + 0x94], 0
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x30]
mov r8d, 0x40
mov dword [rsp + 0x30], 0x7380166f
mov dword [rsp + 0x34], 0x4914b2b9
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x3c], 0xda8a0600
mov dword [rsp + 0x40], 0xa96f30bc
mov dword [rsp + 0x44], 0x163138aa
mov dword [rsp + 0x48], 0xe38dee4d
mov dword [rsp + 0x4c], 0xb0fb0e4e
call fcn.18009481c
mov ebx, 0x20
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.18009481c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x150]
call fcn.1800948dc
and qword [rdi + 0x18], 0
mov qword [rdi + 0x20], sendto
lea rdx, [rsp + 0x150]
mov r8, rbx
mov rcx, rdi
mov byte [rdi + 8], 0
call fcn.18000f0f0
mov rax, rdi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0x188
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18008230c
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha256

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x178
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x160], rax
and dword [rsp + 0x20], 0
mov rsi, rdx
xor edx, edx
mov ebp, r8d
mov rdi, rcx
lea r8d, [rdx + 0x3f]
lea rcx, [rsp + 0xa1]
mov rbx, r9
mov byte [rsp + 0xa0], 0
call fcn.18009e990
mov eax, dword [rbx]
xor edx, edx
mov dword [rsp + 0xa0], eax
movzx eax, word [rbx + 4]
lea r9d, [rdx + 0x40]
mov word [rsp + 0xa4], ax
mov r8, r9
mov cl, byte [rsp + rdx + 0xa0]
inc rdx
mov al, cl
xor cl, 0x5c
xor al, 0x36
sub r8, 1
mov byte [rsp + rdx + 0x11f], cl
mov byte [rsp + rdx + 0xdf], al
jne 0x180082374
and dword [rsp + 0x70], r8d
and qword [rsp + 0x78], r8
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
mov ebx, 0x5be0cd19
mov r8d, r9d
mov dword [rsp + 0x80], 0x6a09e667
mov dword [rsp + 0x84], 0xbb67ae85
mov dword [rsp + 0x88], 0x3c6ef372
mov dword [rsp + 0x8c], 0xa54ff53a
mov dword [rsp + 0x90], 0x510e527f
mov dword [rsp + 0x94], 0x9b05688c
mov dword [rsp + 0x98], 0x1f83d9ab
mov dword [rsp + 0x9c], ebx
call fcn.180094f40
lea rcx, [rsp + 0x30]
mov r8d, ebp
mov rdx, rsi
call fcn.180094f40
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xe0]
call fcn.180094fa0
xor esi, esi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x30]
lea r8d, [rsi + 0x40]
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rsi
mov dword [rsp + 0x80], 0x6a09e667
mov dword [rsp + 0x84], 0xbb67ae85
mov dword [rsp + 0x88], 0x3c6ef372
mov dword [rsp + 0x8c], 0xa54ff53a
mov dword [rsp + 0x90], 0x510e527f
mov dword [rsp + 0x94], 0x9b05688c
mov dword [rsp + 0x98], 0x1f83d9ab
mov dword [rsp + 0x9c], ebx
call fcn.180094f40
lea ebx, [rsi + 0x20]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.180094f40
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.180094fa0
mov qword [rdi + 0x20], sendto
mov qword [rdi + 0x18], rsi
lea rdx, [rsp + 0xa0]
mov r8, rbx
mov rcx, rdi
mov byte [rdi + 8], sil
call fcn.18000f0f0
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.180099fe0
add rsp, 0x178
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800848c4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rsi
mov rsi, rcx
mov ecx, 0x20
call fcn.18009a960
mov rdi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x180084925
mov rcx, qword [rsi + 0x18]
test rcx, rcx
jne 0x180084905
and qword [rax + 0x18], rcx
jmp 0x180084927
cmp rcx, rsi
jne 0x180084918
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax]
mov qword [rdi + 0x18], rax
jmp 0x180084927
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
mov qword [rdi + 0x18], rax
jmp 0x180084927
xor edi, edi
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x180084998]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x180084964
mov r8, qword [rcx]
cmp rcx, rsi
setne dl
call qword [r8 + 0x18]
and qword [rsi + 0x18], 0
mov rax, rdi
jmp 0x18008498a
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x180084a20
Capabilities:
Delete registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
sub rsp, 0xc0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, r9
mov bpl, r8b
mov rdi, rdx
xor r12d, r12d
cmp word [0x18010bea0], r12w
je 0x180084b8a
lea rcx, [r11 - 0x50]
call fcn.180052d68
nop
cmp qword [rsp + 0xa0], r12
je 0x180084b72
lea rcx, [rsp + 0x90]
cmp qword [rsp + 0xa8], 8
cmovae rcx, qword [rsp + 0x90]
lea rbx, [0x1800cda5f]
cmp rsi, r12
cmovne rbx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r8, rax
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea rdx, str._s__hs__p
lea rcx, [rsp + 0x60]
call fcn.180053a60
nop
cmp bpl, r12b
je 0x180084b33
lea edx, [r12 + 1]
lea rcx, [rsp + 0x38]
call fcn.180051f30
cmp qword [rax + 0x20], 8
jb 0x180084aef
mov r9, qword [rax + 8]
jmp 0x180084af3
lea r9, [rax + 8]
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae r8, qword [rsp + 0x68]
mov dword [rsp + 0x20], r12d
lea rdx, [0x18010bea0]
mov rcx, 0xffffffff80000002
call fcn.180053be4
cmp qword [rsp + 0x58], 8
jb 0x180084b5c
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
jmp 0x180084b5c
lea r8, [rsp + 0x68]
cmp qword [rsp + 0x80], 8
cmovae r8, qword [rsp + 0x68]
lea rdx, [0x18010bea0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
nop
cmp qword [rsp + 0x80], 8
jb 0x180084b72
mov rcx, qword [rsp + 0x68]
call fcn.18009a864
nop
cmp qword [rsp + 0xa8], 8
jb 0x180084b8a
mov rcx, qword [rsp + 0x90]
call fcn.18009a864
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x180084df0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x270
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
dec eax
cmp eax, 0xc6
ja 0x180084eb3
lea rcx, [0x18010bea0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x52]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], si
call fcn.18009e990
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, 0x104
lea rdx, [rsp + 0x50]
mov rcx, rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x1800d0fd8]
lea rcx, [0x18010bea0]
mov r8d, ebx
call qword [sym.imp.SHLWAPI.dll_StrCatBuffW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rcx, [0x18010bea0]
mov r8d, ebx
mov rdx, rax
call qword [sym.imp.SHLWAPI.dll_StrCatBuffW]
lea rdx, [0x18010bea0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rax, [0x18007920c]
mov qword [0x18010d1e8], rax
cmp byte [0x18010d140], sil
jne 0x180084f41
mov ebx, 1
lea rax, [0x180084bb4]
mov qword [rsp + 0x20], rax
lea rax, [0x18010d140]
lea ecx, [rbx + 0x1f]
mov byte [0x18010d140], bl
mov dword [0x18010d178], ebx
mov qword [rsp + 0x28], rax
call fcn.18009a960
cmp rax, rsi
je 0x180084f15
movdqu xmm0, xmmword [rsp + 0x20]
lea rcx, [0x1800d6260]
mov qword [rax], rcx
movdqu xmmword [rax + 8], xmm0
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x48], rax
call fcn.1800848c4
lea rdx, [rsp + 0x20]
lea rcx, [0x18010d180]
mov qword [rsp + 0x20], rax
call fcn.180042a20
jmp 0x180084f44
mov bl, sil
mov al, bl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rsi
ret
Function at 0x180085490
Capabilities:
Check if file exists
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x380
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x370], rax
xor edi, edi
lea rcx, str..gxdte_cd
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea r8d, [rdi + 7]
mov edx, 0xc0000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x180085619
lea rcx, [rsp + 0x162]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x160], di
call fcn.18009e990
mov ebx, 0x11c
lea rcx, [rsp + 0x40]
mov r8, rbx
xor edx, edx
call fcn.18009e990
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, edi
je 0x180085545
lea rcx, [rsp + 0x40]
call fcn.180051604
cmp eax, edi
je 0x180085545
cmp dword [rsp + 0x44], 6
lea rbx, str.gxdte64_win7.sys
je 0x18008554c
lea rbx, str.gxdte64.sys
lea r8, [rsp + 0x160]
mov rdx, rbx
xor ecx, ecx
call fcn.180051450
lea rcx, [rsp + 0x160]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x18008559f
cmp word [0x18010c0b0], di
je 0x18008559f
lea rdx, [0x18010c0b0]
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x160]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rbx, str.gxdte
mov rcx, rbx
call fcn.180054360
lea r9, str.gxdte_driver
lea r8, str.gxdte64.sys
cmp eax, edi
mov eax, 1
lea rdx, [rsp + 0x160]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov rcx, rbx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0x22343
call fcn.180095be8
mov rcx, rbx
call fcn.1800542b8
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea rcx, str..gxdte_cd
lea r8d, [r9 + 7]
mov edx, 0xc0000000
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0x390]
add rsp, 0x380
pop rdi
ret
Function at 0x180085998
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
sub rsp, 0x50
and dword [rsp + 0x30], 0
mov rsi, rdx
mov rbx, rcx
xor eax, eax
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov rdi, r8
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, 0x1000
mov dword [rsp + 0x30], eax
cmp qword [rsp + 0x30], r13
jb 0x180085b3f
and dword [rsp + 0x88], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x4c], 0
mov r12d, 1
lea r8, [rsp + 0x4c]
xor edx, edx
mov rcx, rsi
mov r9d, r12d
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, r13d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180085b1c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x180085a5e
mov eax, dword [rbx + 8]
mov dword [rdi], eax
movabs rax, 0x706c646f70bfbbef
cmp qword [rbx], rax
jne 0x180085b1c
cmp dword [rbx + 8], 2
je 0x180085a81
cmp dword [rbx + 8], 3
jne 0x180085b1c
mov ecx, dword [rbx + 0x18c]
mov edx, 0x190
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rdx + rbx], al
add rdx, r12
cmp rdx, r13
jl 0x180085a8c
cmp byte [rbx + 0x4a3], 0
jne 0x180085af3
cmp dword [rbx + 0x1a0], 0x40
ja 0x180085af3
mov eax, 0x270f
cmp word [rbx + 0x190], ax
ja 0x180085af3
movzx eax, word [rbx + 0x192]
cmp ax, r12w
jb 0x180085af3
cmp ax, 0xc
ja 0x180085af3
movzx eax, word [rbx + 0x196]
cmp ax, r12w
jb 0x180085af3
cmp ax, 0x1f
ja 0x180085af3
mov ebx, r12d
jmp 0x180085af5
xor ebx, ebx
cmp dword [rsp + 0x40], 0
jne 0x180085b18
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
xor r9d, r9d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, ebx
jmp 0x180085b41
cmp dword [rsp + 0x40], 0
jne 0x180085b3f
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
xor r9d, r9d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x18008a068
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor eax, eax
mov dil, cl
mov byte [rsp + 0x20], cl
lea rcx, [rsp + 0x20]
mov rsi, rdx
xor ebx, ebx
mov byte [rsp + 0x21], 0x3a
mov byte [rsp + 0x22], 0x5c
mov qword [rsp + 0x23], rax
mov dword [rsp + 0x2b], eax
mov byte [rsp + 0x2f], al
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea ebp, [rbx + 1]
cmp eax, 2
je 0x18008a0c0
cmp eax, 3
jne 0x18008a0d3
mov cl, dil
call fcn.1800519a0
cmp eax, 0xffffffff
je 0x18008a0df
cmp eax, 7
cmove ebx, ebp
test ebx, ebx
mov al, bpl
setne cl
mov byte [rsi], cl
jmp 0x18008a0e1
xor al, al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x18008a0fc
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [r11 - 0x38], rcx
and dword [rsp + 0x24], 0
mov ecx, 8
call fcn.18009a960
test rax, rax
je 0x18008a144
mov qword [rax], rdi
jmp 0x18008a146
xor eax, eax
mov qword [rdi], rax
mov rcx, rdi
call fcn.18002e810
mov qword [rdi + 0x30], rax
mov byte [rax + 0x1a], 1
mov rax, qword [rdi + 0x30]
mov qword [rax + 8], rax
mov rax, qword [rdi + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 0x30]
mov qword [rax + 0x10], rax
and qword [rdi + 0x38], 0
mov dword [rsp + 0x24], 1
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
xor ebx, ebx
bt esi, ebx
jae 0x18008a1c2
mov byte [rsp + 0x20], 0
lea ecx, [rbx + 0x61]
lea rdx, [rsp + 0x20]
call fcn.18008a068
test al, al
je 0x18008a1c2
cmp byte [rsp + 0x20], 0
je 0x18008a1c2
lea ecx, [rbx + 0x41]
mov byte [rsp + 0x20], cl
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.18008a1ec
inc ebx
cmp ebx, 0x1a
jl 0x18008a187
mov rax, rdi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18008f4f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x18008f55e
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x18008f52a
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.18008f664
mov edi, dword [rbx + 0x18]
lea r14, [0x1801033f0]
jmp 0x18008f5b9
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18008f578
add r11, 4
sub r8, 1
jne 0x18008f575
mov edx, edi
mov rcx, rbx
call fcn.18008f664
mov rcx, rbx
call fcn.18008f7a4
mov rcx, rbx
dec edi
call fcn.18008f71c
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x18008f575
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18008f5d4
add r11, 4
sub r8, 1
jne 0x18008f5d1
xor edx, edx
mov rcx, rbx
call fcn.18008f664
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x18008f648
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x18008f617
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18008f664
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x18008f67e
inc rdx
add rcx, r11
sub r10, 1
jne 0x18008f678
repz ret
Function at 0x18009031c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov r12, r8
mov rdi, rdx
mov rbx, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov rdx, qword [rdx + 0x18]
test dl, 0xf
je 0x18009038e
mov qword [rcx + 0x20], sendto
mov qword [rcx + 0x18], r13
mov byte [rcx + 8], r13b
xor r8d, r8d
lea rdx, [0x1800cda5f]
call fcn.18000f0f0
mov rax, rbx
jmp 0x180090580
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.18006a584
nop
mov rbp, qword [rdi + 0x18]
mov r15d, sendto
cmp qword [rdi + 0x20], r15
jb 0x1800903b2
mov rdi, qword [rdi + 8]
jmp 0x1800903b6
add rdi, 8
lea rsi, [rsp + 0x48]
cmp qword [rsp + 0x60], r15
cmovae rsi, qword [rsp + 0x48]
cmp rbp, r15
jb 0x180090422
shr rbp, 4
cmp qword [r12 + 0x20], r15
jb 0x1800903dd
mov r8, qword [r12 + 8]
jmp 0x1800903e2
lea r8, [r12 + 8]
mov byte [rsp + 0x20], 0
mov r9d, dword [r12 + 0x18]
mov rdx, rsi
mov rcx, rdi
call fcn.18008fd38
mov r11, rsi
sub r14, rsi
mov rcx, r15
mov al, byte [r14 + r11]
xor byte [r11], al
inc r11
sub rcx, 1
jne 0x180090400
mov r14, rdi
add rdi, r15
add rsi, r15
sub rbp, 1
jne 0x1800903cf
xor r13d, r13d
mov r9, qword [rsp + 0x58]
cmp r9, r15
jae 0x180090468
mov qword [rbx + 0x20], sendto
mov qword [rbx + 0x18], r13
mov byte [rbx + 8], r13b
xor r8d, r8d
lea rdx, [0x1800cda5f]
mov rcx, rbx
call fcn.18000f0f0
nop
cmp qword [rsp + 0x60], r15
jb 0x180090460
mov rcx, qword [rsp + 0x48]
call fcn.18009a864
mov rax, rbx
jmp 0x180090580
lea rdi, [r9 - 1]
cmp r9, rdi
ja 0x18009047b
call fcn.180099f34
mov r9, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], r15
cmovae rax, qword [rsp + 0x48]
mov dil, byte [rax + rdi]
cmp dil, r15b
jbe 0x1800904d0
mov qword [rbx + 0x20], sendto
mov qword [rbx + 0x18], r13
mov byte [rbx + 8], r13b
xor r8d, r8d
lea rdx, [0x1800cda5f]
mov rcx, rbx
call fcn.18000f0f0
nop
cmp qword [rsp + 0x60], r15
jb 0x1800904c8
mov rcx, qword [rsp + 0x48]
call fcn.18009a864
mov rax, rbx
jmp 0x180090580
mov bpl, r13b
cmp dil, r13b
jbe 0x180090554
movzx r12d, dil
movzx eax, bpl
mov rsi, r9
sub rsi, rax
dec rsi
cmp r9, rsi
ja 0x1800904f8
call fcn.180099f34
mov r9, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], r15
cmovae rax, qword [rsp + 0x48]
movsx eax, byte [rax + rsi]
cmp eax, r12d
jne 0x18009051b
inc bpl
cmp bpl, dil
jb 0x1800904dc
jmp 0x180090554
mov qword [rbx + 0x20], sendto
mov qword [rbx + 0x18], r13
mov byte [rbx + 8], r13b
xor r8d, r8d
lea rdx, [0x1800cda5f]
mov rcx, rbx
call fcn.18000f0f0
nop
cmp qword [rsp + 0x60], r15
jb 0x18009054f
mov rcx, qword [rsp + 0x48]
call fcn.18009a864
mov rax, rbx
jmp 0x180090580
movzx eax, dil
sub r9, rax
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.18000cbb0
nop
cmp qword [rsp + 0x60], r15
jb 0x18009057d
mov rcx, qword [rsp + 0x48]
call fcn.18009a864
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180090798
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x18009098a
lea rdi, [0x1800d47f0]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18009081e
cmp cl, r14b
je 0x180090809
cmp cl, r14b
je 0x18009098a
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18009083d
cmp bpl, r14b
je 0x180090827
cmp bpl, r14b
je 0x18009098a
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.180054f54
jmp 0x18009086f
lea rdi, [0x1800d47f0]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x18009094e
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x180090890
cmp dil, r14b
je 0x180090868
cmp dil, r14b
je 0x18009098a
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180054f54
lea rdx, [0x1800d47f0]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x180090912
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x1800908e0
cmp cl, r14b
je 0x1800908c4
cmp cl, r14b
je 0x18009098a
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180054f54
cmp rsi, r13
lea rdi, [0x1800d47f0]
jb 0x180090809
jmp 0x18009098a
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18000d880
nop
cmp qword [rsp + 0x50], 0x10
jb 0x180090949
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
mov rax, rbx
jmp 0x1800909c4
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18000d880
nop
cmp qword [rsp + 0x50], 0x10
jb 0x180090985
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
mov rax, rbx
jmp 0x1800909c4
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18000d880
nop
cmp qword [rsp + 0x50], 0x10
jb 0x1800909c1
mov rcx, qword [rsp + 0x38]
call fcn.18009a864
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180099fe0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret