joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004f980
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rbx, r8
mov rdi, rdx
mov r15, rcx
cmp r8, 0x180
jbe 0x18004f9cc
mov eax, 0xffffffc8
jmp 0x18004fbbd
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x1a0
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
call fcn.180052894
mov rax, rbx
mov byte [rbp + 0xb3], bl
shr rax, 0x18
lea rcx, [rbp + 0xb8]
mov byte [rbp + 0xb0], al
mov r8, rbx
mov rax, rbx
mov byte [rbp + 0xb7], 0x30
shr rax, 0x10
mov rdx, rdi
mov byte [rbp + 0xb1], al
mov rax, rbx
shr rax, 8
mov byte [rbp + 0xb2], al
call sub.VCRUNTIME140.dll_memcpy
xor eax, eax
mov byte [rbp + rbx + 0xb8], 0x80
lea rcx, [rbp + 0x80]
lea r12, [rbx + 0x19]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x20
jl 0x18004fa45
mov r8d, 0x100
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.180052a28
mov ebx, eax
mov r13d, reloc.WS2_32.dll_recv
test eax, eax
jne 0x18004fb67
xor esi, esi
mov r8, r13
lea rcx, [rbp + 0x40]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r14, r12
test r12, r12
je 0x18004fae9
lea rdi, [rbp + 0xa0]
lea rax, [rbp + 0x40]
sub rdi, rax
lea rcx, [rbp + 0x40]
mov rdx, r13
mov al, byte [rdi + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x18004faa5
mov rax, r14
lea r9, [rbp + 0x40]
add rdi, r13
lea r8, [rbp + 0x40]
cmp r14, r13
lea rcx, [rsp + 0x20]
mov edx, 1
cmovae rax, r13
sub r14, rax
call fcn.1800525a0
mov ebx, eax
test eax, eax
jne 0x18004fb67
test r14, r14
jne 0x18004fa9e
movsxd rax, esi
lea rcx, [rbp + 0x50]
add rcx, rax
lea rdx, [rbp + 0x40]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
inc byte [rbp + 0xa3]
add esi, r13d
cmp esi, 0x30
jl 0x18004fa7a
mov r8d, 0x100
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.180052a28
mov ebx, eax
test eax, eax
jne 0x18004fb67
mov rdi, r15
xor esi, esi
lea r9, [rbp + 0x70]
mov edx, 1
lea r8, [rbp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1800525a0
mov ebx, eax
test eax, eax
jne 0x18004fb67
mov r8, r13
lea rdx, [rbp + 0x70]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, r13
add esi, r13d
cmp esi, 0x30
jl 0x18004fb30
lea rcx, [rsp + 0x20]
call fcn.18005287c
mov edx, 0x1a0
lea rcx, [rbp + 0xa0]
call fcn.180053ed4
mov esi, 0x30
lea rcx, [rbp + 0x50]
mov edx, esi
call fcn.180053ed4
lea edx, [rsi - 0x10]
lea rcx, [rbp + 0x80]
call fcn.180053ed4
mov rdx, r13
lea rcx, [rbp + 0x40]
call fcn.180053ed4
test ebx, ebx
je 0x18004fbbb
mov edx, esi
mov rcx, r15
call fcn.180053ed4
mov eax, ebx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.180084a40
mov rbx, qword [rsp + 0x3a8]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004fbe8
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, rdx
lea rbp, [r11 - 0x58]
xor edx, edx
mov rdi, rcx
lea rcx, [r11 - 0x58]
lea r8d, [rdx + 0x30]
call sub.VCRUNTIME140.dll_memset
xor esi, esi
mov ecx, reloc.WS2_32.dll_recv
add byte [rdi + rcx - 1], 1
jne 0x18004fc3e
dec rcx
test rcx, rcx
jg 0x18004fc2f
mov r9, rbp
lea rcx, [rdi + 0x28]
mov r8, rdi
mov edx, 1
call fcn.1800525a0
mov ebx, eax
test eax, eax
jne 0x18004fcbd
add rbp, 0x10
add esi, 0x10
cmp esi, 0x30
jl 0x18004fc2a
xor edx, edx
lea rax, [rsp + 0x20]
sub r14, rax
lea rax, [rsp + 0x20]
add rax, rdx
add rdx, 0x10
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [r14 + rax]
pxor xmm1, xmm0
movdqu xmmword [rax], xmm1
cmp rdx, 0x30
jl 0x18004fc6e
mov r8d, 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x28]
call fcn.180052a28
mov ebx, eax
test eax, eax
jne 0x18004fcbd
lea r8d, [rax + 0x10]
mov rcx, rdi
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov edx, 0x30
lea rcx, [rsp + 0x20]
call fcn.180053ed4
mov eax, ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180084a40
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1800504c8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, r8
lea rdx, [0x18008e7f0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
jne 0x180050501
mov eax, 0xffffc200
jmp 0x1800505c9
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rbp, eax
mov rcx, rbx
cmp ebp, 0xffffffff
jne 0x18005052c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1800504f7
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
lea rdx, [rbp + 1]
mov qword [rdi], rbp
test rdx, rdx
je 0x1800505bb
mov ebp, 1
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov qword [rsi], rax
test rax, rax
je 0x1800505bb
mov r8, qword [rdi]
mov r9, rbx
mov edx, ebp
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, qword [rdi]
je 0x180050590
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, qword [rdi]
mov rcx, qword [rsi]
call fcn.180053ed4
mov rcx, qword [rsi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800504f7
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsi]
lea rdx, str._____BEGIN
mov rax, qword [rdi]
mov byte [rcx + rax], 0
mov rcx, qword [rsi]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x1800505b7
add qword [rdi], rbp
xor eax, eax
jmp 0x1800505c9
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, 0xffffc080
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800540a8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1800541c4
mov rdx, qword [rcx]
test rdx, rdx
je 0x1800541c4
cmp qword [rcx + 0x10], 0
je 0x1800541c4
movsxd rax, dword [rdx + 0x14]
cmp r8, rax
jbe 0x180054140
mov rcx, qword [rcx + 8]
call qword [rdx + 0x18]
mov edi, eax
test eax, eax
jne 0x1800541b1
mov rax, qword [rbx]
mov r8, rbp
mov rcx, qword [rbx + 8]
mov rdx, rsi
call qword [rax + 0x20]
mov edi, eax
test eax, eax
jne 0x1800541b1
mov rax, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jne 0x1800541b1
mov rdx, qword [rbx]
lea rsi, [rsp + 0x20]
movsxd rbp, dword [rdx + 0x10]
mov r14, qword [rbx + 0x10]
movsxd r8, dword [rdx + 0x14]
mov rcx, r14
mov edx, 0x36
lea rdi, [r8 + r14]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbx]
mov edx, 0x5c
mov rcx, rdi
movsxd r8, dword [rax + 0x14]
call sub.VCRUNTIME140.dll_memset
test rbp, rbp
je 0x18005418e
mov rcx, r14
sub rcx, rsi
sub rdi, rsi
mov al, byte [rsi]
xor byte [rcx + rsi], al
mov al, byte [rsi]
xor byte [rdi + rsi], al
inc rsi
sub rbp, 1
jne 0x18005417b
mov rax, qword [rbx]
mov rcx, qword [rbx + 8]
call qword [rax + 0x18]
mov edi, eax
test eax, eax
jne 0x1800541b1
mov rax, qword [rbx]
mov rdx, r14
mov rcx, qword [rbx + 8]
movsxd r8, dword [rax + 0x14]
call qword [rax + 0x20]
mov edi, eax
mov edx, 0x40
lea rcx, [rsp + 0x20]
call fcn.180053ed4
mov eax, edi
jmp 0x1800541c9
mov eax, 0xffffaf00
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180084a40
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180055068
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov rax, qword [rbp + 0x420]
mov esi, r9d
mov r15, qword [rbp + 0x438]
mov r13, rdx
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov rax, qword [rbp + 0x430]
mov qword [rsp + 0x60], rax
mov rax, qword [rbp + 0x440]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], r8
cmp r9d, 1
jne 0x1800550e4
cmp dword [rcx + 0x148], r9d
jne 0x1800552e5
mov rdi, qword [rcx + 8]
lea rax, [rdi - 0x10]
cmp rax, 0x3f0
ja 0x1800552e5
mov ecx, dword [rcx + 0x14c]
call fcn.180054208
mov r14, rax
test rax, rax
je 0x1800552e5
mov rcx, rax
call fcn.180053f88
movzx r12d, al
lea eax, [r12 + r12]
lea ecx, [rax + 2]
mov dword [rsp + 0x30], eax
cmp rcx, rdi
ja 0x1800552e5
mov rcx, rbx
test esi, esi
jne 0x180055144
lea r8, [rbp - 0x50]
mov rdx, r15
call fcn.180054f8c
jmp 0x18005515d
mov r8, qword [rsp + 0x50]
lea rax, [rbp - 0x50]
mov r9, r15
mov qword [rsp + 0x20], rax
mov rdx, r13
call fcn.180054b20
mov ebx, eax
test eax, eax
jne 0x1800552c4
lea rcx, [rsp + 0x38]
call fcn.1800607f4
xor r8d, r8d
lea rcx, [rsp + 0x38]
mov rdx, r14
call fcn.180054284
mov ebx, eax
test eax, eax
jne 0x1800552ba
mov rsi, r12
lea rax, [rsp + 0x38]
mov r15, rdi
mov qword [rsp + 0x20], rax
sub r15, r12
lea rcx, [rbp - 0x4f]
lea r12, [rbp - 0x4f]
mov rdx, rsi
add r12, rsi
mov r8, r12
lea r9, [r15 - 1]
call fcn.180056204
mov ebx, eax
test eax, eax
jne 0x1800552ba
lea rax, [rsp + 0x38]
mov r9, rsi
lea r8, [rbp - 0x4f]
mov qword [rsp + 0x20], rax
lea rdx, [r15 - 1]
mov rcx, r12
call fcn.180056204
mov ebx, eax
test eax, eax
jne 0x1800552ba
lea rcx, [rsp + 0x38]
call fcn.180053f30
mov r8, qword [rbp + 0x428]
lea r9, [rsp + 0x70]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call fcn.180053ef0
mov ebx, eax
test eax, eax
jne 0x1800552c4
mov r8b, byte [rbp - 0x50]
lea rdx, [rbp - 0x4f]
add rdx, rsi
xor ecx, ecx
test rsi, rsi
je 0x18005523c
mov al, byte [rsp + rcx + 0x70]
inc rcx
xor al, byte [rdx]
inc rdx
or r8b, al
cmp rcx, rsi
jb 0x180055228
mov eax, dword [rsp + 0x30]
mov r11, rdi
sub r11, rax
xor r10d, r10d
xor r9b, r9b
xor ecx, ecx
add r11, 0xfffffffffffffffe
je 0x180055274
or r9b, byte [rcx + rdx]
inc rcx
mov al, r9b
neg al
or al, r9b
not al
movzx eax, al
shr rax, 7
add r10, rax
cmp rcx, r11
jb 0x180055254
add rdx, r10
mov al, byte [rdx]
inc rdx
xor al, 1
or r8b, al
je 0x18005528a
mov ebx, 0xffffbf00
jmp 0x1800552c4
sub rdi, rdx
lea r8, [rbp - 0x50]
add r8, rdi
cmp r8, qword [rbp + 0x448]
jbe 0x1800552a4
mov ebx, 0xffffbc00
jmp 0x1800552c4
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov qword [rax], r8
call sub.VCRUNTIME140.dll_memcpy
xor ebx, ebx
jmp 0x1800552c4
lea rcx, [rsp + 0x38]
call fcn.180053f30
mov edx, 0x400
lea rcx, [rbp - 0x50]
call fcn.180053ed4
mov edx, 0x40
lea rcx, [rsp + 0x70]
call fcn.180053ed4
mov eax, ebx
jmp 0x1800552ea
mov eax, 0xffffbf80
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.180084a40
mov rbx, qword [rsp + 0x518]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180055a1c
Capabilities:
Encode data using xor

Disassembly:
mov r10d, dword [rcx + 0x148]
test r10d, r10d
je 0x180054b19
cmp r10d, 1
je 0x180054b14
mov eax, 0xffffbf00
ret
jmp 0x180055e10
jmp 0x180055a1c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, qword [rcx + 8]
xor esi, esi
mov r15d, r9d
mov r12, r8
mov r13, rdx
mov r14, rcx
lea ebx, [rsi + 1]
cmp r9d, ebx
jne 0x180055a64
cmp dword [rcx + 0x148], esi
je 0x180055a64
mov eax, 0xffffbf80
jmp 0x180055b60
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rdi, rax
test rax, rax
je 0x180055b27
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rsi, rax
test rax, rax
je 0x180055b27
mov r8, qword [rsp + 0x90]
mov r9, rbp
mov edx, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.180056574
mov ebx, eax
test eax, eax
jne 0x180055b2c
mov rcx, r14
test r15d, r15d
jne 0x180055ad7
mov rdx, qword [rsp + 0x98]
mov r8, rdi
call fcn.180054f8c
jmp 0x180055aef
mov r9, qword [rsp + 0x98]
mov r8, r12
mov rdx, r13
mov qword [rsp + 0x20], rdi
call fcn.180054b20
mov ebx, eax
test eax, eax
jne 0x180055b2c
xor dl, dl
test rbp, rbp
je 0x180055b19
mov r8, rsi
mov rcx, rdi
sub r8, rdi
mov r9, rbp
mov al, byte [r8 + rcx]
xor al, byte [rcx]
inc rcx
or dl, al
sub r9, 1
jne 0x180055b08
movzx ebx, dl
test dl, dl
je 0x180055b2c
mov ebx, 0xffffbc80
jmp 0x180055b2c
mov ebx, 0xfffffff0
test rdi, rdi
je 0x180055b45
mov rdx, rbp
mov rcx, rdi
call fcn.180053ed4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rsi, rsi
je 0x180055b5e
mov rdx, rbp
mov rcx, rsi
call fcn.180053ed4
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
sub rsp, 0x58
mov eax, dword [rcx + 0x14c]
test eax, eax
mov r11d, dword [rsp + 0x80]
mov r10d, r11d
cmovne r10d, eax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
or dword [rsp + 0x40], 0xffffffff
mov rax, qword [rsp + 0x90]
mov dword [rsp + 0x38], r10d
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r11d
call fcn.180055e6c
add rsp, 0x58
ret
Function at 0x180056204
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, qword [rsp + 0xe0]
mov r12, r8
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r13, r9
lea r8d, [rbx + 0x40]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea r8d, [rbx + 4]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [r14]
call fcn.180053f88
movzx eax, al
test rsi, rsi
je 0x1800562eb
mov r15d, eax
cmp rsi, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rsi
call fcn.1800542fc
mov ebx, eax
test eax, eax
jne 0x1800562eb
mov r8, r13
mov rdx, r12
mov rcx, r14
call fcn.180054318
mov ebx, eax
test eax, eax
jne 0x1800562eb
lea r8d, [rax + 4]
mov rcx, r14
lea rdx, [rsp + 0x20]
call fcn.180054318
mov ebx, eax
test eax, eax
jne 0x1800562eb
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.180053f14
mov ebx, eax
test eax, eax
jne 0x1800562eb
xor ecx, ecx
test rdi, rdi
je 0x1800562e2
mov al, byte [rsp + rcx + 0x30]
inc rcx
xor byte [rbp], al
inc rbp
cmp rcx, rdi
jb 0x1800562d0
inc byte [rsp + 0x23]
sub rsi, rdi
jne 0x180056273
mov edx, 0x40
lea rcx, [rsp + 0x30]
call fcn.180053ed4
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180084a40
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x18005b088
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov bpl, r8b
mov rdi, rdx
lea r8, [rdx + 1]
mov r13, r9
xor edx, edx
mov r14, rcx
call sub.VCRUNTIME140.dll_memset
xor esi, esi
mov ebx, esi
test rdi, rdi
je 0x18005b0fa
movzx r12d, bpl
mov rbp, rsi
test r12, r12
je 0x18005b0f2
mov r15, rbx
mov rdx, r15
mov rcx, r13
call fcn.180058374
mov rcx, rbp
add r15, rdi
shl al, cl
inc rbp
or byte [rbx + r14], al
cmp rbp, r12
jb 0x18005b0d3
inc rbx
cmp rbx, rdi
jb 0x18005b0c8
cmp rdi, 1
jb 0x18005b144
movzx ecx, byte [r14]
lea r10, [r14 + 1]
mov r9b, byte [r10]
mov r8d, 1
xor r9b, sil
and sil, byte [r10]
mov al, r9b
and al, 1
sub r8b, al
movzx eax, r8b
imul ecx, eax
mov al, r9b
shl r8b, 7
or byte [r14], r8b
lea r14, [r10]
and al, cl
xor r9b, cl
or sil, al
mov byte [r10], r9b
sub rdi, 1
jne 0x18005b100
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180060634
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [0x180090730]
mov rcx, rbx
test rdi, rdi
je 0x180060686
cmp qword [0x180090730], 0
je 0x180060686
mov r8, qword [rdi + 8]
cmp qword [rcx + 8], r8
jne 0x180060674
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rcx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180060681
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jmp 0x180060658
mov rax, rbx
jmp 0x180060688
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800606f4
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [0x180090500]
mov rcx, rbx
test rdi, rdi
je 0x180060746
cmp qword [0x180090500], 0
je 0x180060746
mov r8, qword [rdi + 8]
cmp qword [rcx + 8], r8
jne 0x180060734
mov rdx, qword [rdi + 0x10]
mov rcx, qword [rcx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180060741
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jmp 0x180060718
mov rax, rbx
jmp 0x180060748
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18006136c
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc8
mov rax, qword [0x1800c33b0]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov r15, qword [rbp + 0x87]
mov rdi, rcx
mov rcx, qword [rcx]
mov rsi, r9
mov qword [rsp + 0x28], r9
mov r13, r8
mov r12, rdx
call fcn.180053f88
xor edx, edx
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x24]
mov bl, al
lea r8d, [rdx + 4]
call sub.VCRUNTIME140.dll_memset
mov r14d, dword [rbp + 0x7f]
mov byte [rsp + 0x27], 1
test r14d, r14d
je 0x1800614f6
mov r8, r13
mov rdx, r12
mov rcx, rdi
call fcn.1800540a8
test eax, eax
jne 0x1800614f8
mov r8, qword [rbp + 0x6f]
mov rdx, rsi
mov rcx, rdi
call fcn.1800541e4
test eax, eax
jne 0x1800614f8
lea r8d, [rax + 4]
mov rcx, rdi
lea rdx, [rsp + 0x24]
call fcn.1800541e4
test eax, eax
jne 0x1800614f8
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.180053f94
test eax, eax
jne 0x1800614f8
movzx ebx, bl
lea rdx, [rsp + 0x30]
mov r8d, ebx
lea rcx, [rbp - 0x51]
call sub.VCRUNTIME140.dll_memcpy
mov esi, 1
cmp dword [rbp + 0x77], esi
jbe 0x1800614ab
mov r8, r13
mov rdx, r12
mov rcx, rdi
call fcn.1800540a8
test eax, eax
jne 0x1800614f8
mov r8, rbx
lea rdx, [rbp - 0x51]
mov rcx, rdi
call fcn.1800541e4
test eax, eax
jne 0x1800614f8
lea rdx, [rbp - 0x51]
mov rcx, rdi
call fcn.180053f94
test eax, eax
jne 0x1800614f8
xor ecx, ecx
test rbx, rbx
je 0x1800614a4
mov al, byte [rbp + rcx - 0x51]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, rbx
jl 0x180061494
inc esi
cmp esi, dword [rbp + 0x77]
jb 0x180061454
movzx eax, byte [rsp + 0x20]
lea rdx, [rsp + 0x30]
cmp r14d, eax
mov rcx, r15
cmovb eax, r14d
mov r8d, eax
mov ebx, eax
call sub.VCRUNTIME140.dll_memcpy
sub r14d, ebx
mov edx, 4
add r15, rbx
lea eax, [rdx - 1]
add byte [rsp + rax + 0x24], 1
jne 0x1800614e3
add edx, 0xffffffff
jne 0x1800614d4
test r14d, r14d
je 0x1800614f6
mov bl, byte [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp 0x1800613db
xor eax, eax
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.180084a40
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180062834
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
and qword [rcx], 0
and qword [rcx + 8], 0
test edx, edx
jne 0x1800628af
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
jmp 0x18006291b
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx + 0x10], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x18], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x20], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x28], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x30], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x38], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x40], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x48], rax
xor eax, eax
mov dword [rcx + 0xd0], edx
ret
Function at 0x180064ca0
Capabilities:
Hash data using sha1

Disassembly:
and dword [rcx], 0
xor eax, eax
and dword [rcx + 4], 0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
ret

Function at 0x180065974
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
mov r11, qword [rsp + 0x30]
mov rbx, r9
xor r9d, r9d
xor edi, edi
xor r10d, r10d
mov rsi, r8
mov r8, rdx
mov rbp, rcx
test r11, r11
je 0x180065b25
lea r15, [0x180092760]
xor ecx, ecx
jmp 0x1800659c2
cmp byte [r10 + rbx], 0x20
jne 0x1800659c7
inc r10
inc ecx
cmp r10, r11
jb 0x1800659b6
cmp r10, r11
je 0x180065a3a
mov rax, r11
sub rax, r10
cmp rax, 2
jb 0x1800659e7
cmp byte [r10 + rbx], 0xd
jne 0x1800659e7
cmp byte [r10 + rbx + 1], 0xa
je 0x180065a2e
mov al, byte [r10 + rbx]
cmp al, 0xa
je 0x180065a2e
test ecx, ecx
jne 0x180065b14
cmp al, 0x3d
jne 0x180065a06
inc edi
cmp edi, 2
ja 0x180065b14
cmp al, 0x7f
ja 0x180065b14
movzx eax, al
cmp byte [rax + r15], 0x7f
je 0x180065b14
cmp byte [rax + r15], 0x40
jae 0x180065a2b
test edi, edi
jne 0x180065b14
inc r9
inc r10
cmp r10, r11
jb 0x1800659b2
test r9, r9
je 0x180065b25
mov rax, r9
shr r9, 3
and eax, 7
lea rax, [rax + rax*2]
lea rcx, [rax*2 + 7]
shr rcx, 3
lea rax, [r9 + r9*2]
lea rdx, [rcx + rax*2]
mov eax, edi
sub rdx, rax
test rbp, rbp
je 0x180065b1b
cmp r8, rdx
jb 0x180065b1b
xor r8d, r8d
xor r11d, r11d
mov r9d, 3
mov rdx, rbp
test r10, r10
je 0x180065b0c
cmp byte [rbx], 0x20
ja 0x180065aa8
movzx eax, byte [rbx]
movabs rcx, 0x100002400
bt rcx, rax
jb 0x180065b03
movzx eax, byte [rbx]
movzx ecx, byte [rax + r15]
xor eax, eax
cmp cl, 0x40
sete al
and ecx, 0x3f
sub r9d, eax
inc r11
mov eax, r8d
mov r8d, ecx
shl eax, 6
or r8d, eax
cmp r11, 4
jne 0x180065b03
xor r11d, r11d
test r9d, r9d
je 0x180065ae6
mov eax, r8d
shr eax, 0x10
mov byte [rdx], al
inc rdx
cmp r9d, 1
jbe 0x180065af7
mov eax, r8d
shr eax, 8
mov byte [rdx], al
inc rdx
cmp r9d, 2
jbe 0x180065b03
mov byte [rdx], r8b
inc rdx
inc rbx
sub r10, 1
jne 0x180065a90
sub rdx, rbp
mov qword [rsi], rdx
jmp 0x180065b29
mov eax, 0xffffffd4
jmp 0x180065b2b
mov qword [rsi], rdx
mov eax, 0xffffffd6
jmp 0x180065b2b
and qword [rsi], 0
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r15
ret
Function at 0x1800687ec
Capabilities:
Encode data using add xor sub operations
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rcx]
mov r10, rcx
mov ebx, dword [rcx + 4]
test rdx, rdx
je 0x180068840
sub r8, r9
lea eax, [r11 + 1]
movzx r11d, al
movzx ecx, byte [r11 + r10 + 8]
lea eax, [rcx + rbx]
movzx ebx, al
movzx eax, byte [rbx + r10 + 8]
mov byte [r11 + r10 + 8], al
mov byte [rbx + r10 + 8], cl
add cl, al
movzx eax, cl
mov cl, byte [rax + r10 + 8]
xor cl, byte [r8 + r9]
mov byte [r9], cl
inc r9
sub rdx, 1
jne 0x180068802
mov dword [r10 + 4], ebx
xor eax, eax
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret