joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180198c1d
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
push rdx
call fcn.180198980
mov r8, qword [rsp]
cmp eax, 0
jne 0x180198e1d
mov r14d, dword [r8 + 0xf0]
xor rdi, rdi
lea rcx, [rdi + r14*4]
mov rsi, r8
lea rdi, [r8 + rcx*4]
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
lea rsi, [rsi + 0x10]
lea rdi, [rdi - 0x10]
cmp rdi, rsi
jne 0x180198c58
lea rax, [0x18019a000]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov rbp, qword [rax + 0x38]
mov r15, r8
sub r14d, 1
nop
lea r15, [r15 + 0x10]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov r9, rsi
mov r12, rsi
and r9, rax
and r12, rcx
mov rbx, r9
mov rdx, r12
shr r9, 7
lea r8, [rax + rax]
shr r12, 7
lea r11, [rcx + rcx]
sub rbx, r9
sub rdx, r12
and r8, rdi
and r11, rdi
and rbx, rbp
and rdx, rbp
xor r8, rbx
xor r11, rdx
mov r10, rsi
mov r13, rsi
and r10, r8
and r13, r11
mov rbx, r10
mov rdx, r13
shr r10, 7
lea r9, [r8 + r8]
shr r13, 7
lea r12, [r11 + r11]
sub rbx, r10
sub rdx, r13
and r9, rdi
and r12, rdi
and rbx, rbp
and rdx, rbp
xor r9, rbx
xor r12, rdx
mov r10, rsi
mov r13, rsi
and r10, r9
and r13, r12
mov rbx, r10
mov rdx, r13
shr r10, 7
xor r8, rax
shr r13, 7
xor r11, rcx
sub rbx, r10
sub rdx, r13
lea r10, [r9 + r9]
lea r13, [r12 + r12]
xor r9, rax
xor r12, rcx
and r10, rdi
and r13, rdi
and rbx, rbp
and rdx, rbp
xor r10, rbx
xor r13, rdx
xor rax, r10
xor rcx, r13
xor r8, r10
xor r11, r13
mov rbx, rax
mov rdx, rcx
xor r9, r10
shr rbx, 0x20
xor r12, r13
shr rdx, 0x20
xor r10, r8
rol eax, 8
xor r13, r11
rol ecx, 8
xor r10, r9
rol ebx, 8
xor r13, r12
rol edx, 8
xor eax, r10d
shr r10, 0x20
xor ecx, r13d
shr r13, 0x20
xor ebx, r10d
xor edx, r13d
mov r10, r8
rol r8d, 0x18
mov r13, r11
rol r11d, 0x18
shr r10, 0x20
xor eax, r8d
shr r13, 0x20
xor ecx, r11d
rol r10d, 0x18
mov r8, r9
rol r13d, 0x18
mov r11, r12
shr r8, 0x20
xor ebx, r10d
shr r11, 0x20
xor edx, r13d
rol r9d, 0x10
rol r12d, 0x10
rol r8d, 0x10
xor eax, r9d
rol r11d, 0x10
xor ecx, r12d
xor ebx, r8d
xor edx, r11d
mov dword [r15], eax
mov dword [r15 + 4], ebx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], edx
sub r14d, 1
jne 0x180198c9c
xor rax, rax
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x18019d140
Capabilities:
Encode data using xor

Disassembly:
lea r11, [0x18019ef00]
movdqu xmm7, xmmword [rcx]
lea rcx, [rcx + 0x10]
movdqa xmm0, xmmword [r11]
movdqa xmm1, xmmword [r11 + 0x10]
movdqa xmm2, xmmword [r11 + 0x20]
movdqa xmm3, xmmword [r11 + 0x30]
movdqa xmm4, xmmword [r11 + 0x40]
pcmpeqd xmm5, xmm5
movdqu xmm6, xmmword [rcx]
movdqa xmmword [rax], xmm7
lea rax, [rax + 0x10]
dec r10d
jmp 0x18019d190
pshufb xmm6, xmm4
movdqa xmm8, xmm0
movdqa xmm9, xmm1
pand xmm8, xmm6
pand xmm9, xmm6
movdqa xmm10, xmm2
pcmpeqb xmm8, xmm0
psllq xmm0, 4
movdqa xmm11, xmm3
pcmpeqb xmm9, xmm1
psllq xmm1, 4
pand xmm10, xmm6
pand xmm11, xmm6
movdqa xmm12, xmm0
pcmpeqb xmm10, xmm2
psllq xmm2, 4
movdqa xmm13, xmm1
pcmpeqb xmm11, xmm3
psllq xmm3, 4
movdqa xmm14, xmm2
movdqa xmm15, xmm3
pxor xmm8, xmm5
pxor xmm9, xmm5
pand xmm12, xmm6
pand xmm13, xmm6
movdqa xmmword [rax], xmm8
pcmpeqb xmm12, xmm0
psrlq xmm0, 4
movdqa xmmword [rax + 0x10], xmm9
pcmpeqb xmm13, xmm1
psrlq xmm1, 4
lea rcx, [rcx + 0x10]
pand xmm14, xmm6
pand xmm15, xmm6
movdqa xmmword [rax + 0x20], xmm10
pcmpeqb xmm14, xmm2
psrlq xmm2, 4
movdqa xmmword [rax + 0x30], xmm11
pcmpeqb xmm15, xmm3
psrlq xmm3, 4
movdqu xmm6, xmmword [rcx]
pxor xmm13, xmm5
pxor xmm14, xmm5
movdqa xmmword [rax + 0x40], xmm12
movdqa xmmword [rax + 0x50], xmm13
movdqa xmmword [rax + 0x60], xmm14
movdqa xmmword [rax + 0x70], xmm15
lea rax, [rax + 0x80]
dec r10d
jne 0x18019d190
movdqa xmm7, xmmword [r11 + 0x50]
repz ret

Function at 0x18019f360
Capabilities:
Encode data using xor

Disassembly:
xor rax, rax
xor r10, r10
cmp r8, 0
je 0x18019f389
mov r10b, byte [rcx]
lea rcx, [rcx + 1]
xor r10b, byte [rdx]
lea rdx, [rdx + 1]
or al, r10b
dec r8
jne 0x18019f36c
neg rax
shr rax, 0x3f
repz ret
Function at 0x18019f590
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18019f6ed
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r13
push r14
mov eax, 0x20
call fcn.18014c9d0
sub rsp, rax
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x48], r12
mov r12, qword [rsp + 0x68]
mov r10, r14
mov r13, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
cmp r8, 0x10
jb 0x18019f638
mov qword [rsp + 0x40], rsi
mov rsi, r8
shr rsi, 4
mov rax, rsi
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop
mov r8, rbx
sub r10, rbp
mov rcx, rbp
sub r8, rbp
mov edx, 2
mov rax, qword [r10 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r8 + rcx - 8], rax
jne 0x18019f601
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
add rbx, 0x10
add rbp, 0x10
dec rsi
jne 0x18019f5f0
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x18019f6c7
mov rdx, r10
mov r9, rbx
xor r8d, r8d
sub rdx, rbp
sub r9, rbp
mov rcx, rbp
cmp r8, rdi
jae 0x18019f672
movzx eax, byte [rdx + rcx]
inc r8
inc rcx
xor al, byte [rcx - 1]
mov byte [r9 + rcx - 1], al
cmp r8, 0x10
jb 0x18019f653
jmp 0x18019f6a0
cmp r8, 0x10
jae 0x18019f6a0
mov edx, reloc.WS2_32.dll_recv
sub r10, rbx
lea rcx, [r8 + rbx]
sub rdx, r8
nop word [rax + rax]
movzx eax, byte [r10 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x18019f690
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
cmp rdi, 0x10
jbe 0x18019f6c7
add rbx, 0x10
add rbp, 0x10
sub rdi, 0x10
jne 0x18019f641
mov rax, qword [r10]
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov qword [r14], rax
mov rax, qword [r10 + 8]
mov qword [r14 + 8], rax
add rsp, 0x20
pop r14
pop r13
pop rdi
repz ret
Function at 0x18019f6f9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18019f8f6
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x48
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x40], r12
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp rcx, rdx
je 0x18019f7b0
mov r12, r13
cmp rbx, 0x10
jb 0x18019f79d
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop word [rax + rax]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call r15
mov r11, qword [r12]
add rsi, 0x10
xor qword [rsi - 0x10], r11
mov rax, qword [r12 + 8]
mov r12, rdi
xor qword [rsi - 8], rax
add rdi, 0x10
dec rbp
jne 0x18019f770
mov rax, qword [r12]
mov qword [r13], rax
mov rax, qword [r12 + 8]
mov qword [r13 + 8], rax
jmp 0x18019f814
cmp rbx, 0x10
jb 0x18019f814
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
mov r11, qword [rdi]
mov rax, qword [r13]
xor rax, qword [rsp + 0x20]
add rsi, 0x10
add rdi, 0x10
mov qword [rsi - 0x10], rax
mov rax, qword [r13 + 8]
mov qword [r13], r11
mov rcx, qword [rdi - 8]
xor rax, qword [rsp + 0x28]
dec rbp
mov qword [rsi - 8], rax
mov qword [r13 + 8], rcx
jne 0x18019f7d0
test rbx, rbx
je 0x18019f8cf
lea rax, [rsp + 0x20]
mov rbp, r13
lea r12, [rsp + 0x20]
sub rbp, rax
lea rax, [rsp + 0x20]
sub rsi, rax
neg r12
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
xor r11d, r11d
lea r9, [r12 + rdi]
cmp r11, rbx
jae 0x18019f888
movzx ecx, byte [rsp + r11 + 0x20]
lea rax, [r9 + r11]
lea rdx, [r11 + rbp]
movzx r8d, byte [rsp + rax + 0x20]
xor cl, byte [rsp + rdx + 0x20]
lea rax, [rsi + r11]
inc r11
mov byte [rsp + rax + 0x20], cl
mov byte [rsp + rdx + 0x20], r8b
cmp r11, 0x10
jb 0x18019f855
cmp rbx, 0x10
jbe 0x18019f89e
add rdi, 0x10
add rsi, 0x10
sub rbx, 0x10
jne 0x18019f840
jmp 0x18019f8cf
cmp r11, 0x10
jae 0x18019f8cf
mov edx, reloc.WS2_32.dll_recv
sub rdi, r13
lea rcx, [r13 + r11]
sub rdx, r11
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x18019f8c0
mov rbp, qword [rsp + 0x90]
mov r12, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180146c80
add rsp, 0x48
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
repz ret
Function at 0x18019f900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov eax, gethostname
call fcn.18014c9d0
sub rsp, rax
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x28], r15
mov ebx, dword [rsi]
mov r10, r9
mov rdi, r8
mov r12, rdx
mov r13, rcx
test ebx, ebx
je 0x18019f967
test rdi, rdi
je 0x18019f967
mov eax, ebx
inc r12
inc r13
movzx ecx, byte [rax + r14]
dec rdi
xor cl, byte [r13 - 1]
inc ebx
and ebx, 0xf
mov byte [r12 - 1], cl
jne 0x18019f942
mov r9, qword [rsp + 0xa0]
movsxd r15, ebx
cmp rdi, 0x10
jb 0x18019fa30
mov rsi, r12
mov rcx, rdi
mov qword [rsp + 0x30], rbp
shr rcx, 4
mov rbp, r13
sub rsi, r14
mov rax, rcx
sub rbp, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
add r12, rax
add r13, rax
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x78], r12
mov r12, rcx
mov r8, r13
mov rdx, r14
mov rcx, r14
call r9
cmp ebx, 0x10
jae 0x18019f9f7
mov edx, send
lea rcx, [r15 + r14]
sub edx, ebx
shr edx, 3
inc edx
mov rax, qword [rcx + rbp]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [rsi + rcx - 8], rax
jne 0x18019f9e1
mov r9, qword [rsp + 0xa0]
add rsi, 0x10
add rbp, 0x10
xor ebx, ebx
xor r15d, r15d
dec r12
jne 0x18019f9c0
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r10, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
test rdi, rdi
je 0x18019fa75
mov r8, r10
mov rdx, r14
mov rcx, r14
call r9
movsxd rcx, ebx
sub r13, r14
add rcx, r14
sub r12, r14
add ebx, edi
nop word [rax + rax]
movzx eax, byte [rcx + r13]
inc rcx
xor al, byte [rcx - 1]
dec rdi
mov byte [rcx + r12 - 1], al
jne 0x18019fa60
mov dword [rsi], ebx
add rsp, 0x38
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1801a0060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x50
call fcn.18014c9d0
sub rsp, rax
mov r14, qword [rsp + 0xb8]
mov rbp, rdx
mov rdx, qword [rsp + 0xc0]
mov edi, dword [rdx]
mov r10, r9
mov rbx, r8
mov r12, rcx
test edi, edi
je 0x1801a00c4
nop
test rbx, rbx
je 0x1801a00c4
mov eax, edi
inc rbp
inc r12
movzx ecx, byte [rax + r14]
dec rbx
xor cl, byte [r12 - 1]
inc edi
and edi, 0xf
mov byte [rbp - 1], cl
jne 0x1801a00a0
mov r9, qword [rsp + 0xc8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x48], r15
mov esi, 1
cmp rbx, r13
jb 0x1801a01fd
mov rax, qword [rsp + 0xb0]
mov rcx, rbx
xor edi, edi
add rax, r13
shr rcx, 4
mov r14, rbp
mov qword [rsp + 0x30], rax
mov r15, r12
mov rax, rcx
mov dword [rsp + 0x20], edi
mov rdi, qword [rsp + 0xb8]
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
mov rax, rcx
sub r14, rdi
shl rax, 4
sub r15, rdi
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x30]
add rbp, rax
add r12, rax
mov qword [rsp + 0x90], r12
mov r12, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rbp
mov rbp, rcx
nop word [rax + rax]
mov r8, r10
mov rdx, rdi
mov rcx, r12
call r9
mov r11d, r13d
mov ecx, esi
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r11d
jne 0x1801a0180
mov rcx, rdi
lea edx, [r11 + 2]
nop word [rax + rax]
mov rax, qword [r15 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r14 + rcx - 8], rax
jne 0x1801a01a0
mov r9, qword [rsp + 0xc8]
mov r10, qword [rsp + 0xa8]
add r14, r13
add r15, r13
dec rbp
jne 0x1801a0160
mov rbx, qword [rsp + 0xa0]
mov edi, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov r14, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
test rbx, rbx
je 0x1801a0262
mov r15, qword [rsp + 0xb0]
mov r8, r10
mov rdx, r14
mov rcx, r15
call r9
lea rcx, [r15 + 0x10]
nop word [rax + rax]
movzx eax, byte [rcx - 1]
dec rcx
add esi, eax
mov byte [rcx], sil
shr esi, 8
dec r13d
jne 0x1801a0220
movsxd rcx, edi
sub r12, r14
sub rbp, r14
add rcx, r14
add edi, ebx
movzx eax, byte [rcx + r12]
inc rcx
xor al, byte [rcx - 1]
dec rbx
mov byte [rcx + rbp - 1], al
jne 0x1801a0242
mov rax, qword [rsp + 0xc0]
mov dword [rax], edi
jmp 0x1801a0264
mov dword [rdx], edi
mov r15, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801a0280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.18014c9d0
sub rsp, rax
mov rbx, r8
mov r8, qword [rsp + 0xb0]
mov rbp, rdx
mov edi, dword [r8]
mov r12, rcx
mov dword [rsp + 0x30], edi
test edi, edi
je 0x1801a02ed
mov rdx, qword [rsp + 0xa8]
test rbx, rbx
je 0x1801a02e9
mov eax, edi
inc rbp
inc r12
movzx ecx, byte [rax + rdx]
dec rbx
xor cl, byte [r12 - 1]
inc edi
and edi, 0xf
mov byte [rbp - 1], cl
jne 0x1801a02c6
mov dword [rsp + 0x30], edi
mov rcx, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov esi, 1
mov r14d, dword [rcx + 0xc]
lea r13, [rcx + 0xc]
lea r15d, [rsi + 0xb]
bswap r14d
cmp rbx, 0x10
jb 0x1801a03e2
mov eax, 0x10000000
mov edi, r14d
nop word [rax + rax]
mov r14, rbx
shr r14, 4
cmp r14, rax
cmova r14, rax
add edi, r14d
mov eax, edi
cmp rax, r14
jae 0x1801a034d
sub r14, rax
xor edi, edi
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rdx, rbp
mov rcx, r12
call r10
mov r11d, edi
bswap r11d
mov dword [r13], r11d
test edi, edi
jne 0x1801a0393
mov r8d, r15d
mov ecx, esi
mov rdx, r13
nop word [rax + rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r8d
jne 0x1801a0380
mov rcx, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
shl r14, 4
mov eax, 0x10000000
sub rbx, r14
add rbp, r14
add r12, r14
cmp rbx, 0x10
jae 0x1801a0330
mov r8, qword [rsp + 0xb0]
mov dword [rsp + 0x90], edi
mov edi, dword [rsp + 0x30]
mov r14d, dword [rsp + 0x90]
test rbx, rbx
je 0x1801a0470
mov rax, qword [rsp + 0xa8]
xor edx, edx
mov qword [rsp + 0x20], rcx
mov qword [rax], rdx
mov qword [rax + 8], rdx
mov rdx, rax
mov r8, rsi
mov rcx, rax
call r10
inc r14d
bswap r14d
mov dword [r13], r14d
jne 0x1801a0436
nop dword [rax]
movzx eax, byte [r13 - 1]
dec r13
add esi, eax
mov byte [r13], sil
shr esi, 8
dec r15d
jne 0x1801a0420
mov rdx, qword [rsp + 0xa8]
movsxd rcx, edi
add rcx, rdx
sub r12, rdx
sub rbp, rdx
add edi, ebx
nop dword [rax]
movzx eax, byte [r12 + rcx]
inc rcx
xor al, byte [rcx - 1]
dec rbx
mov byte [rcx + rbp - 1], al
jne 0x1801a0450
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x1801a0473
mov dword [r8], edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801a12c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1801a13e0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1801a1320
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1801a1320
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1801a1320
Function at 0x1801a47a0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.18014c9d0
sub rsp, rax
cmp dword [0x1803c9e30], 0
jne 0x1801a490d
lea rcx, str.OPENSSL_ia32cap
mov qword [rsp + 0x38], rbx
mov dword [0x1803c9e30], 1
mov qword [rsp + 0x48], rsi
call fcn.180161c94
mov rbx, rax
test rax, rax
je 0x1801a48e1
mov qword [rsp + 0x40], rbp
xor esi, esi
cmp byte [rax], 0x7e
mov ebp, esi
sete bpl
mov qword [rsp + 0x20], rdi
movsxd rdi, ebp
lea r8, [rsp + 0x30]
lea rdx, str._I64i
add rdi, rax
mov rcx, rdi
call fcn.1802a8d8c
test eax, eax
jne 0x1801a482f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.180161b20
mov edi, eax
mov qword [rsp + 0x30], rdi
jmp 0x1801a4834
mov rdi, qword [rsp + 0x30]
test ebp, ebp
mov rbp, qword [rsp + 0x40]
je 0x1801a486d
lea rcx, [0x1803cbf00]
call fcn.18019f130
mov rcx, rdi
not rcx
and rax, rcx
mov qword [rsp + 0x30], rax
bt rdi, 0x18
jae 0x1801a4883
movabs rcx, 0xedfff7fdffffffff
and rax, rcx
jmp 0x1801a487e
cmp byte [rbx], 0x3a
jne 0x1801a4883
lea rcx, [0x1803cbf00]
call fcn.18019f130
mov qword [rsp + 0x30], rax
mov edx, 0x3a
mov rcx, rbx
call fcn.180167428
mov rdi, qword [rsp + 0x20]
test rax, rax
je 0x1801a48d4
inc rax
cmp byte [rax], 0x7e
sete sil
xor r8d, r8d
xor edx, edx
movsxd rcx, esi
add rcx, rax
call fcn.180161b20
test esi, esi
je 0x1801a48c7
not eax
and dword [0x1803cbf08], eax
mov rax, qword [rsp + 0x30]
jmp 0x1801a48ed
mov dword [0x1803cbf08], eax
mov rax, qword [rsp + 0x30]
jmp 0x1801a48ed
mov rax, qword [rsp + 0x30]
mov dword [0x1803cbf08], esi
jmp 0x1801a48ed
lea rcx, [0x1803cbf00]
call fcn.18019f130
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
mov ecx, eax
bts ecx, 0xa
shr rax, 0x20
mov dword [0x1803cbf04], eax
mov dword [0x1803cbf00], ecx
add rsp, 0x28
ret
Function at 0x1801a53f0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x1801a5448
movzx eax, byte [rcx]
test al, al
je 0x1801a5448
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x1801a5410
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret

Function at 0x1801a58a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
mov eax, 0x20
call fcn.18014c9d0
sub rsp, rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [rbx], eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x1801a58d0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18014c9d0
sub rsp, rax
mov ecx, dword [rcx]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1801a58f0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18014c9d0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1801b1150
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, gethostbyname
call fcn.18014c9d0
sub rsp, rax
mov r14, rdx
mov r13, r8
mov rbp, rcx
mov r15d, 0x20
lea rdx, str.enginese_capi.c
mov r8d, 0x5bd
mov ecx, r15d
mov r12d, r9d
call fcn.1801a04c0
mov rsi, rax
test rax, rax
jne 0x1801b11ad
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
mov qword [rsp + 0x68], rdi
cmp r12d, 1
jne 0x1801b11f3
cmp dword [0x1803ca4ec], 0
je 0x1801b11f3
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov rax, r13
sub r8, r13
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1801b11e4
add rax, 2
test ecx, ecx
jne 0x1801b11d0
test edx, edx
jne 0x1801b11f3
lea r13, str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
lea r12d, [rdx + 0x18]
mov qword [rsp + 0x60], rbx
test rbp, rbp
je 0x1801b1264
cmp dword [rbp], 2
jl 0x1801b1264
cmp qword [rbp + 8], 0
je 0x1801b1264
mov rcx, r14
call fcn.1801afcb0
mov rcx, r13
mov rdi, rax
call fcn.1801afcb0
lea rdx, str.capi_get_key__contname_s__provname_s__type_d_n
mov r8, rdi
mov rcx, rbp
mov r9, rax
mov rbx, rax
mov dword [rsp + 0x20], r12d
call fcn.1801afc10
lea rdx, str.enginese_capi.c
mov r8d, 0x5cf
mov rcx, rbx
call fcn.1801a0590
lea rdx, str.enginese_capi.c
mov r8d, 0x5d0
mov rcx, rdi
call fcn.1801a0590
test dword [rbp + 0x38], 0x20000
mov eax, 0
lea rcx, [rsi + 8]
cmovne eax, r15d
mov r9d, r12d
mov r8, r13
mov rdx, r14
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1801b12c9
mov eax, dword [0x1803ca4e8]
test eax, eax
jne 0x1801b12a4
call fcn.18018f5b0
mov dword [0x1803ca4e8], eax
mov edx, 0x67
lea r9, str.enginese_capi.c
mov ecx, eax
mov r8d, edx
mov dword [rsp + 0x20], 0x5d6
call fcn.18018f910
call fcn.1801b06f0
jmp 0x1801b1329
mov ebx, dword [rsp + 0x80]
mov rcx, qword [rsi + 8]
lea r8, [rsi + 0x10]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetUserKey]
test eax, eax
jne 0x1801b1342
mov eax, dword [0x1803ca4e8]
test eax, eax
jne 0x1801b12f9
call fcn.18018f5b0
mov dword [0x1803ca4e8], eax
mov edx, 0x67
lea r9, str.enginese_capi.c
mov ecx, eax
lea r8d, [rdx + 0xa]
mov dword [rsp + 0x20], 0x5db
call fcn.18018f910
call fcn.1801b06f0
mov rcx, qword [rsi + 8]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea rdx, str.enginese_capi.c
mov r8d, 0x5e5
mov rcx, rsi
call fcn.1801a0590
xor eax, eax
jmp 0x1801b134f
mov dword [rsi + 0x18], ebx
mov qword [rsi], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x1801b4fb0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.18014c9d0
sub rsp, rax
lea rcx, str.OPENSSL_CONF
call fcn.180161c94
test rax, rax
je 0x1801b4fe7
lea rdx, str.cryptoconfconf_mod.c
mov r8d, 0x1e3
mov rcx, rax
add rsp, 0x28
jmp fcn.1801a59a0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
call fcn.1801cfbf0
xor ecx, ecx
mov r11, rax
mov eax, ecx
cmp byte [r11], al
je 0x1801b5013
cmp eax, 0x80000000
jae 0x1801b5013
inc r11
inc eax
cmp byte [r11], cl
jne 0x1801b5002
btr eax, 0x1f
lea rdx, str.openssl.cnf
inc eax
cmp ecx, 0x80000000
jae 0x1801b5032
inc rdx
inc ecx
cmp byte [rdx], 0
jne 0x1801b5020
btr ecx, 0x1f
lea rdx, str.cryptoconfconf_mod.c
mov r8d, 0x1eb
add eax, ecx
inc eax
movsxd rdi, eax
mov rcx, rdi
call fcn.1801a04c0
mov rbx, rax
test rax, rax
jne 0x1801b5069
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
call fcn.1801cfbf0
mov r8, rdi
mov rcx, rbx
mov rdx, rax
call fcn.1801a5af0
lea rdx, [0x1803121d0]
mov r8, rdi
mov rcx, rbx
call fcn.1801a5b50
lea rdx, str.openssl.cnf
mov r8, rdi
mov rcx, rbx
call fcn.1801a5b50
mov rdi, qword [rsp + 0x20]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret