joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006292c
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x40
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
mov r8d, 3
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
test rax, rax
je 0x1800629b2
cmp rax, 0xffffffffffffffff
je 0x1800629c6
and dword [rsp + 0x60], 0
and dword [rsp + 0x58], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov r8d, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1800629b2
cmp dword [rsp + 0x58], 4
jne 0x1800629b2
cmp dword [rsp + 0x60], 0x21726152
jne 0x1800629b2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1800629c8
cmp rbx, 0xffffffffffffffff
je 0x1800629c6
test rbx, rbx
je 0x1800629c6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1800629d0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x8148
call fcn.180082cd0
sub rsp, rax
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x8130], rax
mov r12d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rcx
lea rcx, str.unrar64.dll
call fcn.1800627cc
mov rdi, rax
xor r13d, r13d
cmp rax, r13
jne 0x180062a2e
mov eax, 0x453
jmp 0x180062c03
lea rdx, str.RAROpenArchiveEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800bf778], rax
lea rdx, str.RARCloseArchive
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800bf780], rax
lea rdx, str.RARReadHeaderEx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800bf788], rax
lea rdx, str.RARProcessFileW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800bf790], rax
lea rdx, str.RARSetPassword
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800bf798], rax
mov rdi, qword [0x1800bf778]
cmp rdi, r13
je 0x180062bfe
cmp qword [0x1800bf780], r13
je 0x180062bfe
cmp qword [0x1800bf788], r13
je 0x180062bfe
cmp qword [0x1800bf790], r13
je 0x180062bfe
cmp rax, r13
je 0x180062bfe
mov qword [rsp + 0x80], r13
xor edx, edx
mov r8d, 0xa8
lea rcx, [rsp + 0x88]
call fcn.1800729a0
mov qword [rsp + 0x88], rbx
lea rax, [rsp + 0x130]
mov qword [rsp + 0xc4], rax
mov dword [rsp + 0xa0], 0x4000
mov dword [rsp + 0x90], r12d
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xb8], r13
lea rcx, [rsp + 0x80]
call rdi
mov rbx, rax
mov eax, dword [rsp + 0x94]
cmp eax, r13d
jne 0x180062c03
cmp rsi, r13
je 0x180062bf6
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], r13
mov word [rsp + 0x28], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.180006960
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.1800215c0
nop
cmp qword [rax + 0x20], 0x10
jb 0x180062bb1
mov rdx, qword [rax + 8]
jmp 0x180062bb5
lea rdx, [rax + 8]
mov rcx, rbx
call qword [0x1800bf798]
nop
cmp qword [rsp + 0x68], 0x10
jb 0x180062bd1
mov rcx, qword [rsp + 0x50]
call fcn.18006e998
mov qword [rsp + 0x68], socket
mov qword [rsp + 0x60], r13
mov byte [rsp + 0x50], r13b
cmp qword [rsp + 0x40], 8
jb 0x180062bf6
mov rcx, qword [rsp + 0x28]
call fcn.18006e998
mov qword [rbp], rbx
xor eax, eax
jmp 0x180062c03
mov eax, 0x454
mov rcx, qword [rsp + 0x8130]
xor rcx, rsp
call fcn.18006e130
add rsp, 0x8148
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180063748
Capabilities:
Check if file exists
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x30]
mov rdi, qword [rcx]
mov r12, rcx
mov rbx, qword [rax]
mov ebp, 1
mov rsi, qword [r12 + 0x30]
test rdi, rdi
je 0x180063783
cmp rdi, qword [r12]
je 0x180063788
call fcn.18006e940
cmp rbx, rsi
je 0x180063890
test rdi, rdi
jne 0x1800637a0
call fcn.18006e940
xor r11d, r11d
jmp 0x1800637a3
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x1800637ae
call fcn.18006e940
cmp qword [rbx + 0x60], 8
jb 0x1800637bb
mov rcx, qword [rbx + 0x48]
jmp 0x1800637bf
lea rcx, [rbx + 0x48]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x180063838
test rdi, rdi
jne 0x1800637d8
call fcn.18006e940
xor r11d, r11d
jmp 0x1800637db
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x1800637e6
call fcn.18006e940
cmp qword [rbx + 0x38], 8
jb 0x1800637f3
mov rsi, qword [rbx + 0x20]
jmp 0x1800637f7
lea rsi, [rbx + 0x20]
test rdi, rdi
jne 0x180063806
call fcn.18006e940
xor r11d, r11d
jmp 0x180063809
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x180063814
call fcn.18006e940
cmp qword [rbx + 0x60], 8
jb 0x180063821
mov rcx, qword [rbx + 0x48]
jmp 0x180063825
lea rcx, [rbx + 0x48]
mov r8d, 1
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x18006383a
xor ebp, ebp
test rdi, rdi
jne 0x180063844
call fcn.18006e940
cmp byte [rbx + 0x69], 0
je 0x180063854
call fcn.18006e940
jmp 0x180063773
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x69], 0
jne 0x18006386f
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], 0
je 0x18006385e
jmp 0x180063773
mov rax, qword [rbx + 8]
jmp 0x180063882
cmp rbx, qword [rax + 0x10]
jne 0x180063888
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], 0
je 0x180063875
mov rbx, rax
jmp 0x180063773
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r12
ret
Function at 0x1800638b0
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x100
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebp, ebp
cmp eax, ebp
jne 0x1800638fe
mov eax, 0x44f
jmp 0x180063b01
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
cmp eax, ebp
jne 0x180063915
mov eax, 0x450
jmp 0x180063b01
mov rcx, rbx
call fcn.18006292c
cmp eax, ebp
je 0x180063937
xor r9d, r9d
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.180062dbc
jmp 0x180063b01
mov ecx, 8
call fcn.18006ea94
cmp rax, rbp
je 0x180063953
lea rcx, [rsp + 0x80]
mov qword [rax], rcx
jmp 0x180063956
mov rax, rbp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x80]
call fcn.180036100
mov qword [rsp + 0xb0], rax
mov byte [rax + 0x69], 1
mov rax, qword [rsp + 0xb0]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0xb0]
mov qword [rax], rax
mov rax, qword [rsp + 0xb0]
mov qword [rax + 0x10], rax
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0x20], rdi
mov r9, rbx
lea r8, [0x18009a8f0]
lea rdx, str.__s__x___s___r__o__s___y
lea rcx, [rsp + 0xc8]
call fcn.180033ea8
nop
mov edi, 7
cmp rsi, rbp
je 0x180063a57
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x60], bp
lea r8d, [rdi - 4]
lea rdx, [0x18009a8f8]
lea rcx, [rsp + 0x58]
call fcn.180006960
nop
mov r8, rsi
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.18000aec0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.180006720
nop
cmp qword [rsp + 0x50], 8
jb 0x180063a36
mov rcx, qword [rsp + 0x38]
call fcn.18006e998
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
cmp qword [rsp + 0x78], 8
jb 0x180063a57
mov rcx, qword [rsp + 0x60]
call fcn.18006e998
mov qword [rsp + 0x50], socket
mov qword [rsp + 0x48], rbp
mov byte [rsp + 0x38], bpl
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
lea rdx, [rsp + 0x30]
call fcn.180062874
mov ebx, eax
cmp qword [rsp + 0x50], 0x10
jb 0x180063aa2
mov rcx, qword [rsp + 0x38]
call fcn.18006e998
cmp ebx, ebp
je 0x180063ab4
lea rcx, [rsp + 0x80]
call fcn.180063748
nop
cmp qword [rsp + 0xe8], 8
jb 0x180063acc
mov rcx, qword [rsp + 0xd0]
call fcn.18006e998
mov qword [rsp + 0xe8], rdi
mov qword [rsp + 0xe0], rbp
mov word [rsp + 0xd0], bp
lea rcx, [rsp + 0x80]
call fcn.1800358a4
nop
mov rcx, qword [rsp + 0x80]
call fcn.18006e998
mov eax, ebx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.18006e130
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x180063c2c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rdx, rcx
lea r9, str..________.dirty
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.180031410
mov r11, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [r11]
mov rsi, qword [rsp + 0x50]
test rdi, rdi
je 0x180063c73
cmp rdi, qword [rsp + 0x20]
je 0x180063c78
call fcn.18006e940
cmp rbx, rsi
je 0x180063d08
test rdi, rdi
jne 0x180063c90
call fcn.18006e940
xor r11d, r11d
jmp 0x180063c93
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x30]
jne 0x180063c9e
call fcn.18006e940
cmp qword [rbx + 0x38], 8
jb 0x180063cab
mov rcx, qword [rbx + 0x20]
jmp 0x180063caf
lea rcx, [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test rdi, rdi
jne 0x180063cbf
call fcn.18006e940
cmp byte [rbx + 0x41], 0
je 0x180063ccc
call fcn.18006e940
jmp 0x180063c62
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x41], 0
jne 0x180063ce7
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x41], 0
je 0x180063cd6
jmp 0x180063c62
mov rax, qword [rbx + 8]
jmp 0x180063cfa
cmp rbx, qword [rax + 0x10]
jne 0x180063d00
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x41], 0
je 0x180063ced
mov rbx, rax
jmp 0x180063c62
lea rcx, [rsp + 0x20]
call fcn.1800042b0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1800643fc
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, r8
mov rsi, rdx
lea rcx, [rsp + 0x52]
xor edi, edi
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x50], di
call fcn.1800729a0
lea rcx, [rsp + 0x50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, str.drivers
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call fcn.180063c2c
lea rcx, [rsp + 0x50]
mov rdx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, edi
jne 0x1800644a7
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x18006452f
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.180031f88
cmp eax, edi
jne 0x18006452f
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, edi
jne 0x18006452f
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.180063bec
cmp qword [rsp + 0x40], 8
lea rdx, [rsp + 0x28]
cmovae rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, edi
je 0x180064518
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
neg eax
sbb edi, edi
not edi
and edi, 8
jmp 0x18006451d
mov edi, 9
cmp qword [rsp + 0x40], 8
jb 0x18006452f
mov rcx, qword [rsp + 0x28]
call fcn.18006e998
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18006e130
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18006496c
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
sub rsp, 0x50
and dword [rsp + 0x30], 0
mov rsi, rdx
mov rbx, rcx
xor eax, eax
lea rdx, [rsp + 0x34]
mov rcx, rsi
mov rdi, r8
mov dword [rsp + 0x34], eax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, 0x1000
mov dword [rsp + 0x30], eax
cmp qword [rsp + 0x30], r13
jb 0x180064b13
and dword [rsp + 0x88], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x4c], 0
mov r12d, 1
lea r8, [rsp + 0x4c]
xor edx, edx
mov rcx, rsi
mov r9d, r12d
mov qword [rsp + 0x38], rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x48], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, r13d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180064af0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rdi, rdi
je 0x180064a32
mov eax, dword [rbx + 8]
mov dword [rdi], eax
movabs rax, 0x706c646f70bfbbef
cmp qword [rbx], rax
jne 0x180064af0
cmp dword [rbx + 8], 2
je 0x180064a55
cmp dword [rbx + 8], 3
jne 0x180064af0
mov ecx, dword [rbx + 0x18c]
mov edx, 0x190
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov eax, ecx
shr eax, 0x10
xor byte [rdx + rbx], al
add rdx, r12
cmp rdx, r13
jl 0x180064a60
cmp byte [rbx + 0x4a3], 0
jne 0x180064ac7
cmp dword [rbx + 0x1a0], 0x40
ja 0x180064ac7
mov eax, 0x270f
cmp word [rbx + 0x190], ax
ja 0x180064ac7
movzx eax, word [rbx + 0x192]
cmp ax, r12w
jb 0x180064ac7
cmp ax, 0xc
ja 0x180064ac7
movzx eax, word [rbx + 0x196]
cmp ax, r12w
jb 0x180064ac7
cmp ax, 0x1f
ja 0x180064ac7
mov ebx, r12d
jmp 0x180064ac9
xor ebx, ebx
cmp dword [rsp + 0x40], 0
jne 0x180064aec
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
xor r9d, r9d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, ebx
jmp 0x180064b15
cmp dword [rsp + 0x40], 0
jne 0x180064b13
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x4c]
xor r9d, r9d
mov dword [rsp + 0x40], r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r13
pop r12
pop rdi
ret
Function at 0x18006a050
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x18006a0be
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x18006a08a
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.18006a1c4
mov edi, dword [rbx + 0x18]
lea r14, [0x1800bc2e0]
jmp 0x18006a119
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18006a0d8
add r11, 4
sub r8, 1
jne 0x18006a0d5
mov edx, edi
mov rcx, rbx
call fcn.18006a1c4
mov rcx, rbx
call fcn.18006a304
mov rcx, rbx
dec edi
call fcn.18006a27c
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x18006a0d5
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18006a134
add r11, 4
sub r8, 1
jne 0x18006a131
xor edx, edx
mov rcx, rbx
call fcn.18006a1c4
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x18006a1a8
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x18006a177
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18006a1c4
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x18006a1de
inc rdx
add rcx, r11
sub r10, 1
jne 0x18006a1d8
repz ret
Function at 0x18006b080
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1800ba080]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x18006b272
lea rdi, [0x180099bc0]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18006b106
cmp cl, r14b
je 0x18006b0f1
cmp cl, r14b
je 0x18006b272
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18006b125
cmp bpl, r14b
je 0x18006b10f
cmp bpl, r14b
je 0x18006b272
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.180034f44
jmp 0x18006b157
lea rdi, [0x180099bc0]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x18006b236
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x18006b178
cmp dil, r14b
je 0x18006b150
cmp dil, r14b
je 0x18006b272
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180034f44
lea rdx, [0x180099bc0]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x18006b1fa
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x18006b1c8
cmp cl, r14b
je 0x18006b1ac
cmp cl, r14b
je 0x18006b272
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180034f44
cmp rsi, r13
lea rdi, [0x180099bc0]
jb 0x18006b0f1
jmp 0x18006b272
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180004de0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18006b231
mov rcx, qword [rsp + 0x38]
call fcn.18006e998
mov rax, rbx
jmp 0x18006b2ac
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180004de0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18006b26d
mov rcx, qword [rsp + 0x38]
call fcn.18006e998
mov rax, rbx
jmp 0x18006b2ac
mov qword [rbx + 0x20], sendto
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180004de0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18006b2a9
mov rcx, qword [rsp + 0x38]
call fcn.18006e998
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18006e130
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18006d698
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
xor r11d, r11d
mov rdi, rcx
mov dword [rsp], 0x2ac3268c
mov dword [rsp + 4], 0x33747d9a
mov dword [rsp + 8], 0xd1de98ac
mov dword [rsp + 0xc], 0x6eee320c
lea ebx, [r11 + 0x20]
lea rsi, [0x180000000]
mov r9d, dword [r11 + rsi + 0x999b0]
xor r9d, dword [rsp + r11 + 4]
xor r9d, dword [rsp + r11 + 0xc]
xor r9d, dword [rsp + r11 + 8]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + rsi + 0x998a0]
movzx eax, cl
movzx ecx, byte [rax + rsi + 0x998a0]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + rsi + 0x998a0]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + rsi + 0x998a0]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
rol ecx, 0xd
ror eax, 9
xor ecx, eax
xor ecx, dword [rsp + r11]
xor ecx, r10d
mov dword [rsp + r11 + 0x10], ecx
mov dword [r11 + rdi], ecx
add r11, 4
sub rbx, 1
jne 0x18006d6da
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x18006d788
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0xb0
mov rbp, rcx
mov rdi, r8
mov rbx, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x90
call fcn.1800729a0
movzx eax, byte [rbx + 1]
movzx r11d, byte [rbx]
movzx ecx, byte [rbx + 4]
shl r11d, 8
mov esi, 0x20
shl ecx, 8
or r11d, eax
movzx eax, byte [rbx + 2]
shl r11d, 8
lea r12, [0x1800998a0]
or r11d, eax
movzx eax, byte [rbx + 3]
shl r11d, 8
or r11d, eax
movzx eax, byte [rbx + 5]
or ecx, eax
movzx eax, byte [rbx + 6]
mov dword [rsp + 0x20], r11d
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
mov dword [rsp + 0x24], ecx
movzx ecx, byte [rbx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
mov dword [rsp + 0x28], ecx
movzx ecx, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xf]
lea rbx, [rsp + 0x28]
shl ecx, 8
or ecx, eax
lea rax, [rsp + 0x28]
sub rbp, rax
mov dword [rsp + 0x2c], ecx
mov r9d, dword [rbx + rbp]
xor r9d, dword [rbx - 4]
xor r9d, dword [rbx]
add rbx, 4
xor r9d, dword [rbx]
mov eax, r9d
mov ecx, r9d
mov edx, r9d
shr ecx, 0x10
shr eax, 0x18
shr edx, 8
movzx eax, al
movzx r10d, byte [rax + r12]
movzx eax, cl
movzx ecx, byte [rax + r12]
shl r10d, 8
movzx eax, dl
movzx edx, byte [rax + r12]
or r10d, ecx
movzx eax, r9b
movzx r9d, byte [rax + r12]
shl r10d, 8
or r10d, edx
shl r10d, 8
or r10d, r9d
mov ecx, r10d
mov eax, r10d
ror ecx, 0xe
rol eax, 0xa
xor ecx, eax
mov eax, r10d
ror eax, 8
xor ecx, eax
mov eax, r10d
rol eax, 2
xor ecx, eax
xor ecx, dword [rbx - 0xc]
xor ecx, r10d
sub rsi, 1
mov dword [rbx + 4], ecx
jne 0x18006d86b
mov ecx, dword [rsp + 0xac]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov eax, ecx
shr eax, 0x18
mov byte [rdi], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 2], cl
mov ecx, dword [rsp + 0xa8]
mov byte [rdi + 1], al
mov al, byte [rsp + 0xac]
mov byte [rdi + 3], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 4], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 6], cl
mov ecx, dword [rsp + 0xa4]
mov byte [rdi + 5], al
mov al, byte [rsp + 0xa8]
mov byte [rdi + 7], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 8], al
mov eax, ecx
shr ecx, 8
shr eax, 0x10
mov byte [rdi + 0xa], cl
mov ecx, dword [rsp + 0xa0]
mov byte [rdi + 9], al
mov al, byte [rsp + 0xa4]
mov byte [rdi + 0xb], al
mov eax, ecx
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ecx
shr eax, 0x10
shr ecx, 8
mov byte [rdi + 0xd], al
mov al, byte [rsp + 0xa0]
mov byte [rdi + 0xe], cl
mov byte [rdi + 0xf], al
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret