joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180205060
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov dword [rsp + 0x40], 0
mov rbp, rdx
mov rbx, rcx
mov rcx, rdi
lea rdx, str.WWW_Authenticate:
mov r8d, reloc.WS2_32.dll_recvfrom
call sym.gcm64.dll_curl_strnequal
test eax, eax
je 0x1802050ac
mov esi, dword [rbx + 0x158]
cmp esi, 0x191
je 0x1802050d3
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.Proxy_authenticate:
mov rcx, rdi
call sym.gcm64.dll_curl_strnequal
test eax, eax
je 0x180205119
mov esi, dword [rbx + 0x158]
cmp esi, 0x197
jne 0x180205119
mov rcx, rdi
call fcn.1801d8bf0
mov rdi, rax
test rax, rax
jne 0x1802050eb
lea eax, [rdi + 0x1b]
jmp 0x18020528a
cmp esi, 0x197
mov r8, rdi
mov rcx, rbx
sete dl
call fcn.1801da8d0
mov rcx, rdi
mov ebx, eax
call qword [fcn.18020f174]
test ebx, ebx
je 0x180205288
mov eax, ebx
jmp 0x18020528a
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Content_Length:
mov rcx, rdi
call sym.gcm64.dll_curl_strnequal
test eax, eax
je 0x180205174
mov r8d, dword [rbx + 0x158]
lea eax, [r8 - 0xc8]
cmp eax, 0x64
jae 0x180205159
lea rdx, str.Ignoring_Content_Length_in_CONNECT__03d_response
mov rcx, rbx
call fcn.1801cdd00
jmp 0x180205288
xor edx, edx
lea r9, [rbp + 0x298]
lea rcx, [rdi + 0xf]
lea r8d, [rdx + 0xa]
call fcn.1801e0510
jmp 0x180205288
lea r9, str.close
mov qword [rsp + 0x20], 5
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.Connection:
mov rcx, rdi
call fcn.1801d8b10
test al, al
jne 0x180205253
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Transfer_Encoding:
mov rcx, rdi
call sym.gcm64.dll_curl_strnequal
test eax, eax
je 0x18020522a
mov r8d, dword [rbx + 0x158]
lea eax, [r8 - 0xc8]
cmp eax, 0x64
jae 0x1802051e1
lea rdx, str.Ignoring_Transfer_Encoding_in_CONNECT__03d_response
mov rcx, rbx
call fcn.1801cdd00
jmp 0x180205288
lea r9, str.chunked
mov qword [rsp + 0x20], 7
mov r8d, reloc.WS2_32.dll_select
lea rdx, str.Transfer_Encoding:
mov rcx, rdi
call fcn.1801d8b10
test al, al
je 0x180205288
lea rdx, str.CONNECT_responded_chunked
mov rcx, rbx
call fcn.1801cdd00
mov rcx, rbx
mov byte [rbp + 0x2a4], 1
call fcn.180200570
jmp 0x180205288
lea r9, str.close
mov qword [rsp + 0x20], 5
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.Proxy_Connection:
mov rcx, rdi
call fcn.1801d8b10
test al, al
je 0x18020525c
mov byte [rbp + 0x2a5], 1
jmp 0x180205288
lea r9, [rbx + 0x158]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, str.HTTP_1._d__d
call fcn.1801c1a20
cmp eax, 2
jne 0x180205288
mov eax, dword [rbx + 0x158]
mov dword [rbx + 0x1394], eax
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18020a630
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1802100c8]
mov rdi, rax
test rax, rax
jne 0x18020a672
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x18020a6b5
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov ebp, dword [rbx + 0x20]
mov rcx, qword [rdi + 8]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x18020a712
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x18020a6d0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x18020a753
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x180409180]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x180409181]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x18020a720
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x18023095c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18023097c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180213f2c
or eax, 0xffffffff
jmp 0x18023097e
xor eax, eax
add rsp, 0x28
ret

Function at 0x180231ef4
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180231d94
call fcn.180213f9c
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.18020ef14
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180231d7c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180231d7c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x180231dc6
lock or dword [rax + 0x14], 0x10
jmp 0x180231d7c
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180231de3
mov rcx, qword [rbp + 0x10]
call fcn.180235fac
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.18022a2a4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1802317cc
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x180231e3a
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x180231d7c
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x180231ea6
mov rcx, qword [rbp + 0x10]
call fcn.18022a2a4
cmp eax, 0xffffffff
je 0x180231e8d
mov rcx, qword [rbp + 0x10]
call fcn.18022a2a4
cmp eax, 0xfffffffe
je 0x180231e8d
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.18022a2a4
movsxd rdi, eax
lea rsi, [0x1805191d0]
mov rcx, rbx
sar rdi, 6
call fcn.18022a2a4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x180231e94
lea rax, [0x1804a7790]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180231ea6
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x180231edc
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x180231ed8
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x180231ed8
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x180231d7f
jmp 0x180231d4c
Function at 0x180231f40
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x180231f1d
call fcn.180213f9c
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.18020ef14
or eax, 0xffffffff
jmp 0x180231f3a
sub dword [rcx + 0x10], 1
jns 0x180231f2c
add rsp, 0x28
jmp fcn.180231ef4
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x180231efc
Function at 0x180252cc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1800b8100
sub rsp, rax
lea rdx, [rsp + 0x38]
mov rbx, rcx
call fcn.180252bb0
test rax, rax
je 0x180252d89
cmp dword [rsp + 0x38], 0
jg 0x180252d89
cmp dword [rsp + 0x3c], 0
jg 0x180252d89
mov rcx, qword [rbx + 0x98]
movzx eax, word [rcx + 0x1bc]
add ax, ax
mov word [rcx + 0x1bc], ax
mov rax, qword [rbx + 0x98]
cmp word [rax + 0x1bc], 0x3c
jbe 0x180252d30
mov ecx, reloc.WLDAP32.dll_Ordinal_60
mov word [rax + 0x1bc], cx
mov rcx, rbx
call fcn.1802530b0
mov rcx, rbx
call fcn.180252790
test eax, eax
jns 0x180252d4d
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov rax, qword [rbx + 0x98]
inc dword [rax + 0x1a8]
mov rax, qword [rbx + 0x98]
cmp dword [rax + 0x1a8], 2
jbe 0x180252d74
mov dword [rax + 0x1a8], 1
mov rcx, rbx
call fcn.1802530b0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1802557d0
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1802553c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, Ordinal_50
call fcn.1800b8100
sub rsp, rax
mov edi, edx
mov rbx, rcx
test edx, edx
jle 0x18025540c
lea r9, str.ssl_statem_statem_dtls.c
mov dword [rsp + 0x20], 0x3bc
mov edx, 0x153
lea ecx, [rax - 0x1c]
lea r8d, [rax + 0x14]
call fcn.180277f00
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call fcn.180252da0
test eax, eax
je 0x180255436
mov rcx, rbx
call fcn.180242f10
mov rcx, rbx
test eax, eax
jne 0x180255443
call fcn.1803080c0
mov rcx, rax
mov edx, 1
call fcn.180268110
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.180252cc0
Function at 0x1802609f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xc0
call fcn.1800b8100
sub rsp, rax
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov eax, dword [rdx + 8]
xor r12d, r12d
mov dword [rsp + 0x20], eax
mov r13, rdx
sub eax, r8d
mov edi, r8d
mov rsi, rcx
mov qword [rsp + 0x28], rcx
mov ebp, r12d
mov dword [rsp + 0x24], eax
cmp dword [rdx + 0xc], r8d
jae 0x180260a60
mov r8d, 0x4d6
lea rdx, [0x18041caa8]
lea rcx, str.assertion_failed:_rec__orig_len___md_size
call fcn.1800d8330
cmp edi, 0x40
jbe 0x180260a7e
mov r8d, 0x4d7
lea rdx, [0x18041caa8]
lea rcx, str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.1800d8330
mov ecx, dword [r13 + 0xc]
lea rax, [rsp + 0x30]
neg rax
lea r14, [rsp + 0x30]
and eax, 0x3f
add r14, rax
lea eax, [rdi + 0x100]
cmp ecx, eax
jbe 0x180260aa9
mov ebp, ecx
sub ebp, edi
sub ebp, 0x100
mov r8, rdi
xor edx, edx
mov rcx, r14
mov ebx, r12d
mov r15, rdi
call fcn.18020d410
mov r10d, dword [r13 + 0xc]
mov r9d, r12d
cmp ebp, r10d
jae 0x180260b56
mov esi, dword [rsp + 0x20]
mov r11d, esi
mov r15, qword [r13 + 0x18]
neg r11d
mov r13d, dword [rsp + 0x24]
nop
mov eax, ebp
lea ecx, [r11 + rbp]
xor ecx, esi
xor eax, r13d
lea r8d, [rax - 1]
not eax
shr eax, 0x1f
shr r8d, 0x1f
and r8d, eax
mov eax, ebp
xor eax, esi
neg r8d
or ecx, eax
or r12d, r8d
xor ecx, ebp
mov eax, ebp
shr ecx, 0x1f
and r8d, r9d
neg ecx
or ebx, r8d
and r12d, ecx
inc ebp
movzx edx, byte [rax + r15]
movzx eax, r12b
mov ecx, r9d
and al, dl
inc r9d
or byte [rcx + r14], al
mov ecx, r9d
sub ecx, edi
mov eax, edi
xor ecx, edi
xor eax, r9d
or ecx, eax
xor ecx, r9d
shr ecx, 0x1f
neg ecx
and r9d, ecx
cmp ebp, r10d
jb 0x180260ae0
mov rsi, qword [rsp + 0x28]
mov r15, rdi
test edi, edi
je 0x180260b96
nop word [rax + rax]
mov ecx, ebx
lea rsi, [rsi + 1]
mov eax, ebx
inc ebx
xor rax, 0x20
movzx eax, byte [rax + r14]
movzx eax, byte [rcx + r14]
mov ecx, ebx
sub ecx, edi
mov byte [rsi - 1], al
xor ecx, edi
mov eax, edi
xor eax, ebx
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
and ebx, ecx
sub r15, 1
jne 0x180260b60
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800b80c0
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180261800
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov eax, Ordinal_41
call fcn.1800b8100
sub rsp, rax
mov rax, qword [rcx + 8]
lea esi, [r9 + 1]
mov rbx, rdx
mov r10, rcx
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x68], 1
je 0x180261857
mov edx, dword [rdx + 8]
lea eax, [rsi + r8]
cmp eax, edx
jbe 0x180261840
xor eax, eax
add rsp, 0x28
pop rsi
pop rbx
ret
mov eax, r8d
sub edx, r8d
add qword [rbx + 0x18], rax
add qword [rbx + 0x20], rax
sub dword [rbx + 0xc], r8d
mov dword [rbx + 8], edx
jmp 0x18026185c
cmp esi, dword [rdx + 8]
ja 0x180261837
mov ecx, dword [rbx + 8]
mov rax, qword [rbx + 0x18]
dec ecx
mov qword [rsp + 0x20], rdi
movzx edi, byte [rcx + rax]
mov rcx, qword [r10 + 0x110]
call fcn.180264340
mov rcx, rax
call fcn.180281c40
bt eax, 0x15
jae 0x1802618a1
or eax, 0xffffffff
sub eax, edi
mov rdi, qword [rsp + 0x20]
add dword [rbx + 8], eax
mov eax, 1
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10d, dword [rbx + 8]
lea ecx, [rdi + rsi]
mov esi, 0x100
mov r8d, r10d
sub r8d, ecx
mov eax, r10d
xor r8d, ecx
xor eax, ecx
or r8d, eax
xor r8d, r10d
shr r8d, 0x1f
dec r8d
cmp r10d, esi
cmovb esi, r10d
xor r9d, r9d
test esi, esi
je 0x18026192f
mov r11d, edi
mov qword [rsp + 0x48], rbp
mov rbp, qword [rbx + 0x18]
shr r11d, 0x1f
nop word [rax + rax]
mov eax, r9d
mov ecx, edi
sub ecx, r9d
shr eax, 0x1f
shr ecx, 0x1f
xor cl, al
xor al, r11b
or cl, al
mov eax, r10d
sub eax, r9d
xor cl, r11b
dec cl
dec eax
movzx edx, cl
inc r9d
movzx ecx, byte [rax + rbp]
xor ecx, edi
and edx, ecx
not edx
and r8d, edx
cmp r9d, esi
jb 0x1802618f0
mov rbp, qword [rsp + 0x48]
not r8d
movzx eax, r8b
lea ecx, [rax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
lea eax, [rdi + 1]
mov rdi, qword [rsp + 0x20]
neg ecx
and eax, ecx
sub r10d, eax
mov dword [rbx + 8], r10d
mov dword [rsp + 0x58], ecx
not ecx
mov dword [rsp + 0x40], ecx
mov ecx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x40]
and ecx, 1
or eax, ecx
add rsp, 0x28
pop rsi
pop rbx
ret
Function at 0x18027e650
Capabilities:
Set thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.1800b8100
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x180285980
Capabilities:
Get thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.1800b8100
sub rsp, rax
lea rcx, [0x18051b618]
add rsp, 0x28
jmp fcn.18027e4d0
Function at 0x18029b620
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.1800b8100
sub rsp, rax
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor edi, edi
movsxd rsi, r8d
mov rbp, r9
mov r14, rdx
mov rbx, rcx
mov eax, edi
test r9, r9
je 0x18029b686
cmp r9, qword [rcx]
je 0x18029b67c
test rdx, rdx
je 0x18029b869
test r8d, r8d
js 0x18029b869
mov eax, 1
mov qword [rcx], r9
jmp 0x18029b692
mov rbp, qword [rcx]
test rbp, rbp
je 0x18029b869
test r14, r14
je 0x18029b764
mov rcx, rbp
mov qword [rsp + 0xb0], r15
call fcn.180282110
mov r15d, eax
cmp eax, 0x80
jle 0x18029b6ce
mov r8d, Ordinal_41
lea rdx, str.cryptohmachmac.c
lea rcx, str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.1800d8330
cmp r15d, esi
mov r15, qword [rsp + 0xb0]
jge 0x18029b720
mov rcx, qword [rbx + 8]
mov r8, r12
mov rdx, rbp
call fcn.18026ee60
test eax, eax
je 0x18029b719
mov rcx, qword [rbx + 8]
mov r8, rsi
mov rdx, r14
call fcn.18026f0d0
test eax, eax
je 0x18029b719
mov rcx, qword [rbx + 8]
lea r14, [rbx + 0x20]
mov r8, r14
lea rdx, [rbx + 0x24]
call fcn.18026ed80
test eax, eax
jne 0x18029b73e
xor eax, eax
jmp 0x18029b869
cmp esi, 0x80
ja 0x18029b719
mov r8, rsi
lea rcx, [rbx + 0x24]
mov rdx, r14
call fcn.18020cf10
lea r14, [rbx + 0x20]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x18029b76c
mov eax, ecx
mov r8d, 0x80
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.18020d410
jmp 0x18029b76c
test eax, eax
je 0x18029b84f
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, rdi
lea rsi, [rax + 0x24]
lea r14, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x18029b790
mov rcx, qword [rbx + 0x10]
mov r8, r12
mov rdx, rbp
call fcn.18026ee60
test eax, eax
je 0x18029b719
mov rcx, rbp
call fcn.180282110
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.18026f0d0
test eax, eax
je 0x18029b719
nop
lea rcx, [rsp + 0x20]
add rcx, rdi
add rdi, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdi, 0x80
jl 0x18029b7f0
mov rcx, qword [rbx + 0x18]
mov r8, r12
mov rdx, rbp
call fcn.18026ee60
test eax, eax
je 0x18029b719
mov rcx, rbp
call fcn.180282110
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.18026f0d0
test eax, eax
je 0x18029b719
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.18026f130
test eax, eax
je 0x18029b719
mov eax, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1802c8860
Capabilities:
Encode data using base64

Disassembly:
xor r10d, r10d
test r8d, r8d
jle 0x1802c8953
lea r9, [rdx + 1]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r8d, 3
jl 0x1802c88db
movzx eax, byte [r9]
movzx edx, byte [r9 - 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [r9 + 1]
shl rdx, 8
or rdx, rax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
mov rax, rdx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 2], al
add rcx, 3
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx], al
jmp 0x1802c8934
movzx edx, byte [r9 - 1]
shl edx, 0x10
cmp r8d, 2
jne 0x1802c88f2
movzx eax, byte [r9]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
cmp r8d, 1
jne 0x1802c891e
lea eax, [r8 + 0x3c]
jmp 0x1802c892a
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx + 2], al
add rcx, 3
mov byte [rcx], 0x3d
add r10d, 4
add r9, 3
sub r8d, 3
inc rcx
test r8d, r8d
jg 0x1802c8877
mov byte [rcx], 0
mov eax, r10d
ret
mov byte [rcx], r10b
mov eax, r10d
ret
Function at 0x1802cd280
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x40
call fcn.1800b8100
sub rsp, rax
cmp dword [rsp + 0x70], 2
mov rdi, r8
movsxd rbp, r9d
mov r14, rcx
je 0x1802cd310
test rdx, rdx
je 0x1802cd2fc
mov r9, rdx
xor r8d, r8d
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.1802b34c0
cmp dword [rsp + 0x30], 0xffffffff
je 0x1802cd2fc
mov dword [rsp + 0x20], Ordinal_50
mov ecx, reloc.WS2_32.dll_recv
lea r9, str.cryptoececx_meth.c
mov edx, 0x10a
lea r8d, [rcx + 0x56]
call fcn.180277f00
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
test rdi, rdi
je 0x1802cd306
cmp ebp, 0x20
je 0x1802cd310
mov dword [rsp + 0x20], gethostname
jmp 0x1802cd2cf
mov r8d, Ordinal_60
mov qword [rsp + 0x50], rbx
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x12]
call fcn.180267550
mov rbx, rax
test rax, rax
jne 0x1802cd35a
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_60
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.180277f00
xor eax, eax
jmp 0x1802cd44a
cmp dword [rsp + 0x70], 0
jne 0x1802cd374
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.18020cf10
jmp 0x1802cd435
mov r8d, 0x43
lea rdx, str.cryptoececx_meth.c
lea ecx, [r8 - 0x23]
call fcn.1802a5ec0
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x1802cd3bb
lea r9, str.cryptoececx_meth.c
mov dword [rsp + 0x20], 0x45
mov edx, 0x10a
lea ecx, [rax + 0x10]
lea r8d, [rax + 0x41]
call fcn.180277f00
mov r8d, 0x46
jmp 0x1802cd3ef
cmp dword [rsp + 0x70], 2
jne 0x1802cd41b
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rax
call fcn.180275940
test eax, eax
jg 0x1802cd402
mov rcx, qword [rbx + 0x20]
lea rdx, str.cryptoececx_meth.c
mov r8d, Ordinal_79
call fcn.1802a5ea0
mov r8d, Ordinal_79
lea rdx, str.cryptoececx_meth.c
mov rcx, rbx
call fcn.180267260
xor eax, eax
jmp 0x1802cd44a
mov rax, qword [rbx + 0x20]
and byte [rax], 0xf8
mov rax, qword [rbx + 0x20]
and byte [rax + 0x1f], 0x7f
mov rax, qword [rbx + 0x20]
or byte [rax + 0x1f], 0x40
jmp 0x1802cd429
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x10], xmm1
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
call fcn.180301250
mov r8, rbx
mov edx, 0x40a
mov rcx, r14
call fcn.18026f890
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x1802dda20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x50
call fcn.1800b8100
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rsi, rcx
mov rdi, qword [rcx + 0x160]
mov r14, r9
mov qword [rsp + 0x30], rax
mov rbp, r8
mov rax, qword [rcx + 0x168]
mov r15, rdx
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x1802ddc5e
cmp rcx, r9
jb 0x1802ddc5e
cmp dword [rsi + 0x174], 0
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x48], r12
mov qword [rsi + 0x38], rcx
je 0x1802ddab1
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov dword [rsi + 0x174], 0
mov ebx, dword [rsi + 0x170]
mov r12d, dword [rsi + 0xc]
mov dword [rsp + 0x80], ebx
bswap r12d
test ebx, ebx
je 0x1802ddb14
nop dword [rax]
test r14, r14
je 0x1802ddb02
movzx edx, byte [r15]
dec r14
mov ecx, ebx
inc r15
movzx eax, byte [rcx + rsi + 0x10]
xor al, dl
mov byte [rbp], al
inc rbp
xor byte [rcx + rsi + 0x40], dl
inc ebx
and ebx, 0xf
mov dword [rsp + 0x80], ebx
jne 0x1802ddad0
jmp 0x1802ddb0a
test ebx, ebx
jne 0x1802ddc3d
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call rdi
mov qword [rsp + 0x40], r13
mov r13, qword [rsp + 0xa0]
cmp r14, 0xc00
jb 0x1802ddba8
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
nop dword [rax + rax]
mov r9d, 0xc00
lea rdx, [rsi + 0x60]
mov r8, r15
lea rcx, [rsi + 0x40]
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8d, 0xc0
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov rcx, r15
call r13
add r12d, 0xc0
add rbp, 0xc00
mov eax, r12d
add r15, 0xc00
bswap eax
mov dword [rsi + 0xc], eax
sub rdi, 1
jne 0x1802ddb50
mov ebx, dword [rsp + 0x80]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x1802ddbf8
mov rdi, r13
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
shr rdi, 4
mov r9, r13
mov r8, r15
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8, rdi
mov rdx, rbp
mov qword [rsp + 0x20], rsi
mov rcx, r15
call qword [rsp + 0xa0]
add r12d, edi
add rbp, r13
mov eax, r12d
add r15, r13
bswap eax
mov dword [rsi + 0xc], eax
sub r14, r13
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x1802ddc3d
mov r8, qword [rsp + 0x30]
lea rdx, [rsi + 0x10]
mov rcx, rsi
call qword [rsi + 0x178]
inc r12d
bswap r12d
mov dword [rsi + 0xc], r12d
nop
mov edx, ebx
inc ebx
movzx ecx, byte [rdx + r15]
movzx eax, byte [rsi + rdx + 0x10]
xor byte [rdx + rsi + 0x40], cl
xor al, cl
mov byte [rdx + rbp], al
sub r14, 1
jne 0x1802ddc20
mov r12, qword [rsp + 0x48]
xor eax, eax
mov dword [rsi + 0x170], ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret