joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180167f80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x28
mov r12, r9
mov r13, r9
shr r13, 3
mov r14, r8
and r12d, 7
mov rsi, rcx
mov qword [rsp + 0x78], r12
je 0x180167fc3
sub r13, 1
jne 0x180167fc3
mov rbx, qword [rdx]
mov rdi, r8
jmp 0x180168142
test r13, r13
je 0x180168135
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x20], r15
nop word [rax + rax]
movsxd rdx, dword [rsi]
mov r15, qword [rsi + 0x10]
mov rbp, rdx
mov rbx, qword [r14]
movzx eax, word [r15 + rdx*4 + 0x10]
movzx ecx, word [r15 + rdx*4 + 0x18]
movzx esi, word [r15 + rdx*4 + 0x14]
shl rsi, 0x10
or rsi, rax
mov eax, ebx
xor rsi, rax
movzx eax, word [r15 + rdx*4 + 0x1c]
shl rax, 0x10
or rax, rcx
mov rcx, rbx
shr rcx, 0x20
xor rax, rcx
lea ecx, [rdx - 1]
xor rax, rsi
movsxd r12, ecx
test ecx, ecx
js 0x1801680d1
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [r15 + r12*4]
mov edx, eax
mov r10d, r8d
shr edx, 0x10
movzx ecx, dx
shr r10, 8
shr cx, 8
movzx r11d, cx
movzx ecx, dl
xor r10, rcx
movzx edi, al
movzx ecx, r8b
xor r10, r11
movzx edx, ax
shr rdx, 8
xor rcx, rdx
xor rcx, rdi
inc rcx
add rcx, r10
rol cl, 2
movzx r9d, cl
add rdi, r9
rol dil, 2
lea rcx, [r9 + r10]
rol cl, 2
movzx edx, cl
lea rcx, [rdx + 1]
add rcx, r11
rol cl, 2
movzx r8d, cl
shl r8, 8
or r8, rdx
movzx ecx, dil
shl r8, 8
or r8, r9
shl r8, 8
or r8, rcx
xor r8, rsi
mov rsi, rax
sub r12, 1
mov rax, r8
jns 0x180168040
movzx ecx, word [r15 + rbp*4 + 8]
movzx edx, word [r15 + rbp*4 + 0xc]
shl rdx, 0x10
or rdx, rcx
movzx ecx, word [r15 + rbp*4]
xor rdx, rax
xor rsi, rdx
movzx edx, word [r15 + rbp*4 + 4]
mov dword [r14 + 4], esi
mov rsi, qword [rsp + 0x60]
shl edx, 0x10
or edx, ecx
xor edx, eax
mov dword [r14], edx
mov rdx, qword [rsp + 0x68]
mov rax, qword [rdx]
xor qword [r14], rax
add r14, 8
mov qword [rdx], rbx
sub r13, 1
jne 0x180167fe0
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x70]
jmp 0x18016813a
mov rbx, qword [rsp + 0x78]
mov rdi, r14
test r12, r12
je 0x18016818b
mov rax, qword [r14]
mov rcx, rsi
mov qword [rdx], rax
mov rdx, r14
call fcn.180167cd0
lea rdx, [r14 + 8]
test r12, r12
je 0x18016817d
nop dword [rax]
movzx ecx, byte [rdx]
lea rdi, [rdi + 1]
movzx eax, cl
lea rdx, [rdx + 1]
xor al, byte [rdi - 1]
mov byte [rdx - 1], al
mov byte [rdi - 1], cl
sub r12, 1
jne 0x180168160
mov rdx, r14
mov rcx, rsi
call fcn.180167cd0
xor qword [r14], rbx
add rsp, 0x28
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180187900
Capabilities:
Check for time delay via gettickcount
Query service status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1802b1734], eax
mov eax, dword [rbx + 0x14]
mov dword [0x1802b1730], eax
cmp dword [rbx + 4], edi
jne 0x1801879d6
mov ebp, 0x2710
lea r14, [0x1802b172c]
nop dword [rax]
mov eax, 0xcccccccd
mul dword [rbx + 0x18]
shr edx, 3
cmp edx, 0x3e8
jae 0x18018796a
mov edx, 0x3e8
jmp 0x18018796f
cmp edx, ebp
cmova edx, ebp
mov ecx, edx
mov dword [0x1802b1738], edx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9d, 0x24
mov qword [rsp + 0x20], r14
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x1801879d6
mov eax, dword [0x1802b1730]
cmp dword [rbx + 0x14], eax
jbe 0x1801879bc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1802b1734], eax
mov eax, dword [rbx + 0x14]
mov dword [0x1802b1730], eax
jmp 0x1801879cd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x1802b1734]
cmp eax, dword [rbx + 0x18]
ja 0x1801879f3
cmp dword [rbx + 4], edi
je 0x180187950
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
xor al, al
jmp 0x1801879d8
Function at 0x180187a00
Capabilities:
Query service status
Start service

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x60
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
mov rbx, rcx
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [rsp + 0x50], eax
mov r8d, 0x20000
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rsi, rax
test rax, rax
je 0x180187b75
mov r8d, reloc.WS2_32.dll_sendto
mov qword [rsp + 0x80], rdi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rdi, rax
test rax, rax
jne 0x180187a7d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x180187b6d
mov qword [rsp + 0x78], rbp
lea r8, [rsp + 0x30]
lea rbp, [0x1802b172c]
mov r9d, 0x24
xor edx, edx
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x180187b54
mov eax, dword [rsp + 0x34]
cmp eax, 4
je 0x180187b3e
dec eax
test eax, 0xfffffffd
jne 0x180187b54
mov ebx, 3
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rdi
call fcn.180187900
test al, al
je 0x180187b54
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x180187b3e
lea r8d, [rbx - 1]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call fcn.180187900
test al, al
jne 0x180187b23
test ebx, ebx
jle 0x180187b23
mov r8d, 2
lea rdx, [rsp + 0x30]
mov rcx, rdi
dec ebx
call fcn.180187900
test al, al
je 0x180187b06
mov r9d, 0x24
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x180187b68
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rsi
ret
Function at 0x1801883a0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
mov rdi, r8
mov rsi, rcx
mov r10, rcx
cmp r8, 0xffffffffffffffff
jae 0x1801884f5
cmp r8, 4
jb 0x1801884f5
mov qword [rsp + 0x18], rbp
lea rbp, [0x18006db30]
mov qword [rsp + 0x10], rbx
movsx rcx, byte [rdx]
test cl, cl
je 0x1801884eb
cmp ecx, 0x80
jae 0x1801884eb
movzx r11d, byte [rcx + rbp]
cmp r11b, 0xff
je 0x1801884eb
movsx rcx, byte [rdx + 1]
cmp ecx, 0x80
jae 0x1801884eb
movsx ebx, byte [rcx + rbp]
mov r8d, ebx
cmp ebx, 0xffffffff
je 0x1801884eb
movsx rcx, byte [rdx + 2]
cmp cl, 0x3d
je 0x18018843c
cmp ecx, 0x80
jae 0x1801884eb
cmp byte [rcx + rbp], 0xff
je 0x1801884eb
movsx r9, byte [rdx + 3]
sub rdi, 4
add rdx, 4
cmp r9b, 0x3d
je 0x180188467
cmp r9d, 0x80
jae 0x1801884eb
cmp byte [r9 + rbp], 0xff
je 0x1801884eb
sar r8d, 4
and r8b, 3
shl r11b, 2
or r8b, r11b
mov byte [r10], r8b
inc r10
cmp cl, 0x3d
je 0x1801884e1
mov r8, rcx
cmp ecx, 0x80
jae 0x180188492
movsx eax, byte [rcx + rbp]
jmp 0x180188497
mov eax, 0xffffffff
sar eax, 2
and al, 0xf
shl bl, 4
or al, bl
mov byte [r10], al
inc r10
cmp r9b, 0x3d
je 0x1801884e1
cmp ecx, 0x80
jae 0x1801884bc
movzx r8d, byte [r8 + rbp]
jmp 0x1801884bf
mov r8b, 0xff
cmp r9d, 0x80
jae 0x1801884cf
movzx ecx, byte [r9 + rbp]
jmp 0x1801884d1
mov cl, 0xff
and cl, 0x3f
shl r8b, 6
or cl, r8b
mov byte [r10], cl
inc r10
cmp rdi, 4
jae 0x1801883d4
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
sub r10d, esi
mov rsi, qword [rsp + 0x20]
mov eax, r10d
pop rdi
ret
Function at 0x180188510
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
movabs rbp, 0xaaaaaaaaaaaaaaab
lea r10, [r9 + 2]
mov rax, rbp
mov rdi, rdx
mul r10
xor r11d, r11d
movabs rax, 0x8000000000000000
mov rbx, rdx
shr rbx, 1
shl rbx, 2
cmp rbx, rax
ja 0x180188685
cmp r9, 0xfffffffffffffffd
jae 0x180188685
cmp rdi, rbx
jb 0x180188685
mov qword [rsp + 0x10], rsi
lea rsi, [0x18006dae0]
cmp r9, 3
jb 0x180188608
mov rax, rbp
mul r9
mov r10, rdx
shr r10, 1
imul rax, r10, 0xfffffffffffffffd
lea r11d, [r10*4]
add r9, rax
nop word [rax + rax]
movzx eax, byte [r8]
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [rcx], al
movzx edx, byte [r8]
movzx eax, byte [r8 + 1]
and edx, 3
shr rax, 4
shl rdx, 4
or rdx, rax
movzx eax, byte [rdx + rsi]
mov byte [rcx + 1], al
movzx edx, byte [r8 + 1]
movzx eax, byte [r8 + 2]
and edx, 0xf
shr rax, 6
shl rdx, 2
or rdx, rax
movzx eax, byte [rdx + rsi]
mov byte [rcx + 2], al
movzx eax, byte [r8 + 2]
add r8, 3
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [rcx + 3], al
add rcx, 4
sub r10, 1
jne 0x1801885a0
test r9, r9
je 0x180188665
movzx eax, byte [r8]
shr rax, 2
movzx eax, byte [rax + rsi]
mov byte [rcx], al
movzx edx, byte [r8]
and edx, 3
shl rdx, 4
cmp r9, 1
jne 0x180188637
movzx eax, byte [rdx + rsi]
mov byte [rcx + 1], al
mov al, 0x3d
jmp 0x180188656
movzx eax, byte [r8 + 1]
shr rax, 4
or rax, rdx
movzx eax, byte [rax + rsi]
mov byte [rcx + 1], al
movzx eax, byte [r8 + 1]
and eax, 0xf
movzx eax, byte [rsi + rax*4]
mov byte [rcx + 2], al
mov byte [rcx + 3], 0x3d
add rcx, 4
add r11d, 4
mov rsi, qword [rsp + 0x10]
lea rdx, [rbx + 1]
mov eax, r11d
cmp rdi, rdx
jb 0x180188688
mov byte [rcx], 0
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rdi
ret
mov eax, r11d
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rdi
ret
Function at 0x1801912a0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x278
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edi, dword [rcx + 0xe0]
xor esi, esi
xor r15d, r15d
movsxd rbp, edx
mov r13, r9
mov r12, r8
mov rbx, rcx
test edi, edi
je 0x180191407
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.18020bef0
xor r14d, r14d
test edi, edi
jle 0x18019141f
lea ecx, [rbp + 1]
mov dword [rsp + 0x30], ecx
nop dword [rax]
mov eax, 2
mov dword [rsp + 0x44], 0x1388
cmp edi, eax
mov qword [rsp + 0x58], rbp
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 1
cmovb eax, edi
xor r9d, r9d
mov dword [rsp + 0x40], eax
xor r8d, r8d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
mov r15d, eax
test eax, eax
jle 0x1801913a4
lea rdx, [rsp + 0x50]
mov rcx, rbp
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1801913dd
xor r9d, r9d
mov r8d, r13d
mov rdx, r12
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test eax, eax
jns 0x18019141b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x1801913dd
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x20]
mov eax, 0xfffffffe
jmp 0x18019144c
jne 0x1801913dd
lea rax, [rsp + 0x34]
mov dword [rsp + 0x38], 0
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov dword [rsp + 0x34], 4
mov r8d, 0x1007
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x1801913f5
mov edi, dword [rbx + 0xe0]
add r14d, 2
cmp r14d, edi
jge 0x18019141b
mov ecx, dword [rsp + 0x30]
jmp 0x180191310
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
mov esi, 0xffffffff
call qword [rax + 0x20]
jmp 0x18019142e
mov rcx, rbp
xor r9d, r9d
mov r8d, r13d
mov rdx, r12
call qword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
jg 0x18019144a
mov rax, qword [rbx]
mov dl, 1
mov rcx, rbx
call qword [rax + 0x20]
test esi, esi
jns 0x180191435
mov dword [rbx + 0x10], 0x67
test r15d, r15d
jle 0x180191443
test esi, esi
jne 0x180191443
lea eax, [rsi - 2]
jmp 0x18019144c
mov eax, 0xffffffff
jmp 0x18019144c
mov eax, esi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x278
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180197db0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x18
lea rdx, [rdx*8]
mov r10, r9
mov rax, rdx
mov byte [rsp], dl
shr rax, 8
mov byte [rsp + 1], al
mov rax, rdx
shr rax, 0x10
mov byte [rsp + 2], al
mov rax, rdx
shr rax, 0x18
mov byte [rsp + 3], al
mov rax, rdx
shr rax, 0x20
mov byte [rsp + 4], al
mov rax, rdx
shr rax, 0x28
mov byte [rsp + 5], al
mov rax, rdx
shr rax, 0x30
mov byte [rsp + 6], al
shr rdx, 0x38
mov byte [rsp + 7], dl
lea rdx, [r8*8]
mov rax, rdx
mov byte [rsp + 8], dl
shr rax, 8
mov r8d, 7
mov byte [rsp + 9], al
mov rax, rdx
shr rax, 0x10
mov byte [rsp + 0xa], al
mov rax, rdx
shr rax, 0x18
mov byte [rsp + 0xb], al
mov rax, rdx
shr rax, 0x20
mov byte [rsp + 0xc], al
mov rax, rdx
shr rax, 0x28
mov byte [rsp + 0xd], al
mov rax, rdx
shr rax, 0x30
mov byte [rsp + 0xe], al
movzx eax, byte [r9]
shr rdx, 0x38
add rax, 3
mov byte [rsp + 0xf], dl
add rax, rax
movdqu xmm2, xmmword [rsp]
pxor xmm2, xmmword [rcx + rax*8]
nop dword [rax]
movzx edx, byte [r10]
movdqa xmm1, xmm2
movzx eax, dl
shr al, 3
dec al
and al, 1
shl al, 3
movzx r9d, al
lea rax, [rdx + 4]
add rax, rax
add rdx, 3
add rdx, rdx
movdqu xmm0, xmmword [rcx + rdx*8]
aesenc xmm0, xmmword [rcx + rax*8]
lea rax, [r9 + 4]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx edx, byte [r10]
lea rax, [rdx + 3]
add rdx, 2
add rax, rax
add rdx, rdx
movdqu xmm0, xmmword [rcx + rdx*8]
aesenc xmm0, xmmword [rcx + rax*8]
lea rax, [r9 + 3]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx eax, byte [r10]
lea rdx, [rax + 2]
inc rax
add rax, rax
add rdx, rdx
movdqu xmm0, xmmword [rcx + rax*8]
lea rax, [r9 + 2]
aesenc xmm0, xmmword [rcx + rdx*8]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx eax, byte [r10]
lea rdx, [rax + 1]
add rax, rax
add rdx, rdx
movdqu xmm0, xmmword [rcx + rax*8]
lea rax, [r9 + 1]
aesenc xmm0, xmmword [rcx + rdx*8]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx edx, byte [r10]
mov eax, edx
add rax, rax
pxor xmm1, xmmword [rcx + rax*8]
lea rax, [rdx + 4]
add rax, rax
movdqu xmm0, xmmword [rcx + rax*8]
mov eax, r9d
add rax, rax
aesenc xmm0, xmm1
movdqu xmmword [rcx + rax*8], xmm0
mov byte [r10], r9b
sub r8, 1
jne 0x180197e80
lea rax, [r9 + 1]
mov r8d, r9d
add r8, r8
lea rdx, [r9 + 2]
add rdx, rdx
add rax, rax
movdqu xmm0, xmmword [rcx + rax*8]
pxor xmm0, xmmword [rcx + rdx*8]
pxor xmm0, xmmword [rcx + r8*8]
movdqu xmmword [rcx + r8*8], xmm0
movzx r8d, byte [r10]
mov r9d, r8d
add r9, r9
lea rdx, [r8 + 4]
add rdx, rdx
lea rax, [r8 + 3]
add rax, rax
movdqu xmm0, xmmword [rcx + rdx*8]
pxor xmm0, xmmword [rcx + rax*8]
pxor xmm0, xmmword [rcx + r9*8]
movdqu xmmword [rcx + r9*8], xmm0
add rsp, 0x18
ret
Function at 0x180197fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x30], rax
movzx r10d, byte [r8]
lea rbp, [rcx*8]
lea r15, [rdx*8]
mov rbx, r9
mov r14, r8
mov r13d, 7
lea eax, [r10*2 + 6]
xor rbp, qword [r9 + rax*8]
lea eax, [r10 + r10]
xor r15, qword [r9 + rax*8 + 0x38]
nop dword [rax + rax]
movzx ecx, byte [r14]
movzx eax, cl
shr al, 3
dec al
lea rdx, [rcx + 4]
and al, 1
shl al, 3
add rcx, 3
movzx esi, al
shl rdx, 4
shl rcx, 4
add rdx, rbx
add rcx, rbx
lea eax, [rsi*2 + 8]
lea r8, [rbx + rax*8]
call fcn.180198c40
movzx ecx, byte [r14]
mov edi, esi
shl rdi, 4
add rdi, rbx
lea rdx, [rcx + 3]
add rcx, 2
shl rcx, 4
shl rdx, 4
lea r8, [rdi + 0x30]
add rcx, rbx
add rdx, rbx
call fcn.180198c40
movzx eax, byte [r14]
lea r8, [rdi + 0x20]
lea r9d, [rax + rax]
lea eax, [r9 + 4]
lea rdx, [rbx + rax*8]
lea eax, [r9 + 2]
lea rcx, [rbx + rax*8]
call fcn.180198c40
movzx r9d, byte [r14]
lea r8, [rdi + 0x10]
lea eax, [r9*2 + 2]
lea rdx, [rbx + rax*8]
lea eax, [r9 + r9]
lea rcx, [rbx + rax*8]
call fcn.180198c40
movzx edx, byte [r14]
mov rax, rbp
mov r8, rdi
lea ecx, [rdx + rdx]
add edx, edx
xor rax, qword [rbx + rcx*8]
mov rcx, r15
mov qword [rsp + 0x20], rax
xor rcx, qword [rbx + rdx*8 + 8]
lea eax, [rdx + 8]
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x20]
lea rcx, [rbx + rax*8]
call fcn.180198c40
mov byte [r14], sil
sub r13, 1
jne 0x180198030
lea eax, [rsi + rsi]
lea r8, [rbx + rax*8]
lea ecx, [rsi*2 + 4]
lea eax, [rsi + rsi]
mov rax, qword [rbx + rax*8 + 0x10]
xor rax, qword [rbx + rcx*8]
xor qword [r8], rax
movzx ecx, byte [r14]
add rcx, rcx
mov rax, qword [rbx + rcx*8 + 0x28]
xor rax, qword [rbx + rcx*8 + 0x18]
xor qword [rbx + rcx*8 + 8], rax
movzx r8d, byte [r14]
lea eax, [r8 + r8]
lea r9, [rbx + rax*8]
lea ecx, [r8*2 + 6]
lea eax, [r8*2 + 8]
mov rax, qword [rbx + rax*8]
xor rax, qword [rbx + rcx*8]
xor qword [r9], rax
movzx ecx, byte [r14]
add rcx, rcx
mov rax, qword [rbx + rcx*8 + 0x48]
xor rax, qword [rbx + rcx*8 + 0x38]
xor qword [rbx + rcx*8 + 8], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180198450
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov byte [rcx], 0
mov rbx, rdx
mov rax, qword [r8]
mov r10, r8
xor rax, qword [r9]
mov r14, rcx
mov qword [rdx], rax
mov rbp, r9
movzx eax, byte [rcx]
mov r15d, 0xa
mov rdx, qword [r9 + 8]
add rax, rax
xor rdx, qword [r8 + 8]
mov qword [rbx + rax*8 + 8], rdx
movzx eax, byte [rcx]
movaps xmm0, xmmword [0x18029b6f0]
inc rax
add rax, rax
movups xmmword [rbx + rax*8], xmm0
movzx eax, byte [rcx]
movaps xmm0, xmmword [0x18029b6e0]
add rax, 2
add rax, rax
movups xmmword [rbx + rax*8], xmm0
movzx r8d, byte [rcx]
lea eax, [r8*2 + 4]
mov rdx, qword [rbx + rax*8]
lea eax, [r8*2 + 6]
xor rdx, qword [r10]
mov qword [rbx + rax*8], rdx
movzx ecx, byte [rcx]
add rcx, rcx
mov rax, qword [rbx + rcx*8 + 0x28]
xor rax, qword [r10 + 8]
mov qword [rbx + rcx*8 + 0x38], rax
movzx r8d, byte [r14]
lea eax, [r8 + r8]
mov rdx, qword [rbx + rax*8 + 0x10]
lea eax, [r8*2 + 8]
xor rdx, qword [r10]
mov qword [rbx + rax*8], rdx
movzx ecx, byte [r14]
add rcx, rcx
mov rax, qword [rbx + rcx*8 + 0x18]
xor rax, qword [r10 + 8]
mov qword [rbx + rcx*8 + 0x48], rax
movdqu xmm6, xmmword [r10]
movdqu xmm0, xmmword [r9]
pxor xmm6, xmm0
movzx ecx, byte [r14]
movdqu xmm0, xmmword [rbp]
movzx eax, cl
shr al, 3
lea rdx, [rcx + 4]
dec al
add rcx, 3
shl rdx, 4
and al, 1
shl rcx, 4
shl al, 3
pxor xmm0, xmm6
movzx esi, al
add rdx, rbx
add rcx, rbx
movdqa xmm6, xmm0
lea r8, [rsi + 4]
shl r8, 4
add r8, rbx
call fcn.180198c40
movzx ecx, byte [r14]
mov edi, esi
shl rdi, 4
add rdi, rbx
lea rdx, [rcx + 3]
add rcx, 2
shl rcx, 4
shl rdx, 4
lea r8, [rdi + 0x30]
add rcx, rbx
add rdx, rbx
call fcn.180198c40
movzx eax, byte [r14]
lea r8, [rdi + 0x20]
lea r9d, [rax + rax]
lea eax, [r9 + 4]
lea rdx, [rbx + rax*8]
lea eax, [r9 + 2]
lea rcx, [rbx + rax*8]
call fcn.180198c40
movzx r9d, byte [r14]
lea r8, [rdi + 0x10]
lea eax, [r9*2 + 2]
lea rdx, [rbx + rax*8]
lea eax, [r9 + r9]
lea rcx, [rbx + rax*8]
call fcn.180198c40
movzx edx, byte [r14]
movq rax, xmm0
psrldq xmm0, 8
mov r8, rdi
lea ecx, [rdx + rdx]
add edx, edx
xor rax, qword [rbx + rcx*8]
mov qword [rsp + 0x20], rax
movq rax, xmm0
xor rax, qword [rbx + rdx*8 + 8]
mov qword [rsp + 0x28], rax
lea eax, [rdx + 8]
lea rdx, [rsp + 0x20]
lea rcx, [rbx + rax*8]
call fcn.180198c40
mov byte [r14], sil
sub r15, 1
jne 0x180198540
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e68c0
mov rbx, qword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180198680
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movzx r9d, byte [r8]
mov r11, rcx
movzx eax, r9b
shr al, 3
dec al
and al, 1
shl al, 3
movzx r10d, al
lea rax, [r9 + 4]
add rax, rax
add r9, 3
add r9, r9
movdqu xmm0, xmmword [rcx + r9*8]
aesenc xmm0, xmmword [rcx + rax*8]
lea rax, [r10 + 4]
add rax, rax
movdqu xmmword [rcx + rax*8], xmm0
movzx ecx, byte [r8]
lea rax, [rcx + 3]
add rcx, 2
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [r11 + rcx*8]
aesenc xmm0, xmmword [r11 + rax*8]
lea rax, [r10 + 3]
add rax, rax
movdqu xmmword [r11 + rax*8], xmm0
movzx eax, byte [r8]
lea rcx, [rax + 2]
inc rax
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [r11 + rax*8]
lea rax, [r10 + 2]
aesenc xmm0, xmmword [r11 + rcx*8]
add rax, rax
movdqu xmmword [r11 + rax*8], xmm0
movzx eax, byte [r8]
lea rcx, [rax + 1]
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [r11 + rax*8]
lea rax, [r10 + 1]
aesenc xmm0, xmmword [r11 + rcx*8]
add rax, rax
movdqu xmmword [r11 + rax*8], xmm0
movzx ecx, byte [r8]
mov eax, ecx
add rax, rax
movdqu xmm1, xmmword [r11 + rax*8]
lea rax, [rcx + 4]
pxor xmm1, xmmword [rdx]
add rax, rax
movdqu xmm0, xmmword [r11 + rax*8]
mov eax, r10d
add rax, rax
aesenc xmm0, xmm1
movdqu xmmword [r11 + rax*8], xmm0
mov byte [r8], r10b
ret
Function at 0x1801988b0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x18029e198]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, r9
mov qword [rsp + 0x20], 0
mov r9, r8
mov qword [rsp + 0x28], 0
lea rax, [r8 + 0xf]
and r9d, 0xf
shr rax, 4
mov r11, rdx
mov rbx, rcx
test rax, rax
je 0x180198a41
xor r8d, r8d
lea r10, [rax - 1]
test r10, r10
je 0x1801989fd
nop dword [rax]
movzx ecx, byte [rdi]
mov rax, r8
add rax, rax
inc r8
movdqu xmm1, xmmword [r11 + rax*8]
movzx eax, cl
shr al, 3
dec al
and al, 1
shl al, 3
movzx edx, al
lea rax, [rcx + 4]
add rax, rax
add rcx, 3
add rcx, rcx
movdqu xmm0, xmmword [rbx + rcx*8]
aesenc xmm0, xmmword [rbx + rax*8]
lea rax, [rdx + 4]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
movzx ecx, byte [rdi]
lea rax, [rcx + 3]
add rcx, 2
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [rbx + rcx*8]
aesenc xmm0, xmmword [rbx + rax*8]
lea rax, [rdx + 3]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
movzx eax, byte [rdi]
lea rcx, [rax + 2]
inc rax
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [rbx + rax*8]
lea rax, [rdx + 2]
aesenc xmm0, xmmword [rbx + rcx*8]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
movzx eax, byte [rdi]
lea rcx, [rax + 1]
add rax, rax
add rcx, rcx
movdqu xmm0, xmmword [rbx + rax*8]
lea rax, [rdx + 1]
aesenc xmm0, xmmword [rbx + rcx*8]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
movzx ecx, byte [rdi]
mov eax, ecx
add rax, rax
pxor xmm1, xmmword [rbx + rax*8]
lea rax, [rcx + 4]
add rax, rax
movdqu xmm0, xmmword [rbx + rax*8]
mov eax, edx
add rax, rax
aesenc xmm0, xmm1
movdqu xmmword [rbx + rax*8], xmm0
mov byte [rdi], dl
cmp r8, r10
jb 0x180198910
add r8, r8
lea rax, [r11 + r8*8]
test r9, r9
je 0x180198a27
mov r8, r9
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.18020b840
movdqu xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
jmp 0x180198a31
movdqu xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180198680
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801e68c0
add rsp, 0x48
pop rdi
pop rbx
ret