joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005c3a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r9, qword [rcx + 0x80]
mov r15, rdx
mov r8, qword [rcx + 0x18]
mov rbp, rcx
mov rax, qword [rcx + 0x30]
cmp r9, 0x10
jb 0x18005c401
mov r10, r9
shr r10, 4
imul rdx, r10, 0xfffffffffffffff0
add r9, rdx
mov rdx, qword [r8 + 8]
xor rdx, qword [rax + 8]
mov rcx, qword [r8]
add r8, 0x10
xor qword [rax], rcx
mov qword [rax + 8], rdx
add rax, 0x10
sub r10, 1
jne 0x18005c3e1
test r9, r9
je 0x18005c421
sub r8, rax
nop dword [rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x18005c410
mov rcx, qword [rbp + 0x80]
mov r9, qword [rbp + 0x78]
cmp rcx, r9
jne 0x18005c493
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x30]
cmp r9, 0x10
jb 0x18005c470
mov r10, r9
shr r10, 4
imul rax, r10, 0xfffffffffffffff0
add r9, rax
nop dword [rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x18005c450
test r9, r9
je 0x18005c501
sub r8, rdx
nop dword [rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x18005c480
jmp 0x18005c501
mov rax, qword [rbp + 0x30]
xor byte [rcx + rax], 0x80
mov r9, qword [rbp + 0x78]
mov r8, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x30]
cmp r9, 0x10
jb 0x18005c4e0
mov r10, r9
shr r10, 4
imul rax, r10, 0xfffffffffffffff0
add r9, rax
nop dword [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x18005c4c0
test r9, r9
je 0x18005c501
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [rdx + r8]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x18005c4f0
mov r14, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x30]
mov rcx, r14
mov rbx, qword [rbp + 0x38]
sub rbx, rsi
mov rdi, qword [r14]
call qword [rdi + 0x28]
xor edx, edx
mov rcx, r14
mov r8, rax
mov rax, rbx
div r8
mov r8, rsi
mov rdx, rsi
mov r9, rax
call qword [rdi + 0x40]
mov r8, qword [rbp + 0x78]
test r8, r8
je 0x18005c548
mov rdx, qword [rbp + 0x30]
mov rcx, r15
call fcn.18017c7f0
mov rcx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x38]
sub r8, rcx
je 0x18005c55c
xor edx, edx
call fcn.18017cc00
mov rcx, qword [rbp + 0x18]
mov r8, qword [rbp + 0x20]
sub r8, rcx
je 0x18005c570
xor edx, edx
call fcn.18017cc00
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov qword [rbp + 0x80], 0
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180060750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, qword [rdx]
mov rax, qword [rbx + 0x18]
mov r9, qword [rbx]
xor rax, rcx
mov r10, qword [rbx + 8]
mov r11, qword [rbx + 0x10]
test r8, r8
je 0x1800607a6
nop
add r9, r10
add r11, rax
rol r10, 0xd
xor r10, r9
rol rax, 0x10
xor rax, r11
rol r9, 0x20
add r11, r10
add r9, rax
rol r10, 0x11
rol rax, 0x15
xor r10, r11
xor rax, r9
rol r11, 0x20
sub r8, 1
jne 0x180060770
xor r9, rcx
mov qword [rbx], r9
mov rcx, qword [rdx]
mov rbx, qword [rsp + 8]
mov qword [rcx + 8], r10
mov rcx, qword [rdx]
mov qword [rcx + 0x10], r11
mov rcx, qword [rdx]
mov qword [rcx + 0x18], rax
ret

Function at 0x1800607d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x40], r14
mov rbx, rcx
cmp qword [rcx + 0x20], rax
jne 0x1800607fd
add rcx, 8
call fcn.1800331f0
add byte [rbx + 0x48], sil
xor ebp, ebp
cmp qword [rbx + 0x40], rbp
je 0x180060861
test rsi, rsi
je 0x180060841
nop
mov rdx, qword [rbx + 0x40]
cmp rdx, 8
je 0x180060841
movzx ecx, byte [rdi]
inc rdi
mov rax, qword [rbx + 0x38]
shr rax, 8
shl rcx, 0x38
or rcx, rax
lea rax, [rdx + 1]
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x38], rcx
sub rsi, 1
jne 0x180060810
cmp qword [rbx + 0x40], 8
jne 0x180060861
mov r8, qword [rbx + 0x10]
lea rdx, [rbx + 0x20]
mov rcx, qword [rbx + 0x38]
call fcn.180060750
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x38], rbp
cmp rsi, 8
jb 0x180060905
mov r11, rsi
mov qword [rsp + 0x48], r15
shr r11, 3
imul rax, r11, 0xfffffffffffffff8
add rsi, rax
nop
mov r9, qword [rbx + 0x20]
mov r15, qword [rdi]
mov r10, qword [rbx + 0x10]
mov rax, qword [r9 + 0x18]
mov rcx, qword [r9]
xor rax, r15
mov rdx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
test r10, r10
je 0x1800608d8
add rcx, rdx
add r8, rax
rol rdx, 0xd
xor rdx, rcx
rol rax, 0x10
xor rax, r8
rol rcx, 0x20
add r8, rdx
add rcx, rax
rol rdx, 0x11
rol rax, 0x15
xor rdx, r8
xor rax, rcx
rol r8, 0x20
sub r10, 1
jne 0x1800608a2
xor rcx, r15
add rdi, 8
mov qword [r9], rcx
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 8], rdx
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 0x10], r8
mov rcx, qword [rbx + 0x20]
mov qword [rcx + 0x18], rax
sub r11, 1
jne 0x180060880
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
test rsi, rsi
je 0x180060948
mov r8, qword [rbx + 0x40]
mov rdx, qword [rbx + 0x38]
nop word [rax + rax]
movzx ecx, byte [rdi + rbp]
mov rax, rdx
shl rcx, 0x38
inc r8
shr rax, 8
mov rdx, rcx
or rdx, rax
mov qword [rbx + 0x40], r8
inc rbp
mov qword [rbx + 0x38], rdx
cmp rbp, rsi
jne 0x180060920
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180060a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x28]
mov rsi, rdx
mov rbx, rcx
cmp qword [rcx + 0x20], rax
jne 0x180060a48
add rcx, 8
call fcn.1800331f0
mov rcx, qword [rbx + 0x40]
test rcx, rcx
jne 0x180060a5f
movzx eax, byte [rbx + 0x48]
shl rax, 0x38
mov qword [rbx + 0x38], rax
jmp 0x180060a88
cmp rcx, 8
jae 0x180060a88
mov rdx, qword [rbx + 0x38]
mov eax, 8
sub al, cl
movzx ecx, al
movzx eax, byte [rbx + 0x48]
shl cl, 3
shr rdx, cl
shl rax, 0x38
or rdx, rax
mov qword [rbx + 0x38], rdx
mov r8, qword [rbx + 0x10]
lea rdx, [rbx + 0x20]
mov rcx, qword [rbx + 0x38]
call fcn.180060750
mov rdx, qword [rbx + 0x20]
xor qword [rdx + 0x10], 0xff
mov r9, qword [rbx + 0x20]
mov r10, qword [rbx + 0x18]
mov rax, qword [r9]
mov rcx, qword [r9 + 8]
mov r8, qword [r9 + 0x10]
mov rdx, qword [r9 + 0x18]
test r10, r10
je 0x180060af7
add rax, rcx
add r8, rdx
rol rcx, 0xd
xor rcx, rax
rol rdx, 0x10
xor rdx, r8
rol rax, 0x20
add r8, rcx
add rax, rdx
rol rcx, 0x11
rol rdx, 0x15
xor rcx, r8
xor rdx, rax
rol r8, 0x20
sub r10, 1
jne 0x180060ac1
mov qword [r9], rax
mov rax, qword [rbx + 0x20]
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x20]
mov qword [rax + 0x10], r8
mov rax, qword [rbx + 0x20]
mov qword [rax + 0x18], rdx
mov rcx, qword [rbx + 0x20]
mov rax, qword [rcx + 0x18]
xor rax, qword [rcx + 0x10]
xor rax, qword [rcx + 8]
xor rax, qword [rcx]
mov qword [rsi], rax
mov rcx, qword [rbx + 0x20]
mov r8, qword [rbx + 0x28]
sub r8, rcx
and r8, 0xfffffffffffffff8
je 0x180060b40
xor edx, edx
call fcn.18017cc00
mov rax, qword [rbx + 0x20]
lea rcx, [rbx + 0x20]
mov qword [rbx + 0x28], rax
call fcn.1800606e0
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov qword [rbx + 0x38], rax
mov qword [rbx + 0x40], rax
mov byte [rbx + 0x48], al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180061160
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
mov rax, qword [rcx + 0x28]
mov r13, r8
mov r15, rdx
mov rbp, rcx
cmp qword [rcx + 0x20], rax
jne 0x180061188
add rcx, 8
call fcn.1800331f0
mov rdx, qword [rbp + 0x38]
mov r12d, 8
sub r12, qword [rbp + 0x38]
mov r8, r15
cmp r13, r12
cmovb r12, r13
add rdx, qword [rbp + 0x20]
mov r9, r12
cmp r12, 0x10
jb 0x1800611e0
mov r10, r12
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, r12
nop dword [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x1800611c0
test r9, r9
je 0x180061201
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1800611f0
add qword [rbp + 0x38], r12
cmp qword [rbp + 0x38], 8
jb 0x180061345
mov qword [rsp + 0x50], rbx
mov rbx, qword [rbp + 0x28]
mov qword [rsp + 0x58], rsi
mov rsi, qword [rbp + 0x20]
mov qword [rsp + 0x60], rdi
sub rbx, rsi
mov qword [rsp + 0x20], r14
mov r14, qword [rbp + 0x10]
mov rcx, r14
mov rdi, qword [r14]
call qword [rdi + 0x28]
xor edx, edx
mov rcx, r14
mov r8, rax
mov rax, rbx
div r8
mov r8, rsi
mov rdx, rsi
mov r9, rax
call qword [rdi + 0x40]
add r15, r12
sub r13, r12
cmp r13, 8
jb 0x1800612cf
mov r12, r13
shr r12, 3
imul rax, r12, 0xfffffffffffffff8
add r13, rax
mov rax, qword [rbp + 0x20]
mov r8d, 8
mov rdx, r15
nop dword [rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x180061280
mov r14, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x20]
mov rcx, r14
mov rbx, qword [rbp + 0x28]
sub rbx, rsi
mov rdi, qword [r14]
call qword [rdi + 0x28]
xor edx, edx
mov rcx, r14
mov r8, rax
mov rax, rbx
div r8
mov r8, rsi
mov rdx, rsi
mov r9, rax
call qword [rdi + 0x40]
add r15, 8
sub r12, 1
jne 0x180061270
mov rdx, qword [rbp + 0x20]
mov r8, r13
mov r14, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
cmp r13, 0x10
jb 0x180061320
mov r9, r13
shr r9, 4
imul r8, r9, 0xfffffffffffffff0
add r8, r13
nop
mov rcx, qword [r15 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r15]
add r15, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r9, 1
jne 0x180061300
test r8, r8
je 0x180061341
sub r15, rdx
nop dword [rax + rax]
movzx eax, byte [r15 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x180061330
mov qword [rbp + 0x38], r13
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x180062a20
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1802609a8]
xor rax, rsp
mov qword [rbp - 8], rax
xor r8d, r8d
mov dword [rbp - 0x28], 0x756e6547
xor eax, eax
mov dword [rbp - 0x24], 0x6c65746e
mov qword [rbp - 0x34], rax
mov r10, rcx
xor ecx, ecx
mov dword [rbp - 0x20], 0x49656e69
cpuid
mov dword [rbp - 0x2c], edx
mov r11d, eax
mov dword [rbp - 0x38], eax
mov edx, r8d
mov dword [rbp - 0x34], ebx
mov dword [rbp - 0x30], ecx
mov dword [rbp - 0x18], 0x68747541
mov dword [rbp - 0x14], 0x444d4163
mov dword [rbp - 0x10], 0x69746e65
mov dword [rbp - 0x40], r8d
nop word [rax + rax]
mov ecx, dword [rbp + rdx - 0x28]
xor ecx, dword [rbp + rdx - 0x34]
add rdx, 4
mov eax, dword [rbp - 0x40]
or ecx, eax
mov dword [rbp - 0x40], ecx
cmp rdx, 0xc
jne 0x180062aa0
mov eax, dword [rbp - 0x40]
mov rdx, r8
test eax, eax
mov dword [rbp - 0x40], r8d
sete sil
nop word [rax + rax]
mov ecx, dword [rbp + rdx - 0x18]
xor ecx, dword [rbp + rdx - 0x34]
add rdx, 4
mov eax, dword [rbp - 0x40]
or ecx, eax
mov dword [rbp - 0x40], ecx
cmp rdx, 0xc
jne 0x180062ad0
mov eax, dword [rbp - 0x40]
test eax, eax
sete dil
cmp dword [rbp - 0x38], 1
jb 0x180062bdd
xor ecx, ecx
mov eax, 1
cpuid
mov r9d, ecx
mov eax, edx
shl r9, 0x20
or r9, rax
mov rax, r9
mov rcx, r9
and ecx, 0x10
and eax, 0x4000000
shl rcx, 6
mov rdx, rcx
or rdx, 1
test rax, rax
mov rax, r9
cmove rdx, rcx
movabs rcx, 0x200000000
and rax, rcx
mov rcx, rdx
bts rcx, 0x11
test rax, rax
mov rax, r9
cmove rcx, rdx
movabs rdx, 0x20000000000
and rax, rdx
mov rdx, rcx
or rdx, 2
test rax, rax
mov rax, r9
cmove rdx, rcx
movabs rcx, 0x8000000000000
and rax, rcx
mov rcx, rdx
or rcx, 4
test rax, rax
mov rax, r9
cmove rcx, rdx
movabs rdx, 0x10000000000000
and rax, rdx
mov rdx, rcx
or rdx, 8
test rax, rax
mov rax, r9
cmove rdx, rcx
movabs rcx, 0x200000000000000
mov r8, rdx
bts r8, 0x10
and rax, rcx
movabs rax, 0x4000000000000000
cmove r8, rdx
test rax, r9
je 0x180062be0
bts r8, 0x12
jmp 0x180062be0
mov ebx, dword [rbp - 0x34]
test sil, sil
je 0x180062bf7
mov eax, ebx
shr rax, 8
movzx ecx, al
shl rcx, 3
mov qword [r10], rcx
jmp 0x180062c0e
test dil, dil
je 0x180062c0e
mov eax, 0x80000005
xor ecx, ecx
cpuid
movzx eax, cl
mov qword [r10], rax
mov dword [rbp - 0x30], ecx
cmp r11d, 7
jb 0x180062ca5
xor ecx, ecx
mov eax, 7
cpuid
mov eax, ebx
mov rdx, r8
or rdx, 0x10
mov r9d, ecx
shl r9, 0x20
or r9, rax
movzx eax, r9b
and al, 0x20
cmove rdx, r8
test r9b, 8
je 0x180062c55
bts rdx, 0xd
bt r9, 8
jae 0x180062c55
bts rdx, 0xb
mov rcx, rdx
mov rax, r9
and eax, 0x10000
or rcx, 0x20
test rax, rax
mov rax, r9
cmove rcx, rdx
and eax, 0x40000
mov rdx, rcx
bts rdx, 0x13
test rax, rax
mov rax, r9
cmove rdx, rcx
and eax, 0x80000
mov r8, rdx
bts r8, 0xc
test rax, rax
cmove r8, rdx
bt r9, 0x1d
jae 0x180062ca5
bts r8, 0x14
test r8, r8
mov eax, 0x401
cmovne rax, r8
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18015e5e0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x180096a50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
cmp r9, 0x10
jb 0x180096a97
mov r11, r9
shr r11, 4
imul rax, r11, 0xfffffffffffffff0
add r9, rax
nop dword [rax + rax]
mov rdx, qword [r10 + 8]
mov rax, qword [r10]
add r10, 0x10
xor rdx, qword [r8 + 8]
xor rax, qword [r8]
add r8, 0x10
mov qword [rcx], rax
mov qword [rcx + 8], rdx
add rcx, 0x10
sub r11, 1
jne 0x180096a70
xor r11d, r11d
test r9, r9
je 0x180096b64
cmp r9, 0x20
jb 0x180096b3e
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x180096ac5
cmp rdx, r8
jae 0x180096b3e
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x180096ad6
cmp rdx, r10
jae 0x180096b3e
mov qword [rsp + 0x10], rbx
mov rdx, r10
mov qword [rsp], rdi
sub rdx, r8
mov rdi, r9
mov rbx, rcx
and rdi, 0xffffffffffffffe0
mov rax, r8
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r11, 0x20
movdqu xmm1, xmmword [rdx + rax]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm1
movdqu xmm2, xmmword [rdx + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x10], xmm2
cmp r11, rdi
jne 0x180096b00
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
je 0x180096b64
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180096b50
add rsp, 8
ret
Function at 0x180097fb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1802609a8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r15, r8
mov r12, rdx
mov rsi, rcx
mov edx, 0x40
lea rcx, [rsp + 0x28]
call fcn.180032ca0
nop
mov rax, rsi
shl rax, 7
lea rdx, [r12 - 0x40]
add rdx, rax
mov r8d, 0x40
mov rbp, qword [rsp + 0x28]
mov rcx, rbp
call fcn.18017c7f0
test rsi, rsi
je 0x180098121
mov rbx, r15
mov rdi, r12
sub rdi, r15
lea r14, [rsi + rsi]
nop
lea r8, [rdi + rbx]
mov rax, rbp
mov r9d, 4
nop dword [rax]
mov rdx, qword [rax]
xor rdx, qword [r8]
mov rcx, qword [rax + 8]
xor rcx, qword [r8 + 8]
mov qword [rax], rdx
mov qword [rax + 8], rcx
lea rax, [rax + 0x10]
lea r8, [r8 + 0x10]
sub r9, 1
jne 0x180098040
movups xmm0, xmmword [rbp]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rsp + 0x70], xmm1
lea r8d, [r9 + 8]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.1800ff690
mov r8d, 0x40
mov rdx, rbp
mov rcx, rbx
call fcn.18017c7f0
add rbx, 0x40
sub r14, 1
jne 0x180098030
test rsi, rsi
je 0x180098121
mov rbx, r12
mov rdi, r15
mov r14, rsi
nop word [rax + rax]
mov r8d, 0x40
mov rdx, rdi
mov rcx, rbx
call fcn.18017c7f0
sub rdi, 0xffffffffffffff80
add rbx, 0x40
sub r14, 1
jne 0x1800980d0
test rsi, rsi
je 0x180098121
mov rbx, rsi
shl rbx, 6
add rbx, r12
lea rdi, [r15 + 0x40]
mov r8d, 0x40
mov rdx, rdi
mov rcx, rbx
call fcn.18017c7f0
add rbx, 0x40
sub rdi, 0xffffffffffffff80
sub rsi, 1
jne 0x180098102
test rbp, rbp
je 0x18009813d
mov rdx, qword [rsp + 0x38]
sub rdx, rbp
mov r8d, 1
mov rcx, rbp
call fcn.1800302d0
nop
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18015e5e0
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180098160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x20
mov rbx, rcx
mov r15, r9
shl rbx, 7
mov rbp, r8
mov r13, rdx
mov r12, rcx
test rdx, rdx
je 0x1800981d5
mov qword [rsp + 0x50], r14
mov rsi, rdx
mov r14, rbx
imul r14, r13
xor edi, edi
nop
test rbx, rbx
je 0x1800981b6
mov rcx, qword [r15]
mov r8, rbx
add rcx, rdi
mov rdx, rbp
call fcn.18017c7f0
mov r8, qword [r15]
mov rdx, rbp
add r8, r14
mov rcx, r12
call fcn.180097fb0
add rdi, rbx
sub rsi, 1
jne 0x1800981a0
mov r14, qword [rsp + 0x50]
test r13, r13
je 0x18009827c
mov rdi, rbx
lea rsi, [r13 - 1]
imul rdi, r13
nop dword [rax]
mov r8d, dword [rbx + rbp - 0x40]
mov r9, rbx
and r8, rsi
mov rax, rbp
imul r8, rbx
add r8, qword [r15]
cmp rbx, 0x10
jb 0x180098240
mov r10, rbx
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rbx
nop dword [rax]
mov rdx, qword [r8 + 8]
xor rdx, qword [rax + 8]
mov rcx, qword [r8]
add r8, 0x10
xor qword [rax], rcx
mov qword [rax + 8], rdx
add rax, 0x10
sub r10, 1
jne 0x180098220
test r9, r9
je 0x180098261
sub r8, rax
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x180098250
mov r8, qword [r15]
mov rdx, rbp
add r8, rdi
mov rcx, r12
call fcn.180097fb0
sub r13, 1
jne 0x1800981f0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18009de90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r14
mov rax, qword [rdx + 8]
xor edi, edi
sub rax, qword [rdx]
mov rbx, r8
mov r14, rdx
mov rbp, rcx
cmp rax, 4
jb 0x18009e017
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r12
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x38], r13
mov r13, qword [rsp + 0x48]
mov qword [rsp + 0x40], r15
mov r15, qword [rsp + 0x50]
test r15, r15
je 0x18009df0a
xor edx, edx
lea rax, [rdi + r12]
mov rcx, r15
shr rcx, 2
div rcx
mov eax, dword [r13 + rdx*4]
xor edx, edx
bswap eax
xor dword [rbx], eax
lea rax, [r12 + 1]
add rax, rdi
div rcx
mov eax, dword [r13 + rdx*4]
bswap eax
xor dword [r9], eax
xor esi, esi
nop dword [rax]
mov rax, qword [rbp + 0x20]
mov ecx, dword [rsi + rax]
xor dword [rbx], ecx
mov r10d, dword [rbx]
mov eax, r10d
mov r11, qword [rbp + 8]
shr rax, 0x10
movzx edx, al
mov eax, r10d
shr eax, 0x18
movzx ecx, al
mov eax, r10d
shr rax, 8
mov r8d, dword [r11 + rdx*4 + 0x400]
add r8d, dword [r11 + rcx*4]
movzx ecx, al
movzx eax, r10b
add eax, 0x300
xor r8d, dword [r11 + rcx*4 + 0x800]
add r8d, dword [r11 + rax*4]
xor dword [r9], r8d
mov rax, qword [rbp + 0x20]
mov r11d, dword [rsi + rax + 4]
add rsi, 8
xor r11d, dword [r9]
mov dword [r9], r11d
mov eax, r11d
mov r10, qword [rbp + 8]
shr eax, 0x10
movzx edx, al
mov eax, r11d
shr eax, 0x18
movzx ecx, al
mov eax, r11d
shr eax, 8
mov r8d, dword [r10 + rdx*4 + 0x400]
add r8d, dword [r10 + rcx*4]
movzx ecx, al
movzx eax, r11b
add eax, 0x300
xor r8d, dword [r10 + rcx*4 + 0x800]
add r8d, dword [r10 + rax*4]
xor dword [rbx], r8d
cmp rsi, 0x40
jne 0x18009df10
mov rax, qword [rbp + 0x20]
mov edx, dword [r9]
mov ecx, dword [rax + 0x40]
xor ecx, dword [rbx]
mov dword [r9], ecx
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x44]
xor ecx, edx
mov dword [rbx], ecx
mov rax, qword [r14]
mov dword [rax + rdi*4], ecx
mov eax, dword [r9]
mov rcx, qword [r14]
mov dword [rcx + rdi*4 + 4], eax
add rdi, 2
mov rax, qword [r14 + 8]
sub rax, qword [r14]
sar rax, 2
cmp rdi, rax
jne 0x18009ded5
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x18009e020
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rbx, qword [rsp + 0x80]
mov rbp, r9
mov r11, r8
mov rsi, rdx
mov rdi, rcx
test bl, 3
jne 0x18009e156
mov qword [rsp + 0x60], r14
xor r10d, r10d
mov r9d, 2
nop
xor edx, edx
mov r8, qword [rdi + 0x20]
lea rax, [r9 - 2]
div r11
lea rax, [r9 - 1]
movzx ecx, byte [rdx + rsi]
xor edx, edx
div r11
shl ecx, 8
movzx eax, byte [rdx + rsi]
xor edx, edx
or ecx, eax
mov rax, r9
div r11
shl ecx, 8
movzx eax, byte [rdx + rsi]
xor edx, edx
or ecx, eax
lea rax, [r9 + 1]
div r11
shl ecx, 8
add r9, 4
movzx eax, byte [rdx + rsi]
or ecx, eax
xor dword [r8 + r10], ecx
add r10, 4
cmp r10, 0x48
jne 0x18009e060
test rbx, rbx
je 0x18009e0d3
mov rcx, rbx
xor edx, edx
shr rcx, 2
mov eax, 0x12
div rcx
mov rsi, rdx
jmp 0x18009e0d5
xor esi, esi
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x40]
lea rdx, [rdi + 0x20]
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x80], 0
call fcn.18009de90
mov qword [rsp + 0x30], rsi
lea rdx, [rdi + 8]
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call fcn.18009de90
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
lea r9, str.gold
mov dword [rsp + 0x20], 0x14a
lea r8, [0x1801cf040]
lea rdx, [0x1801ba248]
lea rcx, str.salt_length___4__0
call fcn.1800401f0
int3

Function at 0x18009e180
Capabilities:
Encrypt data using blowfish

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
mov edx, 0x12
add rcx, 0x20
mov rdi, r8
call fcn.180036620
mov rcx, qword [rbp + 0x20]
lea rdx, [0x1801cdff0]
mov r8d, 0x48
call fcn.18017c7f0
mov edx, 0x400
lea rcx, [rbp + 8]
call fcn.180036620
mov rcx, qword [rbp + 8]
lea rdx, [0x1801ce040]
mov r8d, 0x1000
call fcn.18017c7f0
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.18009e020
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18009e220
Capabilities:
Encrypt data using camellia

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r10, rcx
lea r12, [0x1801d3080]
xor r10, rdx
mov rax, r10
shr rax, 0x38
movzx r15d, byte [rax + r12]
mov rax, r10
shr rax, 0x20
rol al, 1
movzx eax, al
movzx r14d, byte [rax + r12]
mov rax, r10
shr rax, 8
mov r8d, r14d
rol al, 1
xor r8, r15
movzx eax, al
movzx ebp, byte [rax + r12]
movzx eax, r10b
movzx esi, byte [rax + r12]
mov rax, r10
shr rax, 0x10
mov edi, esi
movzx ecx, al
xor rdi, rbp
xor rbp, r14
mov r11, rdi
movzx eax, byte [rcx + r12]
ror al, 1
movzx r9d, al
mov rax, r10
shr rax, 0x28
xor r11, r9
movzx ecx, al
movzx eax, byte [rcx + r12]
ror al, 1
movzx ebx, al
mov rax, r10
shr rax, 0x18
movzx ecx, al
shr r10, 0x30
movzx eax, byte [rcx + r12]
rol al, 1
movzx edx, al
movzx eax, r10b
xor rdi, rdx
xor rsi, rdx
xor rbp, rdx
xor rsi, r9
xor rbp, r9
movzx ecx, byte [rax + r12]
rol cl, 1
movzx r10d, cl
mov rcx, r11
xor rcx, rbx
mov eax, r10d
xor rax, rdi
xor rcx, r8
xor rax, r8
shl rcx, 8
or rcx, rax
mov eax, r15d
xor rax, r10
shl rcx, 8
xor rax, rbx
xor rax, rsi
or rcx, rax
mov eax, r10d
xor rax, rbx
shl rcx, 8
xor rax, rbp
or rcx, rax
mov eax, r15d
xor rax, r11
shl rcx, 8
xor rax, r10
xor r10, rbx
or rax, rcx
xor r10, rdi
shl rax, 8
or rax, r10
mov rdi, qword [rsp + 0x38]
xor r14, rbx
mov rbx, qword [rsp + 0x20]
xor r14, rsi
mov rsi, qword [rsp + 0x30]
xor r15, rbp
mov rbp, qword [rsp + 0x28]
shl rax, 8
or rax, r14
shl rax, 8
or rax, r15
pop r15
pop r14
pop r12
ret