joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180023c80
Capabilities:
Reference http user-agent string

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
xor esi, esi
mov qword [rax - 0x28], rsi
mov qword [rax - 0x18], rsi
mov qword [rax - 0x10], 0xf
mov byte [rax - 0x28], sil
lea r8d, [rsi + 0xa]
lea rdx, str.User_Agent
lea rcx, [rax - 0x28]
call fcn.180005110
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x10]
call fcn.180032cd0
lea r8d, [rsi + 0x6e]
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_63.0.3239.132_Safari_537.36
mov rcx, rax
call fcn.180005110
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x180023d1d
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023d18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023e3b
call fcn.18016015c
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], select
mov byte [rsp + 0x20], 0
mov r8d, 6
lea rdx, str.Accept
lea rcx, [rsp + 0x20]
call fcn.180005110
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x10]
call fcn.180032cd0
mov r8d, 3
lea rdx, [0x1801c55d8]
mov rcx, rax
call fcn.180005110
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x180023dae
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180023da9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180023e35
call fcn.18016015c
mov dword [rbx + 0x158], 1
lea rcx, [rbx + 0x180]
mov r8d, 4
lea rdx, str.http
call fcn.180005110
lea rcx, [rbx + 0x1a0]
mov r8d, 9
lea rdx, str.127.0.0.1
call fcn.180005110
mov dword [rbx + 0x1c0], 0x50
lea rcx, [rbx + 0x1c8]
mov r8d, 1
lea rdx, [0x1801c4124]
call fcn.180005110
mov dword [rbx + 0x220], esi
mov eax, dword [rbx + 0x224]
and eax, 0xfffffffd
or eax, 1
mov dword [rbx + 0x224], eax
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.180166c48
int3
call fcn.180166c48
int3

Function at 0x1800285c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, str.C:inetpublogs1.log
xor r9d, r9d
mov dword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18002867d
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, eax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov r8d, 2
lea rdx, [0x1801c4484]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18015fd80
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x180032410
Capabilities:
Timestomp file

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x18], 0x10
mov rbx, rdx
jb 0x180032436
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2000000
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp qword [rbx + 0x18], 0x10
mov rdi, rax
jb 0x18003246e
mov rbx, qword [rbx]
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0x100
mov rcx, rbx
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov rcx, rdi
lea r8, [rsp + 0x48]
mov rbx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x1800324d3
lea r9, [rsp + 0x40]
mov rcx, rbx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18015fd80
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x1800328d0
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18003295f
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x180032959
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x44], rax
xor edx, edx
xor eax, eax
mov dword [rsp + 0x40], 1
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], rax
lea r9d, [rax + 0x10]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18015fd80
add rsp, 0x68
ret
Function at 0x18003d220
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov eax, dword [rsp + 0x70]
mov r14d, r8d
mov ebx, r9d
mov rbp, rdx
mov rdi, rcx
mov r8d, 0x1388
test eax, eax
jle 0x18003d261
imul eax, eax, 0x3e8
cmp eax, r8d
cmovl r8d, eax
mov edx, r14d
mov rcx, rbp
call fcn.180043810
movsxd rsi, eax
test eax, eax
jns 0x18003d2e6
mov ecx, 2
call fcn.1801671d4
mov rcx, rax
lea rdx, str._connect__s:_d_failed__n
mov r9d, r14d
mov r8, rbp
call fcn.1800221e0
mov edx, 0x5c
lea rcx, str.C:devlibhvhttpclienthttp_client.cpp
call fcn.1801622bc
lea rbx, [rax + 1]
call fcn.180042760
mov rcx, rax
lea r8, str.connect__s:_d_failed____s:_d:_s__n
lea rax, str.http_client_connect
mov r9, rbp
mov qword [rsp + 0x38], rax
mov edx, 4
mov dword [rsp + 0x30], 0x1b5
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], r14d
call fcn.180042c90
jmp 0x18003d465
mov edx, 6
mov dword [rsp + 0x70], 1
lea r9, [rsp + 0x70]
mov dword [rsp + 0x20], 4
mov rcx, rsi
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test ebx, ebx
je 0x18003d45f
cmp qword [rdi + 0xb0], 0
jne 0x18003d45f
mov rax, qword [rdi + 0xb8]
test rax, rax
jne 0x18003d368
mov rax, qword [0x1801edbf0]
test rax, rax
jne 0x18003d368
xor ecx, ecx
call fcn.180042700
mov qword [rdi + 0xb8], rax
mov byte [rdi + 0xc0], 1
test rax, rax
jne 0x18003d368
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xfffffbef
jmp 0x18003d467
mov edx, esi
mov rcx, rax
call fcn.180042730
mov qword [rdi + 0xb0], rax
test rax, rax
jne 0x18003d391
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xfffffbee
jmp 0x18003d467
mov rcx, rbp
call fcn.180043950
test al, al
jne 0x18003d3b8
mov rcx, rbp
call fcn.180043990
test al, al
jne 0x18003d3b8
mov rcx, qword [rdi + 0xb0]
mov rdx, rbp
call fcn.1800426e0
mov rcx, qword [rdi + 0xb0]
call fcn.1800426e0
mov ebp, eax
test eax, eax
je 0x18003d45f
mov ecx, 2
call fcn.1801671d4
mov rcx, rax
lea rdx, str._ssl_handshake_failed:__d_n
mov r8d, ebp
call fcn.1800221e0
mov edx, 0x5c
lea rcx, str.C:devlibhvhttpclienthttp_client.cpp
call fcn.1801622bc
lea rbx, [rax + 1]
call fcn.180042760
mov rcx, rax
lea r8, str.ssl_handshake_failed:__d___s:_d:_s__n
lea rax, str.http_client_connect
mov r9d, ebp
mov qword [rsp + 0x30], rax
mov edx, 4
mov dword [rsp + 0x28], 0x1d4
mov qword [rsp + 0x20], rbx
call fcn.180042c90
mov rcx, qword [rdi + 0xb0]
call fcn.1800426f0
mov rcx, rsi
mov qword [rdi + 0xb0], 0
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebp
cdq
xor eax, edx
sub eax, edx
neg eax
jmp 0x18003d467
mov dword [rdi + 0xa8], esi
mov eax, esi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800436c0
Capabilities:
Connect socket
Initialize winsock library
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx eax, byte [0x1801edb20]
mov esi, r8d
mov byte [0x1801edb20], 1
mov edi, edx
mov rbx, rcx
test al, al
jne 0x18004370e
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
lea rcx, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp + 0x38], rax
mov r8d, edi
mov dword [rsp + 0x40], eax
mov rdx, rbx
movups xmmword [rsp + 0x28], xmm0
call fcn.1800439d0
test eax, eax
je 0x180043741
cdq
xor eax, edx
sub eax, edx
neg eax
jmp 0x1800437de
movzx ecx, word [rsp + 0x28]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
test eax, eax
jns 0x180043768
lea rcx, str.socket
call fcn.180177004
jmp 0x1800437c7
movsxd rdi, eax
test esi, esi
je 0x18004378a
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 1
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp word [rsp + 0x28], 2
lea rdx, [rsp + 0x28]
mov eax, reloc.WS2_32.dll_recv
mov r8d, 0x1c
cmove r8d, eax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x1800437dc
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1800437dc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
test eax, eax
jle 0x1800437d7
neg ebx
jmp 0x1800437dc
mov ebx, 0xffffffff
mov eax, ebx
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.18015fd80
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180043810
Capabilities:
Get socket status
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edi, r8d
mov r8d, 1
call fcn.1800436c0
movsxd rbx, eax
test eax, eax
js 0x180043929
mov eax, 0x10624dd3
mov dword [rsp + 0x30], 4
imul edi
lea ecx, [rbx + 1]
mov qword [rsp + 0x58], rbx
sar edx, 6
lea r8, [rsp + 0x50]
mov eax, edx
mov dword [rsp + 0x50], 1
shr eax, 0x1f
xor r9d, r9d
add edx, eax
imul eax, edx, 0x3e8
mov dword [rsp + 0x40], edx
xor edx, edx
sub edi, eax
imul eax, edi, 0x3e8
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jns 0x1800438ca
lea rcx, str.select
call fcn.180177004
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
test eax, eax
jle 0x180043924
neg ebx
jmp 0x180043929
jne 0x1800438d9
call fcn.180174ca4
mov dword [rax], 0x8a
jmp 0x1800438b1
lea rax, [rsp + 0x30]
mov edx, 0xffff
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov r8d, 0x1007
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x1800438b1
cmp dword [rsp + 0x34], 0
jne 0x1800438b1
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 0
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
jmp 0x180043929
mov ebx, 0xffffffff
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18015fd80
mov rbx, qword [rsp + 0x298]
add rsp, 0x270
pop rdi
ret

Function at 0x180043950
Capabilities:
Convert ip address from string

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdx, rcx
lea r8, [rsp + 0x20]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
sete al
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18015fd80
add rsp, 0x48
ret

Function at 0x180043990
Capabilities:
Convert ip address from string

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
lea r8, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
sete al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18015fd80
add rsp, 0x58
ret
Function at 0x1800439d0
Capabilities:
Convert ip address from string
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x180043adb
cmp byte [rdx], 0
je 0x180043adb
movzx eax, byte [0x1801edb20]
mov byte [0x1801edb20], 1
test al, al
jne 0x180043a2e
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov esi, 2
lea r8, [rbx + 4]
mov ecx, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x180043a51
mov word [rbx], si
xor esi, esi
jmp 0x180043ad3
mov esi, reloc.WS2_32.dll_socket
lea r8, [rbx + 8]
mov ecx, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x180043a6d
mov word [rbx], si
xor esi, esi
lea r9, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x180043ad1
mov rdi, qword [rsp + 0x20]
test rdi, rdi
je 0x180043ad1
cmp qword [rdi + 0x20], rsi
je 0x180043ad1
cmp qword [rdi + 0x10], rsi
je 0x180043ad1
mov rdx, rdi
cmp dword [rdx + 4], 2
je 0x180043ab6
mov rdx, qword [rdx + 0x28]
test rdx, rdx
jne 0x180043aa4
mov rdx, rdi
mov r8, qword [rdx + 0x10]
mov rcx, rbx
mov rdx, qword [rdx + 0x20]
call fcn.1801625a0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x180043ad3
mov esi, eax
test esi, esi
je 0x180043aee
mov eax, esi
jmp 0x180043b0c
mov esi, 2
mov word [rcx], si
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_htonl]
mov dword [rbx + 4], eax
movzx eax, word [rbx]
cmp ax, 2
je 0x180043afd
cmp ax, 0x17
jne 0x180043b0a
movzx ecx, bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rbx + 2], ax
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.18015fd80
mov rbx, qword [rsp + 0x218]
add rsp, 0x1e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800703e0
Capabilities:
Hash data with md5

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rsp + 0xb8], rax
movups xmm0, xmmword [r9]
mov r14, qword [rsp + 0x110]
mov eax, edx
mov r15, qword [rsp + 0x120]
mov edi, edx
xor ebx, ebx
mov byte [r11 - 0x48], dil
test r8d, r8d
mov dword [r11 - 0x44], 0x546c4173
mov ebp, r8d
mov dword [rsp + 0x30], 0x67452301
sete bl
mov dword [rsp + 0x34], 0xefcdab89
sar eax, 8
mov rsi, rcx
mov byte [r11 - 0x47], al
lea rcx, [rsp + 0x30]
mov eax, edx
mov dword [rsp + 0x38], 0x98badcfe
sar eax, 0x10
mov r8d, 0x18
mov byte [r11 - 0x46], al
mov eax, edx
sar eax, 0x18
lea rdx, [r11 - 0x58]
mov byte [r11 - 0x45], al
movups xmmword [r11 - 0x58], xmm0
mov qword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x44], 0
call fcn.180071630
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.180070c90
lea r8, [rsp + 0xa8]
mov edx, edi
mov rcx, rsi
call fcn.180070a80
mov rcx, qword [rsi + 0x30]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x90]
mov r8d, ebx
mov dword [rsp + 0x20], 0
mov edx, 1
call fcn.1800733a0
mov eax, dword [rsp + 0x118]
mov r9, r15
mov rcx, qword [rsi + 0x30]
mov rdx, r14
lea r8d, [rax*8]
test ebp, ebp
je 0x18007050a
call fcn.180072690
jmp 0x18007050f
call fcn.1800721c0
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.18015fd80
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180070a80
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea ecx, [rdx + 1]
mov rbx, r8
mov eax, 0x4f7a09cd
imul ecx
imul ecx, ecx, 0x9ef4
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul ecx, r8d, 0x9ef4
mov eax, r8d
sar eax, 8
mov byte [rbp + 0x38], al
mov eax, r8d
sar eax, 0x10
mov byte [rbp + 0x39], al
mov eax, r8d
sar eax, 0x18
mov byte [rbp + 0x3a], al
mov eax, 0x4f7a09cd
imul r8d
mov byte [rbp + 0x37], r8b
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul ecx, r8d, 0x9ef4
mov eax, r8d
sar eax, 8
mov byte [rbp + 0x3c], al
mov eax, r8d
sar eax, 0x10
mov byte [rbp + 0x3d], al
mov eax, r8d
sar eax, 0x18
mov byte [rbp + 0x3e], al
mov eax, 0x4f7a09cd
imul r8d
mov byte [rbp + 0x3b], r8b
sar edx, 0xe
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7fffff07
sub ecx, eax
mov eax, 0x4f7a09cd
lea r8d, [rcx + 0x7fffff07]
cmovns r8d, ecx
imul r8d
mov ecx, r8d
mov byte [rbp + 0x3f], r8b
sar ecx, 8
mov byte [rbp + 0x40], cl
mov ecx, r8d
sar ecx, 0x10
sar edx, 0xe
mov byte [rbp + 0x41], cl
mov eax, edx
shr eax, 0x1f
mov ecx, r8d
add edx, eax
sar ecx, 0x18
imul eax, edx, 0x7fffff07
mov byte [rbp + 0x42], cl
imul ecx, r8d, 0x9ef4
sub ecx, eax
lea edx, [rcx + 0x7fffff07]
cmovns edx, ecx
mov eax, edx
mov byte [rbp + 0x43], dl
sar eax, 8
mov byte [rbp + 0x44], al
mov eax, edx
sar eax, 0x10
lea rcx, [rbp - 0x29]
sar edx, 0x18
mov byte [rbp + 0x45], al
xor eax, eax
mov byte [rbp + 0x46], dl
lea rdx, [rbp + 0x37]
mov dword [rbp - 0x29], 0x67452301
mov dword [rbp - 0x25], 0xefcdab89
lea r8d, [rax + 0x10]
mov dword [rbp - 0x21], 0x98badcfe
mov qword [rbp - 0x1d], 0x10325476
mov dword [rbp - 0x15], eax
call fcn.180071630
lea rdx, [rbp - 0x29]
mov rcx, rbx
call fcn.180070c90
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18015fd80
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rbp
ret
Function at 0x180073660
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1801eab50]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15d, dword [rcx + 0x1c]
xor edi, edi
sub r15d, 6
xor r14d, r14d
movsxd rbx, r15d
mov rsi, rcx
test r15d, r15d
jle 0x180073712
mov r8, rbx
lea rcx, [rbp - 0x30]
shl r8, 2
call fcn.1801625a0
xor r8d, r8d
xor edx, edx
cmp edi, dword [rsi + 0x1c]
ja 0x1800737f9
cmp r8, rbx
jge 0x1800736e7
cmp rdx, 4
jge 0x1800736e7
mov eax, edi
inc r14d
lea rcx, [rdx + rax*4]
mov eax, dword [rbp + r8*4 - 0x30]
inc r8
mov dword [rsi + rcx*4 + 0x20], eax
inc rdx
cmp r8, rbx
jl 0x1800736c4
cmp rdx, 4
lea eax, [rdi + 1]
cmovne eax, edi
mov edi, eax
xor eax, eax
cmp rdx, 4
cmovne eax, r14d
mov r14d, eax
xor eax, eax
cmp rdx, 4
cmovne rax, rdx
mov rdx, rax
cmp r8, rbx
jl 0x1800736b6
cmp edi, dword [rsi + 0x1c]
ja 0x1800737f9
movsxd rax, r14d
lea r9, [0x1801eaaa0]
lea r10, str.cw
nop dword [rax]
movzx ecx, byte [rbp + rbx*4 - 0x33]
lea r9, [r9 + 4]
movzx edx, byte [rbp - 0x30]
xor dl, byte [rcx + r10]
mov byte [rbp - 0x30], dl
movzx ecx, byte [rbp + rbx*4 - 0x32]
xor dl, byte [r9 - 4]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x2f], cl
movzx ecx, byte [rbp + rbx*4 - 0x31]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x2e], cl
movzx ecx, byte [rbp + rbx*4 - 0x34]
mov byte [rbp - 0x30], dl
mov edx, 1
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x2d], cl
cmp r15d, 8
je 0x180073820
cmp rdx, rbx
jge 0x1800737a0
nop word [rax + rax]
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, rbx
jl 0x180073790
test r15d, r15d
jle 0x1800737f0
xor r8d, r8d
cmp edi, dword [rsi + 0x1c]
ja 0x1800737f9
cmp r8, rbx
jge 0x1800737d2
cmp rax, 4
jge 0x1800737d2
mov ecx, edi
lea rdx, [rax + rcx*4]
mov ecx, dword [rbp + r8*4 - 0x30]
inc r8
mov dword [rsi + rdx*4 + 0x20], ecx
inc rax
cmp r8, rbx
jl 0x1800737b2
cmp rax, 4
lea ecx, [rdi + 1]
cmovne ecx, edi
mov edi, ecx
xor ecx, ecx
cmp rax, 4
cmovne rcx, rax
mov rax, rcx
cmp r8, rbx
jl 0x1800737a8
cmp edi, dword [rsi + 0x1c]
jbe 0x180073730
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18015fd80
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, 4
jl 0x180073820
movzx ecx, byte [rbp - 0x24]
mov edx, 5
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x20], cl
movzx ecx, byte [rbp - 0x23]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1f], cl
movzx ecx, byte [rbp - 0x22]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1e], cl
movzx ecx, byte [rbp - 0x21]
movzx ecx, byte [rcx + r10]
xor byte [rbp - 0x1d], cl
cmp rdx, rbx
jge 0x1800737a0
nop
mov ecx, dword [rbp + rdx*4 - 0x34]
xor dword [rbp + rdx*4 - 0x30], ecx
inc rdx
cmp rdx, rbx
jl 0x180073870
jmp 0x1800737a5
Function at 0x180087a00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, qword [rcx + 0x10]
lea rsi, [0x1801a59b0]
xor r9d, r9d
mov rdi, rdx
mov r11, rcx
test rbx, rbx
je 0x180087a6d
movzx eax, byte [rdx]
mov r10, rdx
test al, al
je 0x180087a52
movzx eax, al
lea r10, [r10 + 1]
movzx ecx, byte [rax + rsi]
lea eax, [r9*8]
xor ecx, eax
movzx eax, byte [r10]
xor r9d, ecx
test al, al
jne 0x180087a32
mov eax, r9d
xor edx, edx
div dword [r11]
mov eax, edx
add rax, rax
mov r9d, edx
mov r10, qword [rbx + rax*8 + 8]
mov r11d, dword [rbx + rax*8]
jmp 0x180087a75
mov r10, qword [rcx + 8]
mov r11d, dword [rcx + 4]
mov dword [r8], r9d
test r11d, r11d
je 0x180087ad7
movzx eax, byte [rdi]
movzx ebx, byte [rax + rsi]
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r10 + 0x18]
dec r11d
movzx r8d, byte [rax]
movzx ecx, byte [r8 + rsi]
cmp ecx, ebx
jne 0x180087acf
mov r9, rdi
sub r9, rax
nop word [rax + rax]
test r8b, r8b
je 0x180087ae9
movzx ecx, byte [r9 + rax + 1]
inc rax
movzx edx, byte [rcx + rsi]
movzx r8d, byte [rax]
movzx ecx, byte [r8 + rsi]
cmp ecx, edx
je 0x180087ab0
mov r10, qword [r10]
test r11d, r11d
jne 0x180087a90
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
mov rbx, qword [rsp + 0x10]
mov rax, r10
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret