joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801d8f30
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edi, 0x80
mov r10, rcx
mov byte [rcx], 0
cmp edx, edi
mov ebx, 0x400
cmovg edx, edi
test r9d, r9d
jle 0x1801d8f63
cmp r9d, ebx
cmovg r9d, ebx
mov ebx, r9d
movsxd r9, edx
test edx, edx
jle 0x1801d8f80
sub r8, r10
mov rdx, r9
movzx eax, byte [r8 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1801d8f70
movzx ecx, byte [r9 + r10 - 1]
lea rdx, [r9 + r10]
lea rsi, [0x1802a6c20]
cmp r9, rdi
jge 0x1801d8fc9
mov r11, r9
mov r8, rdi
neg r11
sub r8, r9
nop word [rax + rax]
movzx eax, byte [rdx + r11]
inc rdx
add eax, ecx
dec r8
movzx ecx, al
movzx ecx, byte [rcx + rsi]
mov byte [rdx - 1], cl
jne 0x1801d8fb0
lea edx, [rbx + 7]
neg ebx
mov eax, 0xff
sar edx, 3
and ebx, 7
sub edi, edx
movzx ecx, bl
movsxd r11, edx
sar eax, cl
movsxd r9, edi
mov ecx, eax
lea r8, [r9 + r10]
movzx eax, byte [r8]
and rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [r8], al
test edi, edi
je 0x1801d9018
nop
movzx ecx, byte [r8 + r11 - 1]
dec r8
xor rcx, rax
dec r9
movzx eax, byte [rcx + rsi]
mov byte [r8], al
jne 0x1801d9000
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop dword [rax]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
sub r8, 4
shl ecx, 8
sub rdx, 2
or ecx, eax
dec r9
movzx eax, cx
mov dword [r8 + 4], eax
jne 0x1801d9030
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1801de550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, qword [rbp + 0x68]
mov rax, qword [rbp + 0x60]
xor r13d, r13d
mov ebx, dword [r15]
mov qword [rbp - 0x28], r9
mov r12d, r8d
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], r15
test ebx, ebx
jns 0x1801de5ad
mov dword [r15], 0xffffffff
jmp 0x1801de731
movzx r8d, byte [rax]
movzx r9d, byte [rax + 4]
mov qword [rsp + 0x90], rdi
lea rdi, [rax + 1]
shl r8d, 0x18
shl r9d, 0x18
movzx eax, byte [rdi]
movzx ecx, byte [rdi + 5]
lea rdx, [rdi + 5]
shl eax, 0x10
shl ecx, 8
or r8d, eax
movzx eax, byte [rdi + 1]
shl eax, 8
or r8d, eax
movzx eax, byte [rdi + 2]
or r8d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
mov dword [rbp - 0x30], r8d
mov byte [rbp - 0xd], r8b
or r9d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r8d
shr eax, 0x18
or r9d, ecx
mov byte [rbp - 0x10], al
mov eax, r8d
mov dword [rbp - 0x2c], r9d
shr eax, 0x10
mov byte [rbp - 9], r9b
mov byte [rbp - 0xf], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1801de726
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r9b
movzx r10d, r8b
dec r12d
test ebx, ebx
jne 0x1801de6c3
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1801dd7c0
mov r8d, dword [rbp - 0x30]
mov r9d, dword [rbp - 0x2c]
mov eax, r8d
movzx edx, r9b
movzx r10d, r8b
shr eax, 0x18
mov byte [rbp - 0xd], r8b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r9d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1801de660
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1801de726
mov rcx, qword [rbp - 0x18]
mov eax, r8d
shr eax, 0x18
mov byte [rcx], al
mov eax, r8d
shr r8d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r8b
mov byte [rdi + 2], r10b
mov eax, r9d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r9d
shr eax, 0x10
shr r9d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r9b
mov byte [rdi + 6], dl
mov rdi, qword [rsp + 0x90]
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
Function at 0x1801e2df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x1801e2fac
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x1801e2f48
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1801def70
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1801e2ee2
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1801e2fac
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800acfa0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801e4750
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call fcn.1800b45b0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1801e61b9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1801e63b7
push rbp
mov eax, 0xe0
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
lea rsi, [r8 - 1]
mov qword [rsp + 0xc0], r13
shr rsi, 3
mov rbp, rdx
lea r12, [rcx + 0xc]
inc rsi
lea r13, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.1801c09d0
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.1801c0a30
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.1801def70
mov rcx, r13
call fcn.1801c09d0
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.1801c0a30
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.1801def70
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
dec rsi
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x1801e6220
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0xe0
pop rbp
repz ret
Function at 0x1801ebf30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
movsxd rsi, r8d
mov rdi, rdx
mov rbp, rcx
mov r8, rsi
call fcn.1800bd270
test eax, eax
jle case.0x1801ec019.2
xor r8d, r8d
test esi, esi
jle 0x1801ebf97
mov rdx, rbp
mov r9, rdi
mov rcx, rdi
sub rdx, rdi
neg r9
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [rdx + rcx], al
jne 0x1801ebf97
inc rcx
inc r8d
lea rax, [r9 + rcx]
cmp rax, rsi
jl 0x1801ebf80
lea edx, [rsi - 1]
movsxd rcx, edx
test edx, edx
js 0x1801ebfc6
mov r9, rbp
lea rax, [rcx + rdi]
sub r9, rdi
nop dword [rax + rax]
cmp byte [rax + r9], 0
jne 0x1801ebfc6
cmp byte [rax], 0xff
jne 0x1801ebfc6
dec edx
dec rax
dec rcx
jns 0x1801ebfb0
cmp r8d, edx
jl case.0x1801ec019.2
jle 0x1801ebfde
lea eax, [r8*8]
jmp 0x1801ec060
movsxd rax, r8d
movzx r9d, byte [rax + rdi]
movzx r10d, byte [rax + rbp]
movzx edx, r9b
xor dl, r10b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x1801ec019.2
lea r11, [0x180000000]
cdqe
movzx eax, byte [r11 + rax + 0x1ec098]
mov ecx, dword [r11 + rax*4 + 0x1ec078]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x1801ec04a
mov eax, 6
jmp 0x1801ec04a
mov eax, 5
jmp 0x1801ec04a
mov eax, 4
jmp 0x1801ec04a
mov eax, 3
jmp 0x1801ec04a
mov eax, 2
jmp 0x1801ec04a
mov eax, 1
test dl, r10b
jne case.0x1801ec019.2
and r9b, dl
cmp r9b, dl
jne case.0x1801ec019.2
lea eax, [rax + r8*8]
jmp 0x1801ec060
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1801f9c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x1801f9c5c
mov rbx, r8
jmp 0x1801f9c62
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
call fcn.1800e43d0
test rax, rax
jne 0x1801f9c7f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x1801f9cb4
mov r9d, r8d
nop dword [rax + rax]
mov rax, qword [rsi]
mov rcx, qword [rbx]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x1801f9c90
movsxd rdx, r8d
cmp r8d, dword [rbx + 8]
jge 0x1801f9cdd
shl rdx, 3
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x1801f9cc1
mov eax, dword [rbx + 8]
mov rcx, rdi
mov dword [rdi + 8], eax
call fcn.1800e3af0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1801fd410
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r10, rdx
test rcx, rcx
je 0x1801fd42c
test byte [rcx + 0x5c], 2
lea r11, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x1801fd433
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test r9d, r9d
jle 0x1801fd51f
inc r8
nop
movzx ecx, byte [r8 - 1]
cmp r9d, 3
jl 0x1801fd4a3
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov edx, ecx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10], al
mov eax, ecx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 1], al
mov eax, ecx
shr rax, 6
and eax, 0x3f
and edx, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 2], al
movzx eax, byte [rdx + r11]
mov byte [r10 + 3], al
jmp 0x1801fd4fb
shl ecx, 0x10
cmp r9d, 2
jne 0x1801fd4b5
movzx eax, byte [r8]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [r10 + 1], al
cmp r9d, 1
jne 0x1801fd4e6
lea eax, [r9 + 0x3c]
jmp 0x1801fd4f2
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + r11]
mov byte [r10 + 2], al
mov byte [r10 + 3], 0x3d
sub r9d, 3
add r10, 4
add ebx, 4
add r8, 3
test r9d, r9d
jg 0x1801fd440
mov byte [r10], 0
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
mov byte [rdx], bl
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
Function at 0x1802000c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
mov eax, 0x78
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x3c]
mov rdi, r9
mov rbp, r8
mov r12, rdx
mov rsi, rcx
test eax, eax
je 0x1802001f8
dec eax
mov qword [rsp + 0x70], rbx
lea rbx, [rcx + 0x10]
mov dword [rcx + 0x3c], eax
mov rax, qword [rbx]
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x68], r13
mov r13, qword [rcx + 0x20]
mov qword [rsp + 0x40], rax
and byte [rsp + 0x40], 0x7f
and byte [rsp + 0x44], 0x7f
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call fcn.1800c55f0
test eax, eax
je 0x1802001ec
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov r9, r12
mov rdx, rbp
mov rcx, r13
mov dword [rsp + 0x20], eax
call fcn.1800c2c00
test eax, eax
je 0x1802001ec
lea rdx, [rsp + 0x48]
mov r9, rdi
mov r8, rbp
mov rcx, rsi
call fcn.1801ffaa0
test eax, eax
je 0x1802001ec
lea rax, [rsp + 0x48]
xor r9d, r9d
sub rbx, rax
nop dword [rax + rax]
lea r8, [rsp + r9 + 0x48]
add r9, 4
movzx eax, byte [rbx + r8]
xor byte [r8], al
movzx eax, byte [rbx + r8 + 1]
xor byte [r8 + 1], al
movzx eax, byte [rbx + r8 + 2]
xor byte [r8 + 2], al
movzx eax, byte [rbx + r8 + 3]
xor byte [r8 + 3], al
cmp r9, 0x10
jl 0x1802001a0
mov rax, qword [rsp + 0x50]
or rax, qword [rsp + 0x48]
je 0x18020020f
mov rdx, rdi
mov rcx, rbp
call fcn.1800ca7c0
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x78
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsi + 0x38], 0
mov eax, edi
jmp 0x1802001ee
Function at 0x1802002f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x110
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rdi, qword [rsp + 0x180]
mov r15, qword [rcx]
mov rbx, qword [rsp + 0x170]
mov r10, qword [rsp + 0x190]
xor r13d, r13d
mov rax, r15
sub rax, rdi
mov rbp, r9
mov qword [rsp + 0x28], r8
mov r14, rdx
mov r12d, r13d
mov qword [rsp + 0x20], rax
cmp rdx, rdi
jb 0x1802003be
cmp rdi, 0x40
ja 0x1802003be
test rdi, rdi
jne 0x180200376
cmp qword [rsp + 0x188], r13
setne r13b
mov eax, r13d
jmp 0x180200575
mov rax, r15
sub rax, rdi
cmp qword [rsp + 0x178], 1
mov qword [rcx], rax
jne 0x1802003a7
test r9, r9
je 0x180200395
add rax, r8
mov qword [r9], rax
test rbx, rbx
je 0x18020039d
mov dword [rbx], r13d
mov eax, 1
jmp 0x180200575
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov r8, rdi
mov rcx, r10
call fcn.1800d2cb0
test eax, eax
jg 0x1802003c5
xor eax, eax
jmp 0x180200575
test rbp, rbp
je 0x1802003be
test rbx, rbx
je 0x1802003be
lea rdx, str.ssl_record_tls_pad.c
mov r8d, 0x103
mov rcx, rdi
mov qword [rsp + 0x158], rsi
call fcn.1800ca810
mov rsi, rax
mov qword [rsp + 0x30], rax
mov qword [rbp], rax
test rax, rax
je 0x18020056d
lea rax, [rsp + 0x80]
mov dword [rbx], 1
neg rax
and eax, 0x3f
lea rbp, [rsp + rax + 0x80]
lea rax, [rdi + 0x100]
cmp r14, rax
jbe 0x180200436
mov r12, r14
sub r12, rdi
sub r12, 0x100
mov r8, rdi
xor edx, edx
mov rcx, rbp
mov rbx, r13
call fcn.1800b45b0
mov r10, r13
cmp r12, r14
jae 0x1802004ef
mov rsi, qword [rsp + 0x28]
mov r11, qword [rsp + 0x20]
lea r9, [r15 + rsi]
neg r9
nop word [rax + rax]
lea rcx, [r12 + rsi]
mov rax, r12
xor rax, r11
lea rdx, [r9 + rcx]
lea r8, [rax - 1]
not rax
xor rdx, r15
shr rax, 0x3f
shr r8, 0x3f
and r8, rax
mov rax, r12
xor rax, r15
neg r8
or rdx, rax
or r13, r8
and r8, r10
inc r10
xor rdx, r12
inc r12
shr rdx, 0x3f
or rbx, r8
neg rdx
and r13, rdx
movzx eax, r13b
and al, byte [rcx]
mov rcx, r10
or byte [r10 + rbp - 1], al
sub rcx, rdi
mov rax, rdi
xor rcx, rdi
xor rax, r10
or rcx, rax
xor rcx, r10
shr rcx, 0x3f
neg rcx
and r10, rcx
cmp r12, r14
jb 0x180200470
mov rsi, qword [rsp + 0x30]
test rdi, rdi
je 0x180200568
movzx r10d, byte [rsp + 0x188]
lea r9, [rsp + 0x40]
mov rdx, rdi
mov r8d, r10d
sub r9, rsi
not r8d
nop
mov rax, rbx
inc rbx
inc rsi
xor rax, 0x20
movzx eax, byte [rax + rbp]
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], r8d
mov eax, dword [rsp + 0x20]
movzx ecx, byte [r9 + rsi - 1]
and cl, al
mov eax, dword [rsp + 0x28]
and al, byte [rbx + rbp - 1]
or cl, al
mov rax, rdi
mov byte [rsi - 1], cl
xor rax, rbx
mov rcx, rbx
sub rcx, rdi
xor rcx, rdi
or rcx, rax
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
dec rdx
jne 0x180200510
mov eax, 1
mov rsi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x180200690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x50
call fcn.1800b9c10
sub rsp, rax
mov rbp, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
xor r11d, r11d
or r10, 0xffffffffffffffff
cmp rbp, 1
mov eax, r11d
setne al
mov r14, r9
mov r9, qword [rcx]
add rax, rsi
mov r12, r8
mov r15, rdx
mov rdi, rcx
cmp rax, r9
jbe 0x1802006e9
xor eax, eax
jmp 0x18020081e
cmp rbp, 1
je 0x1802007e4
movzx edx, byte [r9 + r8 - 1]
lea r8, [r9 + r8 - 1]
cmp dword [rsp + 0xb8], r11d
je 0x18020071e
sub r9, rdx
mov eax, 1
sub r9, rsi
dec r9
mov qword [rcx], r9
jmp 0x18020081e
mov qword [rsp + 0x80], rbx
lea rcx, [rdx + rax]
mov qword [rsp + 0x88], r13
mov r13d, 0x100
mov rbx, r9
mov rax, r9
sub rbx, rcx
xor rax, rcx
xor rbx, rcx
or rbx, rax
xor rbx, r9
shr rbx, 0x3f
dec rbx
cmp r9, r13
cmovb r13, r9
test r13, r13
je 0x1802007ac
mov r10, rdx
shr r10, 0x3f
nop word [rax + rax]
mov rax, r11
mov rcx, rdx
dec r8
sub rcx, r11
shr rax, 0x3f
inc r11
shr rcx, 0x3f
xor cl, al
xor al, r10b
or cl, al
movzx eax, byte [r8 + 1]
xor cl, r10b
xor rax, rdx
dec cl
movzx ecx, cl
and rcx, rax
not rcx
and rbx, rcx
cmp r11, r13
jb 0x180200770
mov r13, qword [rsp + 0x88]
not rbx
movzx eax, bl
mov rbx, qword [rsp + 0x80]
lea r10, [rax - 1]
not rax
shr rax, 0x3f
shr r10, 0x3f
and r10, rax
lea rax, [rdx + 1]
neg r10
and rax, r10
sub r9, rax
mov qword [rdi], r9
mov rax, qword [rsp + 0xc0]
mov r9, r14
mov r8, r12
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rsi
mov rdx, r15
mov rcx, rdi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
call fcn.1802002f0
mov rbp, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140003d10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003d6d
lea rbx, [0x1400ddb70]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003d54
cmp r10, 2
jb 0x140003d54
cmp byte [r9], r8b
jne 0x140003d54
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003d30
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003daf
lea rbx, [0x1400ddb70]
cmp r8b, 0x23
jne 0x140003d93
cmp byte [r9], r8b
jne 0x140003d93
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003d80
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003f70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140003f9f
mov r8d, 0x78f
lea rdx, str.D:PANELES_CSENSI_XEONimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140003fab
mov qword [rdi], 0
lea rdx, [0x1400dd398]
mov rcx, rbx
call fcn.140003dc0
mov rbx, rax
test rax, rax
jne 0x140003fcd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400040a6
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400040a6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400040a6
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400040a6
cmp rsi, 0xffffffffffffffff
je 0x1400040a6
mov rax, qword [0x1402be7b0]
test rax, rax
je 0x140004043
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1400040a6
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140004093
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402be7b0]
test rax, rax
je 0x140004088
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400040af
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1400040a1
mov qword [rdi], rsi
mov rax, rbp
jmp 0x1400040b1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret