joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180019c00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
xor r10d, r10d
xor bl, bl
mov r14, r9
mov rdi, rcx
test rcx, rcx
je 0x180019d16
test rdx, rdx
je 0x180019d16
movzx eax, byte [rcx]
test r8d, r8d
jne 0x180019c4a
cmp al, 0x7f
jbe 0x180019d0e
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x180019d1e
mov bl, 0xff
cmp al, 0x80
jbe 0x180019c61
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x180019d1e
jne 0x180019d0e
mov eax, 1
lea rcx, [rdx - 1]
cmp rdx, rax
jbe 0x180019cff
cmp rcx, 8
jb 0x180019cea
and ecx, 7
mov r8, rdx
sub r8, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop
movd xmm1, dword [rdi + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
movd xmm1, dword [rdi + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, r8
jb 0x180019c90
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r10d, xmm2
cmp rax, rdx
jae 0x180019cff
nop
movzx ecx, byte [rax + rdi]
inc rax
or r10d, ecx
cmp rax, rdx
jb 0x180019cf0
neg r10d
sbb bl, bl
movzx ebx, bl
mov r10d, ebx
and r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x180019d1e
mov eax, 1
mov rdx, r10
mov qword [rsp + 0x10], rsi
test r14, r14
je 0x180019d74
mov rsi, qword [r9]
test rsi, rsi
je 0x180019d74
movzx r8d, bl
lea r11, [rdi + rdx]
and r8d, 1
mov byte [rsi], bl
test rdx, rdx
je 0x180019d71
mov r9, r11
mov r10d, r10d
sub r9, rdi
add r10, rsi
nop
movzx edx, byte [r11 - 1]
lea r11, [r11 - 1]
dec r9
movzx ecx, bl
xor edx, ecx
add r8d, edx
mov byte [r10 + r9], r8b
shr r8d, 8
test r9, r9
jne 0x180019d50
add qword [r14], rax
mov rsi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
pop r14
ret

Function at 0x180037870
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x180037870
mov eax, 0x28
call fcn.180001055
sub rsp, rax
lea rcx, [0x18029488c]
add rsp, 0x28
jmp sym.libcrypto_1_1_x64.dll_CRYPTO_THREAD_get_local
Function at 0x180039830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180039830
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r14d, r8d
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
mov r12, rdx
movzx r10d, byte [rax]
lea rdx, [rdi + 5]
mov qword [rbp - 0x18], rax
xor r15d, r15d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl r8d, 0x18
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 2]
or r10d, eax
mov qword [rbp - 0x28], r9
movzx eax, byte [rdi + 4]
shl eax, 0x10
or r8d, eax
mov qword [rbp - 0x20], r13
movzx eax, byte [rdx + 1]
or ecx, eax
mov dword [rbp - 0x30], r10d
or r8d, ecx
mov byte [rbp - 0xd], r10b
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
mov byte [rbp - 9], r8b
test r14d, r14d
je 0x1800399f4
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x180039993
mov rdx, r13
lea rcx, [rbp - 0x30]
call sym.libcrypto_1_1_x64.dll_BF_encrypt
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov r8d, dword [rbp - 0x2c]
movzx r9d, r10b
shr eax, 0x18
movzx edx, r8b
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi]
mov byte [r12 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x180039930
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x1800399f4
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, r8d
shr eax, 0x18
shr r10d, 8
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
mov byte [rdi + 4], al
shr r8d, 8
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800028c4
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003a2f0
Capabilities:
Resolve dns

Disassembly:
jmp 0x18003a2f0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x60
call fcn.180001055
sub rsp, rax
xor edi, edi
mov ebx, r9d
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
cmp r9d, 0x17
ja 0x18003a46f
mov eax, 0x800005
bt eax, ebx
jae 0x18003a46f
call sym.libcrypto_1_1_x64.dll_BIO_sock_init
cmp eax, 1
jne 0x18003a48f
mov eax, dword [rsp + 0xa0]
mov ecx, edi
mov qword [rsp + 0x80], r15
xorps xmm0, xmm0
mov dword [rsp + 0x30], ecx
xorps xmm1, xmm1
mov dword [rsp + 0x34], ebx
mov r15d, edi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x3c], edi
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
test rsi, rsi
je 0x18003a386
test ebx, ebx
jne 0x18003a386
bts ecx, 0xa
mov dword [rsp + 0x30], ecx
cmp ebp, 1
jne 0x18003a391
or ecx, ebp
mov dword [rsp + 0x30], ecx
mov rbp, qword [rsp + 0xa8]
lea r8, [rsp + 0x30]
mov r9, rbp
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x18003a3ee
cmp ebx, 8
je 0x18003a445
mov ecx, dword [rsp + 0x30]
bt ecx, 0xa
jae 0x18003a400
btr ecx, 0xa
lea r8, [rsp + 0x30]
or ecx, 4
mov r9, rbp
mov dword [rsp + 0x30], ecx
mov rdx, r14
mov rcx, rsi
mov r15d, ebx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
jne 0x18003a3b3
mov r15, qword [rsp + 0x80]
mov edi, 1
jmp 0x18003a48f
mov edx, 0x8f
mov dword [rsp + 0x20], 0x2da
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rcx - 0x1e]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
test r15d, r15d
cmovne ebx, r15d
mov ecx, ebx
call fcn.1800066cc
mov rdx, rax
mov ecx, 1
call sym.libcrypto_1_1_x64.dll_ERR_add_error_data
mov r15, qword [rsp + 0x80]
jmp 0x18003a48f
mov edx, 0x8f
mov dword [rsp + 0x20], 0x2cb
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rdx - 0x4e]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov r15, qword [rsp + 0x80]
jmp 0x18003a48f
mov edx, 0x8f
mov dword [rsp + 0x20], 0x297
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rdx - 0xc]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x18003a520
Capabilities:
Resolve dns

Disassembly:
jmp 0x18003a520
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x60
call fcn.180001055
sub rsp, rax
xor edi, edi
mov ebx, r9d
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
cmp r9d, 0x17
ja 0x18003a6b2
mov eax, 0x800005
bt eax, ebx
jae 0x18003a6b2
call sym.libcrypto_1_1_x64.dll_BIO_sock_init
cmp eax, 1
jne 0x18003a6d2
mov eax, dword [rsp + 0xa0]
mov ecx, edi
mov dword [rsp + 0x38], eax
xorps xmm0, xmm0
mov eax, dword [rsp + 0xa8]
xorps xmm1, xmm1
mov qword [rsp + 0x80], r15
mov r15d, edi
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ebx
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmmword [rsp + 0x50], xmm1
test rsi, rsi
je 0x18003a5bd
test ebx, ebx
jne 0x18003a5bd
bts ecx, 0xa
mov dword [rsp + 0x30], ecx
cmp ebp, 1
jne 0x18003a5c8
or ecx, ebp
mov dword [rsp + 0x30], ecx
mov rbp, qword [rsp + 0xb0]
lea r8, [rsp + 0x30]
mov r9, rbp
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
je 0x18003a62b
nop word [rax + rax]
cmp ebx, 8
je 0x18003a686
mov ecx, dword [rsp + 0x30]
bt ecx, 0xa
jae 0x18003a63f
btr ecx, 0xa
lea r8, [rsp + 0x30]
or ecx, 4
mov r9, rbp
mov dword [rsp + 0x30], ecx
mov rdx, r14
mov rcx, rsi
mov r15d, ebx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov ebx, eax
test eax, eax
jne 0x18003a5f0
mov edi, 1
mov r15, qword [rsp + 0x80]
mov eax, edi
jmp 0x18003a6d4
mov edx, 0x8f
mov dword [rsp + 0x20], 0x2da
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rcx - 0x1e]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
test r15d, r15d
cmovne ebx, r15d
mov ecx, ebx
call fcn.1800066cc
mov rdx, rax
mov ecx, 1
call sym.libcrypto_1_1_x64.dll_ERR_add_error_data
mov r15, qword [rsp + 0x80]
mov eax, edi
jmp 0x18003a6d4
mov edx, 0x8f
mov dword [rsp + 0x20], 0x2cb
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rdx - 0x4e]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov r15, qword [rsp + 0x80]
mov eax, edi
jmp 0x18003a6d4
mov edx, 0x8f
mov dword [rsp + 0x20], 0x297
lea r9, str.crypto_bio_b_addr.c
lea ecx, [rdx - 0x6f]
lea r8d, [rdx - 0xc]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x18003daf0
Capabilities:
Resolve dns

Disassembly:
jmp 0x18003daf0
mov eax, 0x28
call fcn.180001055
sub rsp, rax
add rsp, 0x28
jmp qword [sym.imp.WS2_32.dll_gethostbyname]
Function at 0x18003e150
Capabilities:
Connect socket

Disassembly:
jmp 0x18003e150
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, gethostbyname
call fcn.180001055
sub rsp, rax
movsxd rbx, ecx
mov edi, r8d
mov dword [rsp + 0x40], 1
mov rbp, rdx
cmp ebx, 0xffffffff
jne 0x18003e1ae
lea r9, str.crypto_bio_b_sock2.c
mov dword [rsp + 0x20], 0x52
lea edx, [rax + 0x5a]
lea ecx, [rax - 0x10]
lea r8d, [rax + 0x57]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov edx, edi
mov qword [rsp + 0x48], rsi
shr edx, 3
mov ecx, ebx
and edx, 1
call sym.libcrypto_1_1_x64.dll_BIO_socket_nbio
test eax, eax
je 0x18003e23d
mov rsi, rbx
test dil, 4
je 0x18003e254
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 8
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x18003e254
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, recv
mov dword [rsp + 0x20], 0x5c
mov r8d, eax
lea r9, str.crypto_bio_b_sock2.c
lea ecx, [rdx - 0xc]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov edx, 0x8a
mov dword [rsp + 0x20], 0x5d
lea r9, str.crypto_bio_b_sock2.c
lea ecx, [rdx - 0x6a]
lea r8d, [rdx - 1]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test dil, 0x10
je 0x18003e2c1
mov edx, 6
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x40]
mov rcx, rsi
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x18003e2c1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, recv
mov dword [rsp + 0x20], 0x65
mov r8d, eax
lea r9, str.crypto_bio_b_sock2.c
lea ecx, [rdx - 0xc]
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov edx, 0x8a
mov dword [rsp + 0x20], 0x66
lea r9, str.crypto_bio_b_sock2.c
mov r8d, edx
lea ecx, [rdx - 0x6a]
jmp 0x18003e238
mov rcx, rbp
call fcn.18000598e
mov rcx, rbp
mov ebx, eax
call fcn.180002941
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x18003e33a
mov ecx, eax
call sym.libcrypto_1_1_x64.dll_BIO_sock_should_retry
test eax, eax
jne 0x18003e23d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, 2
mov dword [rsp + 0x20], WSAStartup
mov ecx, edx
lea r9, str.crypto_bio_b_sock2.c
mov r8d, eax
call sym.libcrypto_1_1_x64.dll_ERR_put_error
mov edx, 0x8a
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSAGetLastError
lea r9, str.crypto_bio_b_sock2.c
lea ecx, [rdx - 0x6a]
lea r8d, [rdx - 0x23]
jmp 0x18003e238
mov eax, 1
jmp 0x18003e23f
Function at 0x18005fbc0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18005fbc0
push rdi
movsxd rdi, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x18005fd47
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
lea rsi, [rcx - 1]
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
mov eax, ecx
dec rsi
xor eax, dword [r8 + 8]
and eax, esi
xor ecx, eax
mov dword [rdx + 8], ecx
movq xmm4, rsi
xor dword [r8 + 8], eax
mov ecx, dword [rdx + 0x10]
mov eax, dword [r8 + 0x10]
xor eax, ecx
punpcklqdq xmm4, xmm4
and eax, esi
xor ecx, eax
mov dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], eax
mov ecx, dword [rdx + 0x14]
mov edx, dword [r8 + 0x14]
xor rdx, rcx
and edx, 4
and rdx, rsi
mov eax, edx
xor eax, ecx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], edx
xor edx, edx
mov r8d, edx
test r9d, r9d
jle 0x18005fcfd
cmp edi, 2
jb 0x18005fcfd
mov rbx, qword [r10]
lea eax, [rdi - 1]
mov r9, qword [r11]
movsxd rcx, eax
lea rax, [rbx + rcx*8]
lea rcx, [r9 + rcx*8]
cmp rbx, rcx
ja 0x18005fc79
cmp rax, r9
jae 0x18005fcfd
cmp rbx, r10
ja 0x18005fc83
cmp rax, r10
jae 0x18005fcfd
cmp rbx, r11
ja 0x18005fc8d
cmp rax, r11
jae 0x18005fcfd
cmp r9, r10
ja 0x18005fc97
cmp rcx, r10
jae 0x18005fcfd
cmp r9, r11
ja 0x18005fca1
cmp rcx, r11
jae 0x18005fcfd
mov eax, edi
and eax, 0x80000001
jge 0x18005fcb1
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, edi
sub ecx, eax
nop word [rax + rax]
movdqu xmm2, xmmword [rdx + rbx]
add r8d, 2
movdqu xmm1, xmmword [rdx + r9]
lea rdx, [rdx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm4
movdqa xmm0, xmm3
pxor xmm3, xmm2
pxor xmm0, xmm1
movdqu xmmword [rdx + r9 - 0x10], xmm0
movdqu xmmword [rdx + rbx - 0x10], xmm3
cmp r8d, ecx
jl 0x18005fcc0
movsxd rax, r8d
cmp rax, rdi
jge 0x18005fd3d
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, qword [rcx + rax*8]
xor r9, rdx
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rdi
jl 0x18005fd10
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
ret
Function at 0x1800703e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800703e0
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r14d, r8d
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
mov r12, rdx
movzx r10d, byte [rax]
lea rdx, [rdi + 5]
mov qword [rbp - 0x18], rax
xor r15d, r15d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl r8d, 0x18
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 2]
or r10d, eax
mov qword [rbp - 0x28], r9
movzx eax, byte [rdi + 4]
shl eax, 0x10
or r8d, eax
mov qword [rbp - 0x20], r13
movzx eax, byte [rdx + 1]
or ecx, eax
mov dword [rbp - 0x30], r10d
or r8d, ecx
mov byte [rbp - 0xd], r10b
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
mov byte [rbp - 9], r8b
test r14d, r14d
je 0x1800705a4
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x180070543
mov rdx, r13
lea rcx, [rbp - 0x30]
call sym.libcrypto_1_1_x64.dll_CAST_encrypt
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov r8d, dword [rbp - 0x2c]
movzx r9d, r10b
shr eax, 0x18
movzx edx, r8b
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi]
mov byte [r12 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x1800704e0
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x1800705a4
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, r8d
shr eax, 0x18
shr r10d, 8
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
mov byte [rdi + 4], al
shr r8d, 8
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800028c4
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800723b0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
jmp 0x1800723b0
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3f]
mov eax, 0xb0
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov eax, dword [r9]
mov rdi, rcx
mov rcx, qword [rbp + 0x7f]
mov r14, r8
mov dword [rbp - 1], eax
mov rsi, rdx
mov eax, dword [r9 + 4]
mov dword [rbp + 3], eax
mov eax, dword [r9 + 8]
mov dword [rbp + 7], eax
mov eax, dword [r9 + 0xc]
mov dword [rbp + 0xb], eax
mov eax, dword [r9 + 0x10]
mov dword [rbp + 0xf], eax
mov eax, dword [r9 + 0x14]
mov dword [rbp + 0x13], eax
mov eax, dword [r9 + 0x18]
mov dword [rbp + 0x17], eax
mov eax, dword [r9 + 0x1c]
mov dword [rbp + 0x1b], eax
mov eax, dword [rcx]
mov dword [rbp + 0x1f], eax
mov eax, dword [rcx + 4]
mov dword [rbp + 0x23], eax
mov eax, dword [rcx + 8]
mov dword [rbp + 0x27], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp + 0x2b], eax
mov dword [rbp - 0x11], 0x61707865
mov dword [rbp - 0xd], 0x3320646e
mov dword [rbp - 9], 0x79622d32
mov dword [rbp - 5], 0x6b206574
test r8, r8
je 0x1800725c4
mov qword [rsp + 0xd8], rbx
nop dword [rax]
nop word [rax + rax]
mov ebx, 0x40
lea rdx, [rbp - 0x11]
cmp r14, rbx
lea rcx, [rbp - 0x51]
cmovb rbx, r14
call fcn.180072680
xor eax, eax
test rbx, rbx
je 0x1800725aa
cmp rbx, 0x40
jb 0x180072577
lea rdx, [rdi - 1]
add rdx, rbx
lea rcx, [rbp + rbx - 0x52]
cmp rdi, rcx
ja 0x1800724bc
lea rcx, [rbp - 0x51]
cmp rdx, rcx
jae 0x180072577
lea rcx, [rsi - 1]
add rcx, rbx
cmp rdi, rcx
ja 0x1800724d1
cmp rdx, rsi
jae 0x180072577
mov r9, rbx
and r9, 0xffffffffffffffc0
lea rcx, [rbp - 0x51]
mov rdx, rsi
sub rdx, rcx
mov r8, rdi
lea rcx, [rbp - 0x51]
sub r8, rcx
nop dword [rax]
movdqu xmm0, xmmword [rbp + rax - 0x51]
lea rcx, [rbp - 0x41]
movdqu xmm1, xmmword [rsi + rax]
add rcx, rdx
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x41]
movdqu xmmword [rdi + rax], xmm1
movdqu xmm1, xmmword [rcx + rax]
lea rcx, [rbp - 0x41]
add rcx, r8
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x31]
movdqu xmmword [rcx + rax], xmm1
lea rcx, [rbp - 0x31]
add rcx, rdx
movdqu xmm1, xmmword [rcx + rax]
lea rcx, [rbp - 0x31]
add rcx, r8
pxor xmm1, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x21]
movdqu xmmword [rcx + rax], xmm1
lea rcx, [rbp - 0x21]
add rcx, rdx
movdqu xmm1, xmmword [rcx + rax]
lea rcx, [rbp - 0x21]
add rcx, r8
pxor xmm1, xmm0
movdqu xmmword [rcx + rax], xmm1
add rax, 0x40
cmp rax, r9
jb 0x1800724f0
cmp rax, rbx
jae 0x1800725aa
lea rcx, [rbp - 0x51]
mov r8, rsi
sub r8, rcx
mov r9, rdi
lea rcx, [rbp - 0x51]
sub r9, rcx
lea rdx, [rbp - 0x51]
add rdx, rax
inc rax
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
cmp rax, rbx
jb 0x180072590
inc dword [rbp + 0x1f]
add rdi, rbx
add rsi, rbx
sub r14, rbx
jne 0x180072470
mov rbx, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800028c4
mov rsi, qword [rsp + 0xe0]
add rsp, 0xb0
pop r14
pop rdi
pop rbp
ret
Function at 0x180073260
Capabilities:
Encode data using xor

Disassembly:
jmp 0x180073260
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.180001055
sub rsp, rax
cmp dword [rcx + 0x88], 0xffffffff
mov r14, r8
mov rsi, rdx
mov rbx, rcx
jne 0x18007329e
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
call sym.libcrypto_1_1_x64.dll_EVP_CIPHER_CTX_block_size
movsxd rbp, eax
mov qword [r14], rbp
test rsi, rsi
je 0x180073368
movsxd rcx, dword [rbx + 0x88]
cmp ecx, ebp
jne 0x1800732f7
test eax, eax
jle 0x180073344
mov r8, rsi
lea rcx, [rbx + 8]
sub r8, rbx
mov rdx, rbp
nop dword [rax + rax]
movzx eax, byte [rcx + 0x60]
xor al, byte [rcx]
mov byte [r8 + rcx - 8], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1800732e0
jmp 0x180073344
mov eax, ebp
mov byte [rcx + rbx + 0x68], 0x80
sub eax, ecx
cmp eax, 1
jle 0x180073318
dec eax
add rcx, 0x69
movsxd r8, eax
add rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
test ebp, ebp
jle 0x180073344
mov rdx, rsi
lea rcx, [rbx + 0x28]
sub rdx, rbx
mov r8, rbp
nop dword [rax]
movzx eax, byte [rcx + 0x40]
xor al, byte [rcx]
mov byte [rdx + rcx - 0x28], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x180073330
mov rcx, qword [rbx]
mov r9d, ebp
mov r8, rsi
mov rdx, rsi
call sym.libcrypto_1_1_x64.dll_EVP_Cipher
test eax, eax
jne 0x180073368
mov rdx, rbp
mov rcx, rsi
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
xor eax, eax
jmp 0x18007336d
mov eax, 1
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800a4ca0
Capabilities:
Encrypt data using curve25519

Disassembly:
jmp 0x1800a4ca0
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1f8]
mov eax, 0x2f8
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov rbx, qword [rbp + 0x250]
mov r15, rcx
lea rcx, [rbp - 0x60]
mov rdi, r9
mov r14, r8
mov rsi, rdx
call sym.libcrypto_1_1_x64.dll_SHA512_Init
mov r8d, 0x20
lea rcx, [rbp - 0x60]
mov rdx, rbx
call sym.libcrypto_1_1_x64.dll_SHA512_Update
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x120]
call sym.libcrypto_1_1_x64.dll_SHA512_Final
movzx eax, byte [rbp + 0x13f]
lea rcx, [rbp - 0x60]
and byte [rbp + 0x120], 0xf8
and al, 0x3f
or al, 0x40
mov byte [rbp + 0x13f], al
call sym.libcrypto_1_1_x64.dll_SHA512_Init
mov r8d, 0x20
lea rdx, [rbp + 0x140]
lea rcx, [rbp - 0x60]
call sym.libcrypto_1_1_x64.dll_SHA512_Update
mov r8, r14
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sym.libcrypto_1_1_x64.dll_SHA512_Update
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x160]
call sym.libcrypto_1_1_x64.dll_SHA512_Final
lea rcx, [rbp + 0x160]
call fcn.1800ade40
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x80]
call fcn.1800aa530
lea rdx, [rbp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.1800a5ce0
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x70]
call fcn.1800a60a0
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0xa8]
lea rcx, [rsp + 0x48]
call fcn.1800a60a0
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.1800a8090
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1800a8090
movzx eax, byte [rsp + 0x20]
lea rcx, [rbp - 0x60]
shl al, 7
xor byte [r15 + 0x1f], al
call sym.libcrypto_1_1_x64.dll_SHA512_Init
mov r8d, 0x20
lea rcx, [rbp - 0x60]
mov rdx, r15
call sym.libcrypto_1_1_x64.dll_SHA512_Update
mov r8d, 0x20
lea rcx, [rbp - 0x60]
mov rdx, rdi
call sym.libcrypto_1_1_x64.dll_SHA512_Update
mov r8, r14
lea rcx, [rbp - 0x60]
mov rdx, rsi
call sym.libcrypto_1_1_x64.dll_SHA512_Update
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x1a0]
call sym.libcrypto_1_1_x64.dll_SHA512_Final
lea rcx, [rbp + 0x1a0]
call fcn.1800ade40
lea rcx, [r15 + 0x20]
lea r9, [rbp + 0x160]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x1a0]
call fcn.1800ab590
mov edx, 0xd8
lea rcx, [rbp - 0x60]
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
mov edx, 0x40
lea rcx, [rbp + 0x160]
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
mov edx, 0x40
lea rcx, [rbp + 0x120]
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
mov eax, 1
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1800028c4
add rsp, 0x2f8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret