joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1413ba916
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
add ecx, eax
mov dword [r8 + riz + 4], ecx
mov ecx, 0x5992114
mov eax, dword [rcx + rbp - 0x5992118]
lea rbp, [rbp + rcx*2 - 0xb32422c]
sal di, 0xc2
shr r9b, 0x21
xor eax, ebx
neg eax
lea eax, [rcx + rax - 0x3ac22149]
ror eax, 1
call fcn.14133515b
imul edi
push rbx
xor dword [rsp + rdx*2], r10d
cdq
shl dil, 0x62
and cl, r9b
pop rbx
bt r11d, 0xb7
movsxd r10, r10d
bswap ecx
add dl, r9b
cmovl r11d, edi
adc rsi, r10
sar cx, 0xc9
xchg r9d, edx
mov r8w, word [rcx + r8 - 0x4000000]
mul di
jb fcn.14132df3a
mov qword [rsp], 0xffffffffb40a461b
not byte [rsp + 3]
and r8d, 0xff
mov r8d, dword [rdx + r8*4]
call fcn.1413330b9
mov ecx, dword [r8]
mov edi, 0x86905a9b
mov r9d, edi
mov eax, dword [r8 + riz + 4]
jmp 0x14137f1ee

Function at 0x1413baf99
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
ror ecx, 0xf0
lea r8, [r8 + rdi - 0x4b2132ca]
jne 0x1413c8829
movzx eax, r8w
pop rdx
pop rbp
pop rdx
ja fcn.141341236
pop rcx
rol r9b, 1
dec rax
rol eax, 0x5a
dec eax
sub r9b, r11b
cdqe
lea rcx, [r10*4 - 0x3a4f83c7]
not r9b
xor r9b, 0x9a
not cl
sal dl, 0xe5
xor bl, r9b
add r9, rsp
mov al, byte [r9 + rax*4 - 0x70000008]
sub rcx, 0xffffffffd0b99f08
jno 0x14132f1a2
xor bpl, 0
lea rdi, [rax + rax*8 - 0x7cdc5750]
dec rdx
setge r10b
xor bl, bpl
lea rbp, [rsp + rbp + 0x18]
mul word [rsp + rax - 0x602a4]
mov rax, qword [rax + rbp - 0x6fd53]
mov qword [rsi + rdx*2 - 0x5180568], rax
neg word [rsp + rdx - 0x28c029d]
bt r10d, ecx
add qword [rsp + rdx - 0x28c02aa], rdx
lea rsi, [rsi + rdx*2 - 0x5180568]
xor dword [rsp + rdx*4 - 0xa300aa8], 0x3716dc3a
jae 0x141384af1
Function at 0x1413bbe5d
Capabilities:
Encode data using base64

Disassembly:
pop r8
jne fcn.141341236
dec rdi
bswap r9d
js 0x1413948a0
setle r10b
or r11d, r10d
xor r9d, 0x953bbe2f
cdqe
shl edi, 0x50
sbb rax, r10
rol r9d, 2
push rbx
xor dword [rsp + rax - 0x4d66deca], r9d
xadd cx, r11w
pop rbx
sar r11d, cl
or rdx, rax
call fcn.14132dfb3
mov ebp, 0xe2162fb4
mov r10d, ebp
lea rcx, [rbp + r10*4 - 0x5ae75e4e]
mov ecx, dword [r9 + riz - 4]
xor ecx, ebx
add rbp, rbp
bts r10w, bp
movzx r8d, r10b
xor ecx, 0x69b23816
movsx edi, bp
imul di, r8w
btc r10, r8
bswap ecx
movzx eax, r10w
dec ecx
shr r8w, 0xa4
rol ecx, 1
mov edx, ebp
cwde
push rbx
not bp
cdqe
xor dword [rsp + r8 - 0xb], ecx
rol ebp, 0xd1
lea rbx, [r10*8 + 0x361e6b03]
pop rbx
movsxd rcx, ecx
adc rdx, rax
lea rax, [rdi*8 + 0x1731b122]
adc r11, rcx
add dx, 0xa38f
mov ecx, dword [rsi + r8*8 - 0x58]
sub rdx, rbp
mov r8b, byte [r9 + r8 - 0x10]
bts di, dx
lea r9, [rdi + r9 - 0x152d]
xor r8b, bl
cdqe
dec dl
xor r10d, eax
ror r8b, 1
dec r8b
btr eax, 0xa3
not r8b
cwd
neg r8b
xor bl, r8b
add r8, rsp
mov dword [r8 + rdi*2 - 0x2a50], ecx
lea r10, [rbp + rsi - 0x412f8855]
movsx r8d, ax
mov qword [rsi + rax*4 - 0x5cc9688c], r10
movsx r10d, dx
btr bp, ax
push rdx
lea rsi, [rsi + rdi - 0x152c]
xor r8, qword [rsp + rdi*2 - 0x2a50]
jns 0x141322082
push 0x7d2fe785
push 0xffffffffce95bbbf
lea rsp, [rsp + 0x28]
je 0x1413a5f45
mov r9d, 0x7fba4692
push r8
movsx r8d, r9b
add r9w, 0x905
lea r8, [0x1413759f8]
sbb rcx, r11
sbb di, 0xa322
sal rcx, cl
not di
movzx r9d, dx
ror al, 0x42
or dl, cl
ror di, 1
lea r11, [rax - 0x53c21bed]
shl cl, 0xa7
add rax, rax
sbb di, 0xaf
sar cl, 0x81
btc dx, r9w
xor bx, di
add rdi, rsp
movzx r10w, byte [rdi + rdx - 0x48a]
cbw
inc r9
movzx edi, r11w
lea r8, [r8 + rdx*2 - 0x916]
shl r9d, 0xa8
setns r9b
ror r11d, 0xc1
mov word [r8 + rax - 0x44], r10w
neg al
cbw
lea rbp, [rbp + rdx*2 - 0x918]
btc ax, dx
btr cx, 0x92
neg eax
mov r9d, dword [rbp + rdx*2 - 0x914]
xor r9d, ebx
movsx r10d, al
neg r9d
sub r9d, 0xe30a078f
shr eax, 0x61
adc dx, di
div r11
xor r9d, 0x8ca00807
sub rax, 0x5a1b480f
jg 0x1413cc21e
jo 0x141328b4f
rol eax, 1
lea rdx, [rcx + rdx*4 - 0x24744080]
mov qword [rsp + 0x18], 0xffffffff940f208f
bts r9, 0x27
not eax
xor word [rsp + 0x10], 0x140c
movsx edi, r10b
call fcn.14138cd7b
ror r9d, 2
lea r9d, [r9 + r11 - 0x50e6d9da]
jmp 0x1413256fa

Function at 0x1413bfb46
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
adc rax, rdx
mov qword [rsp], 0xffffffffc22cb3a9
jmp 0x1413de172
mov qword [rbp + riz - 8], rax
lea rsp, [rsp + 0x18]
mov qword [rbp + riz - 0x10], rsp
push 0x7521df1e
call fcn.14132f515

Function at 0x1413da171
Capabilities:
Authenticate hmac

Disassembly:
pop rdi
dec edx
lea rdi, [rsi + r8*2 - 0xa600048]
jno 0x1413cde71
Function at 0x1413e53f8
Capabilities:
Authenticate hmac

Disassembly:
xadd dil, al
pop r9
ja fcn.14132df3a

Function at 0x1413e76ae
Capabilities:
Encode data using base64
Encrypt data using chaskey

Disassembly:
mov r9d, dword [rsp + rbp + 0xa]
mov qword [rsp + rbp], 0x53bfd525
lea rcx, [rsp + rcx + 0x10]
mov rdx, qword [rbp + rcx]
ror word [rsp + rbp*2 + 6], 0x4a
and dword [rsp + rbp], ebp
mov r10, rdx
lea rcx, [rax*8 + 0x11262584]
rol qword [rsp + rbp*2 + 8], 0x78
inc byte [rsp + rbp + 0xb]
add rbp, r10
mul r9d
not r9w
mov r8, rsi
lea r10, [rdi*8 + 0x36213f87]
pop r9
pop rdx
jo 0x1413e24c6

Function at 0x1413e7d06
Capabilities:
Encode data using base64

Disassembly:
lea rdi, [rdi*8 - 0x58f03ed8]
movsx r10d, ax
lea r9, [rdi + r9 + 0x58f03c1c]
dec dl
xchg r8b, cl
xor ebp, ebx
cdqe
sal eax, 0x42
lea ebp, [rbp + rdi + 0x68034959]
rol ebp, 1
not ecx
shl r8b, 0xc6
push rax
not ebp
rol di, 0x66
xchg dword [rsp + rdi + 0x58f007d3], r10d
bts r10, rdi
lea ebp, [rbp + rdi - 0x171ade6a]
sub r8d, dword [rsp + rcx - 0x5559f951]
neg ebp
xor r10d, 0xb784912f
push rdx
mov qword [rsp + rdi + 0x58f007d8], rbx
call fcn.1413510d0
lea rbp, [rbp + rcx*2 - 0x21c]
lea rcx, [r11*2 - 0x726b70e3]
xor edi, ebx
neg r9d
ror r9w, 0x4f
bswap edi
rol r9b, 0x81
mov qword [rsp + rcx + 0x726b70eb], r11
inc edi
sal ax, 0x8d
xor edi, 0x35270bb1
dec r9b
cbw
bt ax, 0x22
rol edi, 3
neg edi
not byte [rsp + rax - 0x31fff0]
imul rax, r9
ror edi, 3
mov r10d, 0x6c226703
cbw
shr qword [rsp + r9 - 0x34940209], cl
xor edi, 0x449f571c
mov qword [rsp + rcx + 0x726b70e3], r10
shr rdx, 0xa4
lea edi, [rdi + r9*4 - 0x26481849]
mov qword [rsp + rdx*2 + 0x20], 0xffffffffca8f033c
jbe 0x1413e93a0
call 0x141378fa5
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov ecx, 0xaaa669ab
movsx edi, cl
movzx eax, di
add rdx, r8
movzx r8d, cl
sar cl, 0xa6
adc edi, r8d
mov qword [rdi + rsi - 0x4f], rdx
lea rdx, [rdi + rsi - 0x4f]
shr cx, 0xc4
mov qword [rsi + rdi - 0x57], rdx
mov edx, eax
cdqe
ja 0x1413de1ca
mov ebp, dword [rdi + r9 - 0x5b]
jns 0x1413589e0
Function at 0x1413e8d73
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + r11 - 0xf2830b8], ecx
sub r11, 0xffffffffc0bf733d
sbb rdi, 0x218c8ebe
adc r9b, 0x10
mov rbx, qword [rsp + r10 - 0x7aff9796]
not di
sar r10d, 0xba
movsxd rcx, ecx
inc word [rsp + r11 - 0x4e68bd84]
add rsi, rcx
movsx ecx, ax
sub byte [rsp + r11 - 0x4e68bd7c], 0x29
movzx r11d, byte [rbp + r11 - 0x4e68bd91]
lea rbp, [rbp + rax - 0x7b000006]
mul edx
sub byte [rsp + rax + 8], dil
xor r11b, bl
sub r11b, 0x8f
mov qword [rsp + rax*2 + 0x10], rcx
not r11b
inc dword [rsp + rax*2 + 0xc]
dec r11b
bts di, ax
xor di, 0x850b
add rdi, qword [rsp + rax*2 + 0xa]
not r11b
ror r11b, 1
push r10
cbw
xor bl, r11b
shl al, 0x61
shl dword [rsp + rax*2 + 0x15], 0xa2
sar cx, 0xe3
lea r11, [rsp + r11 + 0x20]
cwd
div r9
add rcx, qword [r11 + rax*2 - 0x5abf1c]
movzx r11d, word [rsp + rax*8 - 0x16afc54]
neg r10w
push r10
mov qword [r8 + rax - 0x2d5f98], rcx
lea r8, [r8 + rax - 0x2d5f98]
mul r9b
cwde
bts edx, 0x27
pop rax
pop rdi
pop r11
pop rdx
pop r11
jb fcn.14132df3a
mov edx, 0x3d864a86
movzx edi, dx
movsx r11d, di
lea rbp, [rdx + rbp - 0x3d864a8a]
lea r10, [r11*8 + 0x27a79599]
mov r10d, dword [rbp + rdx - 0x3d864a86]
btr rdx, rdi
movsx eax, dx
xor r10d, ebx
lea r10d, [r10 + rdx*2 - 0x170588dd]
ror r10d, 1
sub edx, 0xbd1c46a0
lea r10d, [r10 + rdi*2 - 0x250586a9]
call fcn.141330216
bswap ebp
inc r10b
ror rdx, 0x31
push rbx
call fcn.141376d80
rol ax, 0x4a
mov ecx, dword [rbp + r11 - 0x3be70005]
movzx r10d, r9b
push rax
inc r9d
xor ecx, ebx
push r11
idiv r9b
inc ecx
movzx edi, r10w
xor r11b, 9
sal dil, 0xe7
neg ecx
lea ecx, [rcx + r11*4 + 0xc82fae1]
bt r11, rax
jb 0x141390542
bswap r9
not ecx
lea r11, [rax*2 + 0xf273d24]
inc ecx
bswap r10d
imul r11w, word [rsp + r11*4 - 0x3ca0375d]
neg eax
neg ecx
xadd r10d, eax
imul r9, r11
mov edx, dword [rsp + r11 - 0xf2830c7]
mov qword [rsp + r11*2 - 0x1e506180], rbx
jb 0x141323444
lea r9, [rbp + r9 - 0x2386421c]
lea rdi, [rbp*4 - 0x5c6a25d5]
mov ebp, dword [r9 + rbp - 0x23864218]
imul edi, edi
movzx r8d, di
xor ebp, ebx
dec ebp
neg edi
rol ebp, 2
movzx ecx, di
mov edx, r8d
lea ebp, [rbp + rdi*4 + 0x6bf0fa05]
rol dx, 0x6f
movsx r10d, dx
neg ebp
sar r10w, 0xec
jne 0x1413e7b5a
Function at 0x1800066a0
Capabilities:
Enumerate threads
Hide thread from debugger

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov edi, eax
mov ecx, 0xc
mov edx, eax
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
inc rax
cmp rax, 1
ja 0x1800066e4
call fcn.1800ea570
mov rsi, rax
test edx, edx
jne 0x180006893
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x2c], 0x1c
lea rdx, [rsp + 0x2c]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_Thread32First]
test eax, eax
je 0x180006846
lea r13, [rsp + 0x78]
lea rbx, [rsp + 0x48]
mov r12, qword [sym.imp.kernel32.dll_CloseHandle]
lea r14, [rsp + 0x2c]
mov rbp, qword [sym.imp.kernel32.dll_Thread32Next]
jmp 0x180006750
mov rcx, rsi
mov rdx, r14
call rbp
test eax, eax
je 0x180006810
cmp dword [rsp + 0x38], edi
jne 0x180006740
mov r8d, dword [rsp + 0x34]
mov ecx, 0x60
xor edx, edx
call qword [sym.imp.kernel32.dll_OpenThread]
lea rcx, [rax + 1]
cmp rcx, 1
ja 0x18000677f
call fcn.1800ea570
test edx, edx
jne 0x180006893
mov rcx, rax
mov edx, 0x11
xor r8d, r8d
xor r9d, r9d
mov r15, rax
call qword [sym.imp.ntdll.dll_NtSetInformationThread]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x78], rax
lea rax, [0x180112020]
mov qword [rsp + 0x80], rax
lea rax, str.Thread_ID:__hidden_from_context_evaluation_n
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 2
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 1
mov rcx, rbx
call fcn.1800f2eb0
mov rcx, r15
call r12
test eax, eax
jne 0x180006740
call fcn.1800ea570
test edx, edx
je 0x180006740
jmp 0x180006893
call fcn.1800ea570
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], edx
test edx, edx
je 0x180006750
test rax, rax
je 0x180006835
lea rcx, [rsp + 0x48]
call fcn.1800ea560
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x18000687f
xor edx, edx
jmp 0x180006893
call fcn.1800ea570
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], edx
test edx, edx
je 0x180006713
test rax, rax
je 0x18000686b
lea rcx, [rsp + 0x48]
call fcn.1800ea560
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x18000688a
call fcn.1800ea570
jmp 0x180006893
call fcn.1800ea570
test edx, edx
jne 0x180006893
jmp 0x180006842
call fcn.1800ea570
test edx, edx
je 0x180006878
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1800068b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
sub rsp, 0x70
call fcn.180003040
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1800069e6
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rax
lea rax, [0x180008d60]
mov qword [rsp + 0x68], rax
lea rax, str.Gate_address_retrieved:__n
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 1
lea rcx, [rsp + 0x28]
call fcn.1800f2eb0
mov edx, 0x1000
xor ecx, ecx
mov r8d, 0x3000
mov r9d, 0x40
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [0x1801dc1b0], rax
test rax, rax
je 0x1800069ef
lea rax, [0x1801dc1b0]
mov qword [rsp + 0x60], rax
lea rax, [0x180008d60]
mov qword [rsp + 0x68], rax
lea rax, str.Allocated_memory_for_trampoline_at:
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 1
lea rcx, [rsp + 0x28]
call fcn.1800f2eb0
mov rax, qword [rsp + 0x58]
mov rcx, qword [0x1801dc1b0]
movzx edx, byte [rax + 8]
mov byte [rcx + 8], dl
mov rax, qword [rax]
mov qword [rcx], rax
lea rax, str.Copied_gate_memory_to_trampoline._n
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x28]
call fcn.1800f2eb0
mov rax, qword [0x1801dc1b0]
add rsp, 0x70
pop rsi
ret
lea rax, str.Failed_to_retrieve_gate_address._n
jmp 0x1800069f6
lea rax, str.Failed_to_allocate_memory_for_trampoline._n
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x38], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x28]
call fcn.1800f2eb0
xor eax, eax
add rsp, 0x70
pop rsi
ret
Function at 0x1800072c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
aesimc xmm0, xmmword [rdx + 0x10]
aesimc xmm1, xmmword [rdx + 0x20]
aesimc xmm2, xmmword [rdx + 0x30]
aesimc xmm3, xmmword [rdx + 0x40]
aesimc xmm4, xmmword [rdx + 0x50]
aesimc xmm5, xmmword [rdx + 0x60]
aesimc xmm6, xmmword [rdx + 0x70]
aesimc xmm7, xmmword [rdx + 0x80]
aesimc xmm8, xmmword [rdx + 0x90]
aesimc xmm9, xmmword [rdx + 0xa0]
aesimc xmm10, xmmword [rdx + 0xb0]
aesimc xmm11, xmmword [rdx + 0xc0]
aesimc xmm12, xmmword [rdx + 0xd0]
movaps xmm13, xmmword [rdx]
movaps xmm14, xmmword [rdx + 0xe0]
movaps xmmword [rcx], xmm13
movdqa xmmword [rcx + 0x10], xmm0
movdqa xmmword [rcx + 0x20], xmm1
movdqa xmmword [rcx + 0x30], xmm2
movdqa xmmword [rcx + 0x40], xmm3
movdqa xmmword [rcx + 0x50], xmm4
movdqa xmmword [rcx + 0x60], xmm5
movdqa xmmword [rcx + 0x70], xmm6
movdqa xmmword [rcx + 0x80], xmm7
movdqa xmmword [rcx + 0x90], xmm8
movdqa xmmword [rcx + 0xa0], xmm9
movdqa xmmword [rcx + 0xb0], xmm10
movdqa xmmword [rcx + 0xc0], xmm11
movdqa xmmword [rcx + 0xd0], xmm12
movaps xmmword [rcx + 0xe0], xmm14
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
add rsp, 0x98
ret
Function at 0x1800080e0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
mov rdx, rbp
mov r8d, 0x20
call fcn.1800e72e0
mov qword [rbp + 0x28], rax
test rax, rax
je 0x180008154
mov qword [rbp + 0x30], rdx
mov rax, qword [rdx]
test rax, rax
je 0x180008138
mov rcx, qword [rbp + 0x28]
call rax
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18000819d
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.18000a410
jmp 0x18000819d
movaps xmm0, xmmword [rbp]
movaps xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
lea r8, [0x180133b83]
lea rdx, [rbp - 0x20]
mov r9d, 8
call fcn.1800e70c0
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movaps xmm2, xmmword [rbp - 0x30]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
jmp fcn.1800e4bb0
Function at 0x1800289a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r12, r8
mov rdi, rdx
mov rbx, rcx
cmp r9, 8
jb 0x180028a1a
shr r9, 3
mov r14, r9
shl r14, 7
lea rdx, [rbx + r14]
imul r15, r9, 0xe0
lea r8, [rbx + r15]
mov rcx, rbx
mov rsi, r12
mov r12, r9
call fcn.1800289a0
mov rbx, rax
lea rdx, [rdi + r14]
lea r8, [rdi + r15]
mov rcx, rdi
mov r9, r12
call fcn.1800289a0
mov rdi, rax
add r14, rsi
add r15, rsi
mov rcx, rsi
mov rdx, r14
mov r8, r15
mov r9, r12
call fcn.1800289a0
mov r12, rax
mov qword [rsp + 0x38], rdi
mov rbp, qword [rbx + 8]
mov rsi, qword [rbx + 0x10]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov r13, rsi
sub r13, r8
mov qword [rsp + 0x48], r8
cmovb r8, rsi
mov rcx, rbp
mov qword [rsp + 0x50], rdx
call sub.VCRUNTIME140.dll_memcmp
cdqe
test eax, eax
cmovne r13, rax
movzx r15d, byte [rbx + 0x18]
movzx ecx, byte [rdi + 0x18]
mov eax, r15d
mov byte [rsp + 0x2f], cl
sub al, cl
xor r14d, r14d
cmp al, 0xff
sete r14b
xor eax, eax
test r13, r13
sets al
cmovne r14d, eax
mov rdx, qword [r12 + 8]
mov r13, qword [r12 + 0x10]
mov rdi, r12
mov r12, rsi
sub r12, r13
cmovae rsi, r13
mov rcx, rbp
mov qword [rsp + 0x30], rdx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
cdqe
test eax, eax
cmovne r12, rax
mov qword [rsp + 0x40], rdi
movzx ebp, byte [rdi + 0x18]
sub r15b, bpl
xor eax, eax
cmp r15b, 0xff
sete al
xor ecx, ecx
test r12, r12
sets cl
cmovne eax, ecx
cmp r14b, al
jne 0x180028b20
mov rax, qword [rsp + 0x48]
mov rsi, rax
sub rsi, r13
cmovb r13, rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x30]
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
cdqe
test eax, eax
cmovne rsi, rax
movzx ecx, byte [rsp + 0x2f]
sub cl, bpl
xor eax, eax
cmp cl, 0xff
sete al
xor ecx, ecx
test rsi, rsi
sets cl
cmovne eax, ecx
xor r14b, al
mov rbx, qword [rsp + 0x38]
cmovne rbx, qword [rsp + 0x40]
mov rax, rbx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x180028b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
cmp r9, 8
jb 0x180028bbb
mov rbx, r9
shr rbx, 3
and r9, 0xfffffffffffffff8
lea rdx, [rcx + r9]
mov r14, rbx
shl r14, 4
sub r14, rbx
sub r14, rbx
lea r8, [rcx + r14]
mov r15, r9
mov r9, rbx
call fcn.180028b40
mov r12, rax
lea rdx, [rdi + r15]
lea r8, [rdi + r14]
mov rcx, rdi
mov r9, rbx
call fcn.180028b40
mov rdi, rax
add r15, rsi
add r14, rsi
mov rcx, rsi
mov rdx, r15
mov r8, r14
mov r9, rbx
call fcn.180028b40
mov rsi, rax
mov rcx, r12
movzx r11d, byte [rcx]
movzx ebx, byte [rcx + 1]
movzx edx, byte [rdi]
movzx r8d, byte [rdi + 1]
xor r9d, r9d
cmp bl, r8b
setb r9b
xor eax, eax
cmp r11b, dl
setb al
cmove eax, r9d
movzx r9d, byte [rsi]
movzx r10d, byte [rsi + 1]
xor ebp, ebp
cmp bl, r10b
setb bpl
xor ebx, ebx
cmp r11b, r9b
setb bl
cmove ebx, ebp
cmp al, bl
jne 0x180028c22
xor ecx, ecx
cmp r8b, r10b
setb cl
xor r8d, r8d
cmp dl, r9b
setb r8b
cmove r8d, ecx
xor al, r8b
cmovne rdi, rsi
mov rcx, rdi
mov rax, rcx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x18002fa80
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
movaps xmmword [rbp], xmm6
mov qword [rbp - 8], 0xfffffffffffffffe
mov rax, qword [rdx + 0x48]
cmp byte [rax + 0x182], 1
jne 0x18002fb2a
cmp byte [rax + 0x183], 0
je 0x18002fb2a
mov rsi, qword [rbp + 0x88]
mov rdi, qword [rbp + 0x80]
mov r10, qword [rax + 0x138]
mov rbx, qword [r10 + 0x20]
lea r14, [rbx + rbx]
cmp r14, rsi
jbe 0x18002fb46
cmp qword [rax + 0x168], 1
jne 0x18002fb5a
mov rbx, rcx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x50], xmm0
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 2
lea rcx, [rbp - 0x28]
call fcn.18006e040
test byte [rbp - 0x28], 1
je 0x18002fbbd
mov rax, qword [rbp - 0x20]
mov qword [rbx + 8], rax
mov eax, 1
jmp 0x18002fbe5
movaps xmm6, xmmword [rbp]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.18006e040
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
call fcn.18006e040
jmp 0x18002fbe7
mov qword [rbp - 0x30], r8
mov qword [rbp - 0x38], r9
shl rbx, 4
xor r13d, r13d
mov rax, r14
shr rax, 0x3d
jne 0x18002fcc6
movabs rax, 0x7ffffffffffffff8
cmp rbx, rax
ja 0x18002fcc6
mov r12, rdx
test rbx, rbx
je 0x18002fbff
movzx eax, byte [0x1801dc1b9]
mov r13d, 8
mov edx, 8
mov r15, rcx
mov rcx, rbx
call fcn.18000a400
test rax, rax
je 0x18002fcc6
mov qword [rbp - 0x10], r14
jmp 0x18002fc0f
cmp rsi, 3
jae 0x18002fcd1
movsd xmm6, qword [rbp - 0x24]
shl rsi, 3
lea rdx, [rbp - 0x50]
mov rcx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
movlps qword [rbx + 4], xmm6
xor eax, eax
mov dword [rbx], eax
movaps xmm6, xmmword [rbp]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r15, rcx
mov eax, 8
mov qword [rbp - 0x10], 0
lea r8, [rbx - 8]
mov r13, rax
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov qword [r13 + rbx - 8], 0
mov qword [rsp + 0x28], r14
mov qword [rbp - 0x18], r13
mov qword [rsp + 0x20], r13
lea rcx, [rbp - 0x28]
mov rdx, r12
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x38]
call fcn.18006e040
test byte [rbp - 0x28], 1
je 0x18002fc74
mov rax, qword [rbp - 0x20]
mov qword [r15 + 8], rax
mov dword [r15], 1
mov rdx, qword [rbp - 0x10]
shl rdx, 3
mov r8d, 8
mov rcx, qword [rbp - 0x18]
jmp 0x18002fcaa
shl rsi, 3
mov rbx, qword [rbp - 0x24]
mov rcx, rdi
mov rdi, qword [rbp - 0x18]
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [r15 + 4], rbx
mov dword [r15], 0
mov rdx, qword [rbp - 0x10]
shl rdx, 3
mov r8d, 8
mov rcx, rdi
movaps xmm6, xmmword [rbp]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.18000a410
mov rcx, r13
mov rdx, rbx
call fcn.180118d70
lea r8, [0x180138388]
mov edx, 2
mov rcx, rsi
call fcn.180119470
int3