joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800236c0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x4a0
mov rax, qword [0x1801772b8]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
mov rbx, rdx
mov edi, 0xffffffff
test rdx, rdx
je 0x180023818
movsxd rcx, ecx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
call qword [sym.imp.WS2_32.dll_accept]
mov rdi, rax
cmp eax, 0xffffffff
jne 0x180023775
mov ecx, eax
call sym.version.dll_BIO_fd_should_retry
test eax, eax
je 0x180023728
mov eax, 0xfffffffe
jmp 0x18002381a
call fcn.1800d92ec
lea r9, str.________________________________________C:LibreSS5crypto_bio_b_sock.c
mov dword [rsp + 0x20], 0xd2
mov edx, 0xfff
mov ecx, 2
mov r8d, dword [rax]
call sym.version.dll_ERR_put_error
mov ecx, 0x20
mov dword [rsp + 0x20], 0xd3
lea r9, str.________________________________________C:LibreSS5crypto_bio_b_sock.c
mov edx, 0xfff
lea r8d, [rcx + 0x44]
call sym.version.dll_ERR_put_error
jmp 0x180023818
mov rcx, qword [rbx]
test rcx, rcx
je 0x180023789
call fcn.1800d8288
mov qword [rbx], 0
cmp word [rsp + 0x48], 2
jne 0x180023818
mov edx, dword [rsp + 0x40]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x30], 0xa
lea r8, [rsp + 0x80]
mov dword [rsp + 0x28], 0x20
lea rcx, [rsp + 0x48]
mov r9d, 0x401
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x180023818
lea r9, [rsp + 0x58]
mov rcx, rbx
lea r8, [rsp + 0x80]
lea rdx, str._s:_s
call sym.version.dll_asprintf
cmp eax, 0xffffffff
jne 0x180023818
lea r9, str.________________________________________C:LibreSS5crypto_bio_b_sock.c
mov dword [rsp + 0x20], 0xe4
mov edx, 0xfff
lea ecx, [rax + 0x21]
lea r8d, [rax + 0x42]
call sym.version.dll_ERR_put_error
mov qword [rbx], 0
mov eax, edi
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1800d61c0
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x4a0
pop rdi
ret
Function at 0x180023b40
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
push rsi
sub rsp, 0x70
movdqa xmm0, xmmword [0x1800fef80]
xor ebp, ebp
mov qword [rax + 8], rbp
xorps xmm1, xmm1
mov qword [rax - 0x28], rbp
mov rsi, rdx
mov qword [rax - 0x10], rbp
mov rbx, rcx
movdqu xmmword [rax - 0x38], xmm0
movdqu xmmword [rax - 0x20], xmm1
test rcx, rcx
jne 0x180023b9e
lea rcx, str.NULL_host_provided
call sym.version.dll_ERR_asprintf_error_data
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
lea r9, [rsp + 0x80]
mov qword [rsp + 0x88], rdi
lea r8, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
test eax, eax
je 0x180023c28
mov ecx, 0x20
mov dword [rsp + 0x20], 0x37
lea r9, str.________________________________________C:LibreSS5crypto_bio_b_sock.c
mov edx, 0xfff
lea r8d, [rcx + 0x46]
call sym.version.dll_ERR_put_error
mov qword [rsp + 0x30], rbp
lea rsi, [0x18017bbc0]
mov dword [rsp + 0x28], 0x400
mov r9d, 0x400
mov r8d, edi
mov qword [rsp + 0x20], rsi
xor edx, edx
mov ecx, 0x12ff
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8, rsi
lea rcx, str.getaddrinfo:_host_s_:__s
mov rdx, rbx
call sym.version.dll_ERR_asprintf_error_data
xor eax, eax
jmp 0x180023c44
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx + 0x20]
mov edx, dword [rax + 4]
mov dword [rsi], edx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, 1
mov rdi, qword [rsp + 0x88]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
Function at 0x180023c60
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x70
movdqa xmm0, xmmword [reloc.WS2_32.dll_accept]
xor esi, esi
mov qword [rax + 8], rsi
xorps xmm1, xmm1
mov qword [rax - 0x28], rsi
mov rdi, rdx
mov qword [rax - 0x10], rsi
mov rbx, rcx
movdqu xmmword [rax - 0x38], xmm0
movdqu xmmword [rax - 0x20], xmm1
test rcx, rcx
jne 0x180023cd1
lea r9, str.________________________________________C:LibreSS5crypto_bio_b_sock.c
mov dword [rax - 0x58], 0x4d
mov edx, 0xfff
lea ecx, [rbx + 0x20]
lea r8d, [rbx + 0x72]
call sym.version.dll_ERR_put_error
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea r9, [rsp + 0x80]
mov rdx, rbx
lea r8, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x180023d42
mov qword [rsp + 0x30], rsi
lea rdi, [0x18017bbc0]
mov dword [rsp + 0x28], 0x400
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 0x12ff
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r8, rdi
lea rcx, str.getaddrinfo:_service_s_:__s
mov rdx, rbx
call sym.version.dll_ERR_asprintf_error_data
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
mov rax, qword [rsp + 0x80]
mov rcx, qword [rax + 0x20]
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
mov rcx, qword [rsp + 0x80]
mov word [rdi], ax
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
lea r11, [rsp + 0x70]
mov eax, 1
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180023e10
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
movsxd rcx, ecx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x180023e4d
call fcn.1800d92ec
lea r9, str.________________________________________C:LibreSS5crypto_bio_b_sock.c
mov dword [rsp + 0x20], 0x74
mov edx, 0xfff
mov ecx, 2
mov r8d, dword [rax]
call sym.version.dll_ERR_put_error
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x18003c380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1801772b8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r14d, r8d
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
xor r15d, r15d
movzx r10d, byte [rax]
mov r12, rdx
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl r8d, 0x18
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 2]
or r10d, eax
mov qword [rbp - 0x28], r9
movzx eax, byte [rdi + 4]
shl eax, 0x10
or r8d, eax
mov qword [rbp - 0x20], r13
movzx eax, byte [rdi + 6]
or ecx, eax
mov dword [rbp - 0x30], r10d
or r8d, ecx
mov byte [rbp - 0xd], r10b
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
mov byte [rbp - 9], r8b
test r14d, r14d
je 0x18003c534
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
dec r14d
test ebx, ebx
jne 0x18003c4d3
mov rdx, r13
lea rcx, [rbp - 0x30]
call sym.version.dll_CAST_encrypt
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov r8d, dword [rbp - 0x2c]
movzx r9d, r10b
shr eax, 0x18
movzx edx, r8b
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi]
mov byte [r12 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x18003c470
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x18003c534
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rdi + 2], r9b
mov byte [rdi + 6], dl
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r10d, 8
shr r8d, 8
mov byte [rdi + 5], r8b
mov byte [rdi + 1], r10b
mov byte [rdi + 4], al
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800d61c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18003dd90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r11, r9
movzx ecx, byte [rcx + 0x80]
mov r10, r8
test cl, cl
je 0x18003dec9
mov r8, rbx
sub r8, rcx
sub r8, 0xffffffffffffff80
cmp r9, rcx
ja 0x18003ddc0
mov ecx, r11d
xor r9d, r9d
test ecx, ecx
jle 0x18003dec0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp ecx, 0x40
jb 0x18003de8b
lea eax, [rcx - 1]
movsxd rdi, eax
lea rax, [rdi + r10]
lea rsi, [rdi + rdx]
cmp rdx, rax
ja 0x18003ddfa
cmp rsi, r10
jae 0x18003de8b
lea rax, [rdi + r8]
cmp rdx, rax
ja 0x18003de0c
cmp rsi, r8
jae 0x18003de8b
mov eax, ecx
and eax, 0x8000003f
jge 0x18003de1c
dec eax
or eax, 0xffffffc0
inc eax
mov edi, ecx
sub edi, eax
movdqu xmm0, xmmword [r10]
add r9d, 0x40
movdqu xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x10]
movdqu xmmword [rdx], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x20]
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmm1, xmmword [r8 + 0x20]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r10 + 0x30]
add r10, 0x40
movdqu xmmword [rdx + 0x20], xmm1
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
pxor xmm1, xmm0
movdqu xmmword [rdx + 0x30], xmm1
add rdx, 0x40
cmp r9d, edi
jl 0x18003de20
cmp r9d, ecx
jge 0x18003deb6
sub r8, rdx
mov eax, ecx
sub eax, r9d
mov r9d, eax
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
xor al, byte [r10]
inc r10
mov byte [rdx], al
inc rdx
sub r9, 1
jne 0x18003dea0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
sub byte [rbx + 0x80], cl
sub r11d, ecx
mov r8, rdx
mov r9d, r11d
mov rdx, r10
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.18003df20
Function at 0x18003eb00
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r11, rcx
movzx eax, byte [rdx + 2]
movzx r9d, byte [rdx + 3]
mov r10, rdx
shl r9d, 8
lea rdx, [rdx + 0x10]
or r9d, eax
movzx eax, byte [rdx - 0xf]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx - 0x10]
shl r9d, 8
or r9d, eax
mov dword [rcx + 0x10], r9d
lea r9, [0x180104220]
movzx eax, byte [rdx - 0xa]
movzx ecx, byte [rdx - 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 0xc]
shl ecx, 8
or ecx, eax
mov dword [r11 + 0x14], ecx
movzx eax, byte [rdx - 6]
movzx ecx, byte [rdx - 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 8]
shl ecx, 8
or ecx, eax
mov dword [r11 + 0x18], ecx
movzx eax, byte [rdx - 2]
movzx ecx, byte [rdx - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx - 4]
shl ecx, 8
or ecx, eax
lea rax, [0x180104230]
mov dword [r11 + 0x1c], ecx
cmp r8d, 0x100
cmovne rdx, r10
cmovne r9, rax
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
mov dword [r11 + 0x20], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r11 + 0x24], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r11 + 0x28], ecx
movzx eax, byte [rdx + 0xe]
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r11 + 0x2c], ecx
movsx eax, byte [r9 + 2]
movsx ecx, byte [r9 + 3]
shl ecx, 8
or ecx, eax
movsx eax, byte [r9 + 1]
shl ecx, 8
or ecx, eax
movsx eax, byte [r9]
shl ecx, 8
or ecx, eax
mov dword [r11], ecx
movsx eax, byte [r9 + 6]
movsx ecx, byte [r9 + 7]
shl ecx, 8
or ecx, eax
movsx eax, byte [r9 + 5]
shl ecx, 8
or ecx, eax
movsx eax, byte [r9 + 4]
shl ecx, 8
or ecx, eax
mov dword [r11 + 4], ecx
movsx eax, byte [r9 + 0xa]
movsx ecx, byte [r9 + 0xb]
shl ecx, 8
or ecx, eax
movsx eax, byte [r9 + 9]
shl ecx, 8
or ecx, eax
movsx eax, byte [r9 + 8]
shl ecx, 8
or ecx, eax
mov dword [r11 + 8], ecx
movsx eax, byte [r9 + 0xe]
movsx ecx, byte [r9 + 0xf]
shl ecx, 8
or ecx, eax
movsx eax, byte [r9 + 0xd]
shl ecx, 8
or ecx, eax
movsx eax, byte [r9 + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r11 + 0xc], ecx
ret
Function at 0x18003f2b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
cmp dword [rcx + 0x120], 0xffffffff
mov r14, r8
mov rsi, rdx
mov rbx, rcx
jne 0x18003f2e5
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
call sym.version.dll_EVP_CIPHER_CTX_block_size
movsxd rbp, eax
mov qword [r14], rbp
test rsi, rsi
je 0x18003f3cb
movsxd rcx, dword [rbx + 0x120]
cmp ecx, ebp
jne 0x18003f34a
test eax, eax
jle 0x18003f3a7
mov r8, rsi
lea rcx, [rbx + 0xa0]
sub r8, rbx
mov rdx, rbp
nop word [rax + rax]
movzx eax, byte [rcx + 0x60]
xor al, byte [rcx]
mov byte [r8 + rcx - 0xa0], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18003f330
jmp 0x18003f3a7
mov eax, ebp
mov byte [rcx + rbx + 0x100], 0x80
sub eax, ecx
cmp eax, 1
jle 0x18003f371
dec eax
add rcx, 0x101
movsxd r8, eax
add rcx, rbx
xor edx, edx
call fcn.1800d7430
test ebp, ebp
jle 0x18003f3a7
mov rdx, rsi
lea rcx, [rbx + 0xc0]
sub rdx, rbx
mov r8, rbp
nop word [rax + rax]
movzx eax, byte [rcx + 0x40]
xor al, byte [rcx]
mov byte [rdx + rcx - 0xc0], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x18003f390
mov r9d, ebp
mov r8, rsi
mov rdx, rsi
mov rcx, rbx
call sym.version.dll_EVP_Cipher
test eax, eax
jne 0x18003f3cb
mov rdx, rbp
mov rcx, rsi
call sym.version.dll_explicit_bzero
xor eax, eax
jmp 0x18003f3d0
mov eax, 1
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18004a0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r8, [0x1801786e0]
jmp sym.version.dll_DES_fcrypt
Function at 0x18004b260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1801772b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc0]
mov rsi, rcx
mov rcx, qword [rsp + 0xc8]
mov r13, r9
mov r12, qword [rsp + 0xd8]
mov ebp, r8d
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov rax, qword [rsp + 0xd0]
mov r15, rdx
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov ebx, dword [r12]
mov qword [rsp + 0x48], rax
movzx r9d, byte [rax]
movzx eax, byte [rdi]
shl eax, 8
or r9d, eax
mov qword [rsp + 0x30], rcx
movzx eax, byte [rdi + 1]
movzx ecx, byte [rdi + 6]
shl eax, 0x10
or r9d, eax
shl ecx, 8
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r9d, eax
mov qword [rsp + 0x40], r12
movzx eax, byte [rdi + 4]
shl eax, 8
or r8d, eax
mov qword [rsp + 0x38], rdi
movzx eax, byte [rdi + 5]
or ecx, eax
mov dword [rsp + 0x20], r9d
shl ecx, 0x10
mov eax, r9d
shr eax, 8
or r8d, ecx
mov byte [rsp + 0x51], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
mov dword [rsp + 0x24], r8d
mov byte [rsp + 0x50], r9b
mov byte [rsp + 0x54], r8b
mov byte [rsp + 0x57], al
test ebp, ebp
je 0x18004b458
mov r12, qword [rsp + 0x28]
sub r15, rsi
mov rdi, qword [rsp + 0x30]
nop dword [rax + rax]
dec ebp
test ebx, ebx
jne 0x18004b3ec
mov r9, rdi
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, r13
call sym.version.dll_DES_encrypt3
mov r9d, dword [rsp + 0x20]
mov eax, r9d
mov r8d, dword [rsp + 0x24]
shr eax, 8
mov byte [rsp + 0x51], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x52], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x53], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x55], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x56], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x57], al
inc r14d
mov byte [rsp + 0x50], r9b
mov byte [rsp + 0x54], r8b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x50]
xor cl, byte [rsi]
mov byte [r15 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x18004b380
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
test r14d, r14d
je 0x18004b458
mov rax, qword [rsp + 0x48]
mov byte [rdi + 3], r8b
mov byte [rax], r9b
mov eax, r9d
shr eax, 8
mov byte [rdi], al
mov eax, r9d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, r8d
shr eax, 8
mov byte [rdi + 4], al
mov eax, r8d
shr eax, 0x10
shr r9d, 0x18
shr r8d, 0x18
mov byte [rdi + 6], r8b
mov byte [rdi + 2], r9b
mov byte [rdi + 5], al
mov dword [r12], ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800d61c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004b490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1801772b8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov rsi, rcx
mov r13, qword [rbp + 0x68]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov r12, rdx
movzx edx, byte [rdi + 3]
xor r15d, r15d
movzx r10d, byte [rax]
mov r14d, r8d
mov ebx, dword [r13]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r10d, eax
mov qword [rbp - 0x28], r9
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r10d, eax
mov qword [rbp - 0x20], r13
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rbp - 0x30], r10d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rbp - 0x10], r10b
shl ecx, 0x10
mov eax, r10d
shr eax, 8
or edx, ecx
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 9], al
test r8d, r8d
je 0x18004b63e
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx r8d, dl
movzx r9d, r10b
dec r14d
test ebx, ebx
jne 0x18004b5dc
lea r8d, [rbx + 1]
mov rdx, r13
lea rcx, [rbp - 0x30]
call sym.version.dll_DES_encrypt1
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
inc r15d
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi]
mov byte [r12 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x18004b576
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x18004b63e
mov rax, qword [rbp - 0x18]
mov byte [rdi + 3], r8b
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr r10d, 0x18
shr edx, 0x18
mov byte [rdi + 6], dl
mov byte [rdi + 2], r10b
mov byte [rdi + 5], al
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800d61c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180071a70
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r9, rcx
test r8d, r8d
jle 0x180071b78
mov qword [rsp + 0x10], rbx
inc rdx
mov qword [rsp], rdi
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx eax, byte [rdx - 1]
cmp r8d, 3
jb 0x180071af5
mov ecx, eax
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov byte [r9 + 1], al
mov rax, rcx
and eax, 0x3f
shr rcx, 6
add r9, 2
and ecx, 0x3f
movzx ebx, byte [rax + rdi]
movzx eax, byte [rcx + rdi]
mov rcx, r9
jmp 0x180071b44
mov ecx, eax
shl ecx, 0x10
cmp r8d, 2
jne 0x180071b08
movzx eax, byte [rdx]
shl eax, 8
or ecx, eax
mov eax, ecx
shr rcx, 0x12
movzx ecx, byte [rcx + rdi]
mov byte [r9], cl
mov ecx, eax
shr rcx, 0xc
and ecx, 0x3f
movzx ecx, byte [rcx + rdi]
mov byte [r9 + 1], cl
add r9, 2
mov rcx, r9
cmp r8d, 1
jne 0x180071b37
mov al, 0x3d
jmp 0x180071b42
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov bl, 0x3d
mov byte [r9], al
add r10d, 4
add rdx, 3
mov byte [rcx + 1], bl
sub r8d, 3
lea r9, [rcx + 2]
test r8d, r8d
jg 0x180071a96
mov rdi, qword [rsp]
mov eax, r10d
mov rbx, qword [rsp + 0x10]
mov byte [rcx + 2], 0
add rsp, 8
ret
mov byte [rcx], r10b
mov eax, r10d
add rsp, 8
ret
Function at 0x1800795e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
mov rsi, qword [rsp + 0x90]
mov rdi, r8
mov r12, qword [rsp + 0x88]
mov r15, rdx
mov rbp, rcx
mov ebx, dword [rsi]
test ebx, ebx
je 0x180079632
test rdi, rdi
je 0x180079632
mov eax, ebx
dec rdi
movzx ecx, byte [rax + r12]
xor cl, byte [rbp]
inc rbp
mov byte [r15], cl
inc r15
inc ebx
and ebx, 7
jne 0x180079610
mov rcx, qword [rsp + 0x80]
cmp rdi, 8
jb 0x1800796ea
mov qword [rsp + 0x60], r13
mov rsi, r15
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 3
mov r14, rbp
imul rax, r13, 0xfffffffffffffff8
sub rsi, r12
sub r14, r12
add rdi, rax
lea rax, [r13*8]
add r15, rax
mov qword [rsp + 0x68], r15
add rbp, rax
mov r15, qword [rsp + 0x78]
mov r8, r15
mov rdx, r12
call fcn.180079730
cmp ebx, 8
jae 0x1800796b6
mov edx, 7
mov eax, ebx
sub edx, ebx
add rax, r12
shr edx, 3
inc edx
mov rcx, qword [r14 + rax]
xor rcx, qword [rax]
mov qword [rsi + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1800796a1
mov rcx, qword [rsp + 0x80]
add rsi, 8
add r14, 8
xor ebx, ebx
sub r13, 1
jne 0x180079680
mov r15, qword [rsp + 0x68]
mov r9, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
test rdi, rdi
je 0x180079716
mov r8, r9
mov rdx, r12
call fcn.180079730
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x180079700
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret