joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
movups xmm0, xmmword [rcx]
mov rbx, rcx
xor r8d, r8d
movups xmm1, xmmword [rcx + 0x10]
lea rdx, [rbp - 0x69]
movups xmmword [rbp + 0x17], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rbp + 0x27], xmm1
movups xmm1, xmmword [rcx + 0x30]
lea rcx, [rbp + 0x17]
movups xmmword [rbp + 0x37], xmm0
movups xmmword [rbp + 0x47], xmm1
call fcn.18000f1c0
mov r8d, 1
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x69]
call fcn.18000f1c0
mov edi, 2
lea rdx, [rbp - 0x69]
mov r8d, edi
lea rcx, [rbp - 0x29]
call fcn.18000f1c0
lea r8d, [rdi + 1]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x69]
call fcn.18000f1c0
lea r8d, [rdi + 2]
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x29]
call fcn.18000f1c0
lea r8d, [rdi + 3]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x69]
call fcn.18000f1c0
lea r8d, [rdi + 4]
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x29]
call fcn.18000f1c0
lea r8d, [rdi + 5]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x69]
call fcn.18000f1c0
lea r8d, [rdi + 6]
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x29]
call fcn.18000f1c0
lea r8d, [rdi + 7]
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 0x69]
call fcn.18000f1c0
lea rcx, [rbp + 0x17]
sub rcx, rbx
lea rax, [rbx + 0x10]
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x20], xmm2
sub rdi, 1
jne 0x18000f170
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x18001c8a0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
lea rcx, [rdx*8]
call fcn.18001d3a0
xor ebp, ebp
mov r14, rax
mov ebx, ebp
cmp qword [rdi], rbx
jbe 0x18001c965
nop dword [rax]
mov rcx, qword [rdi + 8]
mov r8, qword [rcx + rbx*8]
test r8, r8
je 0x18001c959
nop dword [rax]
mov r10, qword [r8]
mov eax, 0x1505
mov r11, qword [r8 + 0x10]
mov rdx, rbp
mov qword [r8 + 0x10], rbp
mov r9, qword [r10 + 8]
test r9, r9
je 0x18001c924
mov r10, qword [r10 + 0x10]
movzx ecx, byte [r10 + rdx]
inc rdx
imul rax, rax, 0x21
add rax, rcx
cmp rdx, r9
jb 0x18001c910
xor edx, edx
div rsi
mov rcx, qword [r14 + rdx*8]
test rcx, rcx
jne 0x18001c938
mov qword [r14 + rdx*8], r8
jmp 0x18001c951
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x18001c94d
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x18001c941
mov qword [rcx + 0x10], r8
mov r8, r11
test r11, r11
jne 0x18001c8f0
inc rbx
cmp rbx, qword [rdi]
jb 0x18001c8e0
mov rcx, qword [rdi + 8]
call fcn.18001d2f0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov qword [rdi], rsi
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 8], r14
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18001c9a0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rdx
xor r9d, r9d
mov rdx, qword [rdx + 8]
mov r14, rcx
mov eax, 0x1505
test rdx, rdx
je 0x18001c9e4
mov rcx, qword [rbp + 0x10]
movzx r8d, byte [rcx + r9]
inc r9
imul rax, rax, 0x21
add rax, r8
cmp r9, rdx
jb 0x18001c9d0
xor edx, edx
div qword [r14]
mov rax, qword [r14 + 8]
lea rbx, [rdx*8]
mov rdi, qword [rbx + rax]
test rdi, rdi
je 0x18001ca93
mov rcx, qword [rdi]
mov rdx, rbp
call fcn.18001a280
test al, al
je 0x18001ca33
mov rax, qword [rdi + 0x10]
mov rdx, qword [r14 + 8]
mov qword [rbx + rdx], rax
dec qword [r14 + 0x10]
mov rcx, qword [rdi]
call fcn.180035110
mov rcx, rdi
call fcn.18001d2f0
jmp 0x18001ca93
cmp qword [rdi + 0x10], 0
lea rbx, [rdi + 0x10]
je 0x18001ca93
mov qword [rsp + 0x30], rsi
nop dword [rax]
nop word [rax + rax]
mov rsi, qword [rbx]
mov rdx, rbp
mov rcx, qword [rsi]
call fcn.18001a280
test al, al
jne 0x18001ca72
mov rdi, qword [rbx]
cmp qword [rdi + 0x10], 0
lea rbx, [rdi + 0x10]
jne 0x18001ca50
jmp 0x18001ca8e
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x10], rax
mov rcx, qword [rsi]
call fcn.180035110
mov rcx, rsi
call fcn.18001d2f0
dec qword [r14 + 0x10]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18001cb70
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
xor r9d, r9d
mov rdx, qword [rdx + 8]
mov eax, 0x1505
test rdx, rdx
je 0x18001cbb4
mov r10, qword [rdi + 0x10]
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [r10 + r9]
inc r9
imul rax, rax, 0x21
add rax, r8
cmp r9, rdx
jb 0x18001cba0
mov rbx, qword [rcx + 8]
xor edx, edx
div qword [rcx]
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
jne 0x18001cbd3
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx]
mov rdx, rdi
call fcn.18001a280
test al, al
jne 0x18001cbf8
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x18001cbd3
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 8]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18001cc10
Capabilities:
Hash data using djb2

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov eax, 0x1505
mov qword [rsp + 0x28], 4
nop dword [rax]
movzx edx, byte [rsp + r8 + 0x58]
inc r8
imul rax, rax, 0x21
add rax, rdx
cmp r8, 4
jb 0x18001cc40
mov rbx, qword [rcx + 8]
xor edx, edx
div qword [rcx]
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
jne 0x18001cc70
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rbx]
lea rdx, [rsp + 0x20]
call fcn.18001a280
test al, al
jne 0x18001cc92
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x18001cc70
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rax, qword [rbx + 8]
add rsp, 0x40
pop rbx
ret

Function at 0x18001cca0
Capabilities:
Hash data using djb2

Disassembly:
test r8, r8
je 0x18001cd95
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rsi, rdx
mov rdx, qword [rcx]
inc rax
mov qword [rsp + 0x30], rbx
mov rbp, r8
mov qword [rsp + 0x38], r14
mov rdi, rcx
cmp rax, rdx
jb 0x18001cce2
add rdx, rdx
call fcn.18001c8a0
mov r8, qword [rsi + 8]
xor edx, edx
mov eax, 0x1505
test r8, r8
je 0x18001cd14
mov r9, qword [rsi + 0x10]
nop word [rax + rax]
movzx ecx, byte [r9 + rdx]
inc rdx
imul rax, rax, 0x21
add rax, rcx
cmp rdx, r8
jb 0x18001cd00
mov rbx, qword [rdi + 8]
xor edx, edx
div qword [rdi]
lea r14, [rdx*8]
mov rbx, qword [r14 + rbx]
test rbx, rbx
je 0x18001cd48
nop
mov rcx, qword [rbx]
mov rdx, rsi
call fcn.18001a280
test al, al
jne 0x18001cd96
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x18001cd30
mov ecx, 0x18
call fcn.18001d3a0
mov rcx, rsi
mov rbx, rax
call fcn.18001a1b0
mov qword [rbx], rax
mov qword [rbx + 8], rbp
mov rcx, qword [rdi + 8]
mov rdx, qword [r14 + rcx]
mov qword [rbx + 0x10], rdx
mov rcx, qword [rdi + 8]
mov qword [r14 + rcx], rbx
inc qword [rdi + 0x10]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov qword [rbx + 8], rbp
jmp 0x18001cd7c
Function at 0x18001dfc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
movsxd rax, dword [rcx + 0x3c]
xor edi, edi
mov rsi, rdx
mov r14, rcx
mov ebp, dword [rax + rcx + 0x88]
add rbp, rcx
mov r15d, dword [rbp + 0x20]
mov r12d, dword [rbp + 0x24]
add r15, rcx
mov r13d, dword [rbp + 0x1c]
add r12, rcx
add r13, rcx
cmp dword [rbp + 0x18], edi
jbe 0x18001e0c9
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r15 + rdi*4]
xor ebx, ebx
lea rax, [rcx + r14]
movzx ecx, byte [rcx + r14]
test cl, cl
je 0x18001e057
lea rdx, [rsp + 0x40]
sub rdx, rax
nop dword [rax + rax]
cmp rbx, 0x5a
jae 0x18001e057
mov byte [rdx + rax], cl
inc rbx
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x18001e040
movsd xmm0, qword [rsi + 0x14]
lea rcx, [rsp + 0xb0]
movzx eax, word [rsi + 0x1c]
movsd qword [rsp + rbx + 0x40], xmm0
mov word [rsp + rbx + 0x48], ax
call fcn.18002f620
lea r8d, [rbx + 0xa]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb0]
call fcn.1800309a0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.18002f350
mov rax, qword [rsp + 0x20]
cmp rax, qword [rsi]
jne 0x18001e0be
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsi + 8]
jne 0x18001e0be
mov eax, dword [rsp + 0x30]
cmp eax, dword [rsi + 0x10]
je 0x18001e0ec
inc edi
cmp edi, dword [rbp + 0x18]
jb 0x18001e020
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx ecx, word [r12 + rdi*2]
mov eax, dword [r13 + rcx*4]
add rax, r14
jmp 0x18001e0cb
Function at 0x18001e100
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x220
mov rax, qword gs:[0x60]
mov rbp, rcx
mov r14, qword [rax + 0x18]
add r14, 0x20
mov rsi, qword [r14]
cmp rsi, r14
je 0x18001e210
nop dword [rax]
mov rdi, qword [rsi + 0x50]
lea rbx, [rsp + 0x110]
nop dword [rax]
movsx ecx, byte [rdi]
call fcn.180044b60
mov byte [rbx], al
lea rbx, [rbx + 1]
lea rdi, [rdi + 2]
test al, al
jne 0x18001e150
xor ebx, ebx
cmp byte [rsp + 0x110], bl
je 0x18001e190
cmp rbx, 0x5a
jae 0x18001e190
movzx eax, byte [rsp + rbx + 0x110]
mov byte [rsp + rbx + 0x40], al
inc rbx
cmp byte [rsp + rbx + 0x110], 0
jne 0x18001e171
movsd xmm0, qword [rbp + 0x14]
lea rcx, [rsp + 0xb0]
movzx eax, word [rbp + 0x1c]
movsd qword [rsp + rbx + 0x40], xmm0
mov word [rsp + rbx + 0x48], ax
call fcn.18002f620
lea r8d, [rbx + 0xa]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xb0]
call fcn.1800309a0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.18002f350
mov rax, qword [rsp + 0x20]
cmp rax, qword [rbp]
jne 0x18001e1f8
mov rax, qword [rsp + 0x28]
cmp rax, qword [rbp + 8]
jne 0x18001e1f8
mov eax, dword [rsp + 0x30]
cmp eax, dword [rbp + 0x10]
je 0x18001e230
mov rsi, qword [rsi]
cmp rsi, r14
jne 0x18001e140
nop dword [rax]
nop dword [rax + rax]
xor eax, eax
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rax, qword [rsi + 0x20]
jmp 0x18001e212

Function at 0x1800210a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
cmp qword [r8 + 8], 0
mov rdi, rdx
mov rbp, rcx
jne 0x1800210c4
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov dl, 1
mov qword [rsp + 0x30], rbx
mov rcx, r8
call fcn.18001ae20
mov rbx, rax
test rax, rax
je 0x180021117
xor ecx, ecx
cmp qword [rax + 8], rcx
jbe 0x180021108
mov edx, ecx
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rdx, [rdx + 1]
inc ecx
xor byte [rax + rdx - 1], 0x5c
movsxd rax, ecx
cmp rax, qword [rbx + 8]
jb 0x1800210f0
cmp qword [rbx + 8], 4
mov rcx, rbx
jae 0x180021129
call fcn.180035110
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
movzx edx, byte [rax + 3]
movzx r8d, byte [rax + 2]
add rdx, 4
call fcn.18001a9f0
mov rdx, qword [rbp + 8]
xor r8d, r8d
add rdx, qword [rdi + 8]
mov rcx, rax
mov rsi, rax
call fcn.18001a9f0
mov rcx, rbx
mov rdi, rax
call fcn.180035110
mov rcx, rsi
call fcn.180035110
mov rsi, qword [rsp + 0x38]
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180023e30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 8], 0x40
mov rdi, rdx
mov rbx, rcx
jbe 0x180023e5b
call fcn.180024b50
mov rcx, rax
jmp 0x180023e63
call fcn.18001a1b0
mov rcx, rbx
mov rsi, rax
call fcn.18001a1b0
xor r8d, r8d
mov rcx, rsi
mov rbp, rax
lea edx, [r8 + 0x40]
call fcn.18001ac20
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 0x40]
call fcn.18001ac20
mov rcx, qword [rbp + 0x10]
lea rdx, [rsi + 0x10]
mov rax, qword [rdx]
lea r8, [rbp + 0x10]
xor r11d, r11d
lea r9, [rcx + 0x3f]
lea r10, [rax + 0x3f]
cmp rcx, r10
ja 0x180023eb4
cmp r9, rax
jae 0x180023f59
cmp rcx, rdx
ja 0x180023ec2
cmp r9, rdx
jae 0x180023f59
cmp rcx, r8
ja 0x180023ed0
cmp r9, r8
jae 0x180023f59
cmp rax, rdx
ja 0x180023eda
cmp r10, rdx
jae 0x180023f59
cmp rax, r8
ja 0x180023ee4
cmp r10, r8
jae 0x180023f59
movdqa xmm2, xmmword [str.6666666666666666ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov r9, r11
movdqa xmm3, xmmword [0x180049aa0]
mov r11d, 0x40
nop dword [rax]
movdqu xmm0, xmmword [rax + r9]
movdqa xmm1, xmm3
pxor xmm0, xmm2
movdqu xmmword [rax + r9], xmm0
movdqu xmm0, xmmword [rcx + r9]
pxor xmm1, xmm0
movdqu xmmword [rcx + r9], xmm1
movdqu xmm0, xmmword [rax + r9 + 0x10]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax + r9 + 0x10], xmm1
movdqu xmm0, xmmword [rcx + r9 + 0x10]
movdqa xmm1, xmm3
pxor xmm1, xmm0
movdqu xmmword [rcx + r9 + 0x10], xmm1
add r9, 0x20
cmp r9, r11
jl 0x180023f00
movsxd rax, r11d
cmp rax, 0x40
jge 0x180023f79
mov rcx, qword [rdx]
xor byte [rcx + rax], 0x36
mov rcx, qword [r8]
xor byte [rcx + rax], 0x5c
inc rax
cmp rax, 0x40
jl 0x180023f62
mov rdx, rdi
mov rcx, rsi
call fcn.180019fd0
mov rcx, rsi
call fcn.180024b50
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call fcn.180019fd0
mov rcx, rbp
call fcn.180024b50
mov rcx, rsi
mov rbx, rax
call fcn.180035110
mov rcx, rbp
call fcn.180035110
mov rcx, rdi
call fcn.180035110
mov rbp, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180024130
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r10, qword [rsp + 0x30]
xor r11d, r11d
xor ebx, ebx
xor eax, eax
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test r10, r10
je 0x1800242de
lea r14, [0x180049af0]
nop dword [rax + rax]
xor edx, edx
cmp rax, r10
jae 0x18002418b
cmp byte [rax + r9], 0x20
jne 0x180024188
inc rax
inc edx
cmp rax, r10
jb 0x180024177
cmp rax, r10
je 0x180024203
mov rcx, r10
sub rcx, rax
cmp rcx, 2
jb 0x1800241a8
cmp byte [rax + r9], 0xd
jne 0x1800241a8
cmp byte [rax + r9 + 1], 0xa
je 0x1800241f7
movzx ecx, byte [rax + r9]
cmp cl, 0xa
je 0x1800241f7
test edx, edx
jne 0x1800242cd
cmp cl, 0x3d
jne 0x1800241cc
inc r11d
cmp r11d, 2
ja 0x1800242cd
cmp cl, 0x7f
ja 0x1800242cd
movzx ecx, cl
movzx edx, byte [rcx + r14]
cmp dl, 0x7f
je 0x1800242cd
cmp dl, 0x40
jae 0x1800241f4
test r11d, r11d
jne 0x1800242cd
inc rbx
inc rax
cmp rax, r10
jb 0x180024170
test rbx, rbx
je 0x1800242de
lea rcx, [rbx + rbx*2]
lea rdx, [rcx*2 + 7]
mov ecx, r11d
shr rdx, 3
sub rdx, rcx
test rbp, rbp
je 0x1800242d4
cmp rdi, rdx
jb 0x1800242d4
xor r10d, r10d
xor ebx, ebx
mov r11d, 3
mov r8, rbp
test rax, rax
je 0x1800242c5
movabs rdi, 0x100002400
movzx edx, byte [r9]
cmp dl, 0x20
ja 0x180024260
bt rdi, rdx
jb 0x1800242bc
movzx ecx, dl
movzx edx, byte [rcx + r14]
xor ecx, ecx
cmp dl, 0x40
sete cl
and edx, 0x3f
sub r11d, ecx
inc rbx
mov ecx, r10d
mov r10d, edx
shl ecx, 6
or r10d, ecx
cmp rbx, 4
jne 0x1800242bc
xor ebx, ebx
test r11d, r11d
je 0x18002429e
mov ecx, r10d
shr ecx, 0x10
mov byte [r8], cl
inc r8
cmp r11d, 1
jbe 0x1800242b0
mov ecx, r10d
shr ecx, 8
mov byte [r8], cl
inc r8
cmp r11d, 2
jbe 0x1800242bc
mov byte [r8], r10b
inc r8
inc r9
sub rax, 1
jne 0x180024251
sub r8, rbp
mov qword [rsi], r8
jmp 0x1800242e5
mov eax, 2
jmp 0x1800242e7
mov qword [r8], rdx
mov eax, 1
jmp 0x1800242e7
mov qword [r8], 0
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x180024300
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
mov rsi, qword [rsp + 0x40]
xor r11d, r11d
mov rbx, r9
mov r14, r8
mov r9, rdx
mov r15, rcx
test rsi, rsi
jne 0x180024333
mov qword [r8], r11
xor eax, eax
mov rbx, qword [rsp + 0x38]
pop r15
pop r14
pop rsi
ret
movabs r10, 0xaaaaaaaaaaaaaaab
movabs rcx, 0x3fffffffffffffff
mov rax, r10
mul rsi
mov rax, r11
shr rdx, 1
lea r8, [rdx + rdx*2]
cmp rsi, r8
setne al
add rax, rdx
cmp rax, rcx
jbe 0x18002437c
mov qword [r14], 0xffffffffffffffff
mov eax, 1
mov rbx, qword [rsp + 0x38]
pop r15
pop r14
pop rsi
ret
lea rax, [rax*4 + 1]
cmp r9, rax
jb 0x1800244bc
test r15, r15
je 0x1800244bc
mov qword [rsp + 0x20], rbp
mov rbp, r11
mov qword [rsp + 0x30], r12
lea r12, [0x180049ab0]
mov rcx, r15
test r8, r8
je 0x18002443a
mov qword [rsp + 0x28], rdi
lea rdx, [r8 - 1]
mov rax, r10
mul rdx
mov rdi, rdx
shr rdi, 1
inc rdi
lea rbp, [rdi + rdi*2]
movzx r10d, byte [rbx + 2]
movzx r9d, byte [rbx + 1]
movzx r8d, byte [rbx]
mov edx, r9d
shr edx, 4
mov eax, r8d
shr rax, 2
add rbx, 3
shl r8d, 4
add edx, r8d
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + 1], al
mov eax, r10d
shr eax, 6
and r10d, 0x3f
lea edx, [rax + r9*4]
and edx, 0x3f
movzx eax, byte [rdx + r12]
mov byte [rcx + 2], al
movzx eax, byte [r10 + r12]
mov byte [rcx + 3], al
add rcx, 4
sub rdi, 1
jne 0x1800243d2
mov rdi, qword [rsp + 0x28]
cmp rbp, rsi
jae 0x180024499
movzx r8d, byte [rbx]
inc rbp
cmp rbp, rsi
jae 0x180024450
movzx r11d, byte [rbx + 1]
mov edx, r11d
mov rax, r8
shr edx, 4
shr rax, 2
shl r8d, 4
add edx, r8d
and edx, 0x3f
movzx eax, byte [rax + r12]
mov byte [rcx], al
movzx eax, byte [rdx + r12]
mov byte [rcx + 1], al
cmp rbp, rsi
jae 0x18002448d
and r11d, 0xf
shl r11d, 2
movzx eax, byte [r11 + r12]
mov byte [rcx + 2], al
jmp 0x180024491
mov byte [rcx + 2], 0x3d
mov byte [rcx + 3], 0x3d
add rcx, 4
mov r12, qword [rsp + 0x30]
mov rax, rcx
mov rbp, qword [rsp + 0x20]
sub rax, r15
mov qword [r14], rax
xor eax, eax
mov byte [rcx], 0
mov rbx, qword [rsp + 0x38]
pop r15
pop r14
pop rsi
ret
mov rbx, qword [rsp + 0x38]
mov qword [r14], rax
mov eax, 1
pop r15
pop r14
pop rsi
ret

Function at 0x1800251a0
Capabilities:
Encrypt data using curve25519

Disassembly:
and byte [rcx + 0x1f], 0x3f
or byte [rcx + 0x1f], 0x40
and byte [rcx], 0xf8
ret
Function at 0x18002d630
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10, rcx
mov r11, rdx
sub r10, r8
mov rbx, rcx
sub r11, r8
mov r9, r8
mov edi, 0x1f
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9]
movzx eax, byte [r11 + r9]
lea r9, [r9 + 4]
and cl, 3
and al, 3
shl cl, 2
xor cl, al
mov byte [r10 + r9 - 4], cl
mov ecx, dword [r9 - 4]
mov eax, dword [r11 + r9 - 4]
shr ecx, 2
and cl, 3
shr eax, 2
shl cl, 2
and al, 3
xor cl, al
mov byte [r10 + r9 - 3], cl
mov ecx, dword [r9 - 4]
mov eax, dword [r11 + r9 - 4]
shr ecx, 4
and cl, 3
shr eax, 4
shl cl, 2
and al, 3
xor cl, al
mov byte [r10 + r9 - 2], cl
mov ecx, dword [r9 - 4]
mov eax, dword [r11 + r9 - 4]
shr ecx, 6
and cl, 3
shr eax, 6
shl cl, 2
and al, 3
xor cl, al
mov byte [r10 + r9 - 1], cl
sub rdi, 1
jne 0x18002d660
movzx ecx, byte [r8 + 0x7c]
movzx eax, byte [rdx + 0x7c]
and cl, 3
mov rdi, qword [rsp + 0x10]
and al, 3
shl cl, 2
xor cl, al
mov byte [rbx + 0x7c], cl
mov ecx, dword [r8 + 0x7c]
mov eax, dword [rdx + 0x7c]
shr ecx, 2
and cl, 3
shr eax, 2
shl cl, 2
and al, 3
xor cl, al
mov byte [rbx + 0x7d], cl
mov ecx, dword [r8 + 0x7c]
mov eax, dword [rdx + 0x7c]
shr ecx, 4
and cl, 3
shr eax, 4
shl cl, 2
and al, 3
xor cl, al
mov byte [rbx + 0x7e], cl
mov rbx, qword [rsp + 8]
ret
Function at 0x18002e300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rcx + 0x7c]
lea r10, [rcx + 0x74]
mov r9d, r11d
mov r8, rcx
xor r9d, 0x7f
mov ebx, 5
dec r9d
shr r9d, 0x1f
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r10 - 0x10]
mov eax, dword [r10 - 0xc]
xor ecx, 0xff
mov edx, dword [r10 + 4]
lea r10, [r10 - 0x18]
xor eax, 0xff
dec ecx
dec eax
shr ecx, 0x1f
shr eax, 0x1f
xor edx, 0xff
and ecx, eax
dec edx
mov eax, dword [r10 + 0x10]
xor eax, 0xff
shr edx, 0x1f
dec eax
shr eax, 0x1f
and ecx, eax
mov eax, dword [r10 + 0x14]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
mov eax, dword [r10 + 0x18]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
and ecx, edx
and r9d, ecx
sub rbx, 1
jne 0x18002e330
mov ecx, dword [r8]
sub ecx, 0xed
not ecx
shr ecx, 0x1f
and ecx, r9d
neg ecx
mov eax, ecx
movzx edx, cl
and eax, 0x7f
sub r11d, eax
mov eax, 0x1e
mov dword [r8 + 0x7c], r11d
nop dword [rax]
nop dword [rax + rax]
sub dword [r8 + rax*4], edx
sub dword [r8 + rax*4 - 4], edx
sub rax, 2
test rax, rax
jg 0x18002e3d0
mov rbx, qword [rsp + 8]
and ecx, 0xed
sub dword [r8], ecx
ret
Function at 0x180030c90
Capabilities:
Hash data using sha256

Disassembly:
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
mov qword [rcx + 0x20], 0
ret
Function at 0x180031c10
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov dword [rcx + 0xd0], edx
test edx, edx
jne 0x180031c94
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x48], rax
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx + 0x10], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x18], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x20], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x28], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x30], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x38], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x40], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x48], rax
ret
Function at 0x140b71aec
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r13
jmp 0x140c23c00
push rdx
not dl
movzx dx, r13b
push r15
cdq
jmp 0x140c013bd
inc edx
stc
rol edx, 1
push r8
or r8w, r14w
or r8, 0x60302e27
xor dword [rsp], edx
btr r8d, esp
pop r8
stc
movsxd rdx, edx
jmp 0x140b38e08
add rbx, rdx
jmp 0x140bddab3
push r10
jmp 0x140b1bcdc
sub r8, rsi
add dl, 0x55
mov edx, ebx
dec rdx
lea rbx, [0x140b94166]
movsx dx, r12b
mov edx, dword [r11]
jmp 0x140be08cd
inc edx
bswap edx
jmp 0x140b279a9
jmp rbx
add r11, 4
xor edx, r8d
jmp 0x140bd18a9
push rbx
movsx ebp, bx
mov dx, 0x5213
cdq
push r8
push r12
cwd
push rax
cwd
movsx rbp, dx
push r11
cwd
rdtsc
xchg bp, cx
push rsi
rdtsc
push rdi
pushfq
movabs rax, 0
xor rcx, 0x17be7411
sub rdx, 0x51440f2f
push rax
sub bpl, bl
shr r11w, cl
bswap r11
mov r11, qword [rsp + 0x90]
rcr ch, cl
cwd
xchg ebp, esi
sub r11d, 0x369a1e3f
xor r11d, 0x2abc362b
btr bx, r8w
rol r11d, 1
bswap r11d
rcl bpl, 0xb9
add r11, rax
test r14b, r9b
xadd rbp, r8
movabs rcx, 0x100000000
add r11, rcx
add bl, 0x9a
mov rbp, rsp
sub rsp, 0x180
and rsp, 0xfffffffffffffff0
ror r8b, 0xf
mov r8, r11
movzx bx, r8b
clc
movabs rsi, 0
btr dx, si
jmp 0x140b9415b
push rcx
cmova cx, r9w
push r9
movzx rcx, sp
push rbp
push r14
jmp 0x140b1bf5f