joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180076510
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x30
call fcn.1800c7940
sub rsp, rax
mov rbx, r8
mov r8, qword [rsp + 0xa0]
mov rsi, rdx
mov edi, dword [r8]
mov rbp, rcx
mov dword [rsp + 0x80], edi
test edi, edi
je 0x18007657b
mov rdx, qword [rsp + 0x98]
test rbx, rbx
je 0x180076574
mov eax, edi
inc rsi
inc rbp
movzx ecx, byte [rax + rdx]
dec rbx
xor cl, byte [rbp - 1]
inc edi
and edi, 0xf
mov byte [rsi - 1], cl
jne 0x180076553
mov dword [rsp + 0x80], edi
mov rcx, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa8]
mov qword [rsp + 0x70], r12
movzx eax, byte [rcx + 0xd]
movzx r15d, byte [rcx + 0xc]
lea r13, [rcx + 0xc]
shl r15d, 8
mov r14d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
or r15d, eax
movzx eax, byte [rcx + 0xe]
shl r15d, 8
or r15d, eax
movzx eax, byte [rcx + 0xf]
shl r15d, 8
or r15d, eax
cmp rbx, 0x10
jb 0x180076686
mov eax, 0x10000000
mov rdi, rcx
mov r12, rbx
shr r12, 4
cmp r12, rax
cmova r12, rax
add r15d, r12d
mov eax, r15d
cmp rax, r12
jae 0x1800765f1
sub r12, rax
xor r15d, r15d
mov r8, r12
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call r10
mov eax, r15d
shr eax, 0x10
mov r11d, r15d
mov byte [rdi + 0xf], r15b
mov byte [rdi + 0xd], al
shr r11d, 0x18
mov eax, r15d
shr eax, 8
mov byte [r13], r11b
mov byte [rdi + 0xe], al
test r15d, r15d
jne 0x180076643
mov ecx, r14d
mov rdx, r13
nop
movzx eax, byte [rdx - 1]
dec rdx
dec ecx
add al, 1
mov byte [rdx], al
jne 0x180076643
test ecx, ecx
jne 0x180076630
mov r10, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x88]
shl r12, 4
sub rbx, r12
add rsi, r12
add rbp, r12
mov eax, 0x10000000
cmp rbx, 0x10
jae 0x1800765d2
mov edi, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x90]
mov r8, qword [rsp + 0xa0]
test rbx, rbx
je 0x180076740
mov r12, qword [rsp + 0x98]
xor eax, eax
mov qword [rsp + 0x20], rcx
mov qword [r12], rax
lea r8d, [rax + 1]
mov rdx, r12
mov rcx, r12
mov qword [r12 + 8], rax
call r10
mov rcx, qword [rsp + 0x90]
inc r15d
mov eax, r15d
mov byte [rcx + 0xf], r15b
shr eax, 0x18
mov byte [r13], al
mov eax, r15d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r15d
shr eax, 8
mov byte [rcx + 0xe], al
test r15d, r15d
jne 0x180076708
nop word [rax + rax]
movzx eax, byte [r13 - 1]
dec r13
dec r14d
add al, 1
mov byte [r13], al
jne 0x180076708
test r14d, r14d
jne 0x1800766f0
movsxd rcx, edi
sub rbp, r12
sub rsi, r12
add rcx, r12
add edi, ebx
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
inc rcx
xor al, byte [rcx - 1]
sub rbx, 1
mov byte [rsi + rcx - 1], al
jne 0x180076720
mov rax, qword [rsp + 0xa0]
mov dword [rax], edi
jmp 0x180076743
mov dword [r8], edi
mov r12, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180076de0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
mov eax, 0x20
call fcn.1800c7940
sub rsp, rax
xor eax, eax
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov dword [rcx + 0x174], eax
mov dword [rcx + 0x170], eax
cmp r8, 0xc
jne 0x180076e3e
mov rax, qword [rdx]
lea edi, [r8 - 0xb]
mov qword [rcx], rax
mov eax, dword [rdx + 8]
mov byte [rcx + 0xf], 1
mov dword [rcx + 8], eax
jmp 0x180076f9a
mov qword [rsp + 0x58], r14
mov r14, r8
cmp r8, 0x10
jb 0x180076ee3
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov r12, r8
shr r12, 4
mov rsi, rdx
mov qword [rsp + 0x50], r13
mov rax, r12
sub rsi, rcx
imul rax, rax, 0xfffffffffffffff0
add rbp, rax
nop word [rax + rax]
lea rdx, [rdi + 2]
mov rcx, rbx
mov r8d, 4
nop dword [rax]
movzx eax, byte [rsi + rcx]
add rcx, 4
add rdx, 4
xor byte [rcx - 4], al
movzx eax, byte [rdx - 5]
xor byte [rcx - 3], al
movzx eax, byte [rdx - 4]
xor byte [rcx - 2], al
movzx eax, byte [rdx - 3]
xor byte [rcx - 1], al
sub r8, 1
jne 0x180076e90
lea rdx, [rbx + 0x60]
mov rcx, rbx
call fcn.1800769e0
add rdi, 0x10
add rsi, 0x10
sub r12, 1
jne 0x180076e80
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
test rbp, rbp
je 0x180076f1c
test rbp, rbp
je 0x180076f10
mov rcx, rbx
sub rdi, rbx
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
inc rcx
xor byte [rcx - 1], al
sub rbp, 1
jne 0x180076f00
lea rdx, [rbx + 0x60]
mov rcx, rbx
call fcn.1800769e0
shl r14, 3
lea rdx, [rbx + 0x60]
mov rcx, rbx
xor byte [rbx + 0xf], r14b
mov rax, r14
shr rax, 0x38
xor byte [rbx + 8], al
mov rax, r14
shr rax, 0x30
xor byte [rbx + 9], al
mov rax, r14
shr rax, 0x28
xor byte [rbx + 0xa], al
mov rax, r14
shr rax, 0x20
xor byte [rbx + 0xb], al
mov rax, r14
shr rax, 0x18
xor byte [rbx + 0xc], al
mov rax, r14
shr rax, 0x10
xor byte [rbx + 0xd], al
mov rax, r14
shr rax, 8
xor byte [rbx + 0xe], al
call fcn.1800769e0
movzx eax, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
mov r14, qword [rsp + 0x58]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0xe]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0xf]
shl edi, 8
or edi, eax
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
inc edi
mov eax, edi
mov byte [rbx + 0xf], dil
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, edi
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, edi
shr eax, 8
mov byte [rbx + 0xe], al
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x180076fe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, 0x20
call fcn.1800c7940
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
je 0x18007701d
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx + 0x30]
lea rcx, [r8 + rax]
movabs rax, 0x2000000000000000
cmp rcx, rax
ja 0x1800770ed
cmp rcx, rbx
jb 0x1800770ed
mov qword [rsp + 0x30], rsi
mov esi, dword [rdi + 0x174]
mov qword [rdi + 0x30], rcx
test esi, esi
je 0x180077083
test rbx, rbx
je 0x180077072
movzx eax, byte [rbp]
mov ecx, esi
inc rbp
xor byte [rcx + rdi + 0x40], al
dec rbx
inc esi
and esi, 0xf
jne 0x180077054
jmp 0x180077076
test esi, esi
jne 0x1800770d0
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.1800769e0
mov qword [rsp + 0x38], r12
mov r12, rbx
and r12, 0xfffffffffffffff0
je 0x1800770aa
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
mov r9, r12
mov r8, rbp
call fcn.180076b20
add rbp, r12
sub rbx, r12
mov r12, qword [rsp + 0x38]
test rbx, rbx
je 0x1800770d0
xor ecx, ecx
mov esi, ebx
test rbx, rbx
je 0x1800770d0
nop dword [rax]
movzx eax, byte [rcx + rbp]
inc rcx
xor byte [rdi + rcx + 0x3f], al
cmp rcx, rbx
jb 0x1800770c0
mov dword [rdi + 0x174], esi
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x180078a10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.1800c7940
sub rsp, rax
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r12, qword [rsp + 0xd0]
mov rsi, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov r13, rdx
mov rbx, rcx
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
test dil, 0x40
jne 0x180078a7f
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
inc qword [rbx + 0x20]
mov r9, qword [rsp + 0x38]
movzx eax, dil
mov r8d, 0xf
xor ebp, ebp
and eax, 7
mov r14d, r8d
mov rcx, rbp
sub r14d, eax
mov byte [rbx], al
movsxd rax, r14d
cmp r14d, r8d
jae 0x180078ac6
lea rdx, [rax + rbx]
sub r8d, r14d
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], bpl
inc rdx
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x180078ab0
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rsi
je 0x180078ade
or eax, 0xffffffff
jmp 0x180078c5b
lea rax, [rsi + 0xf]
or rax, 8
shr rax, 3
add qword [rbx + 0x20], rax
movabs rax, 0x2000000000000000
cmp qword [rbx + 0x20], rax
jbe 0x180078b08
mov eax, 0xfffffffe
jmp 0x180078c5b
mov rdi, rsi
shr rdi, 4
test rdi, rdi
je 0x180078b7f
lea rax, [rbx + 0x10]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r13
mov qword [rsp + 0x20], rbx
call r12
shl rdi, 4
add r13, rdi
add r15, rdi
sub rsi, rdi
je 0x180078c0c
shr rdi, 4
mov r8d, 8
mov rdx, rbp
nop
movzx eax, byte [r8 + rbx + 7]
dec r8
movzx ecx, dil
add rdx, rax
shr rdi, 8
add rdx, rcx
mov byte [r8 + rbx + 8], dl
shr rdx, 8
test r8, r8
je 0x180078b7f
test rdi, rdi
jne 0x180078b50
test rdx, rdx
jne 0x180078b50
test rsi, rsi
je 0x180078c0c
mov edx, ebp
lea rcx, [rbx + 0x10]
mov r8, r13
movzx eax, byte [r8]
inc edx
inc r8
xor byte [rcx], al
mov eax, edx
inc rcx
cmp rax, rsi
jb 0x180078b91
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r12
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
test rsi, rsi
je 0x180078c16
lea rax, [rsp + 0x48]
lea rcx, [rsp + 0x48]
sub r13, rax
lea rax, [rsp + 0x48]
sub r15, rax
nop word [rax + rax]
movzx eax, byte [r13 + rcx]
inc ebp
inc rcx
xor al, byte [rcx - 1]
mov byte [r15 + rcx - 1], al
mov eax, ebp
cmp rax, rsi
jb 0x180078bf0
jmp 0x180078c16
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
movsxd rax, r14d
cmp r14d, 0x10
jae 0x180078c33
mov r8d, 0x10
lea rcx, [rax + rbx]
xor edx, edx
sub r8d, r14d
call fcn.180037390
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
mov al, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180037360
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180078c80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.1800c7940
sub rsp, rax
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r13, qword [rsp + 0xd0]
mov r14, qword [rcx + 0x30]
mov rbp, r9
mov r10, r8
mov qword [rsp + 0x38], r8
mov r15, rdx
mov rbx, rcx
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x40], rax
test dil, 0x40
jne 0x180078ceb
lea rdx, [rcx + 0x10]
mov r8, r14
call rax
mov r10, qword [rsp + 0x38]
movzx eax, dil
mov r8d, 0xf
xor esi, esi
and eax, 7
mov r12d, r8d
mov rcx, rsi
sub r12d, eax
mov byte [rbx], al
movsxd rax, r12d
cmp r12d, r8d
jae 0x180078d36
lea rdx, [rax + rbx]
sub r8d, r12d
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
inc rdx
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x180078d20
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x180078d4e
or eax, 0xffffffff
jmp 0x180078e86
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x180078dd1
lea rax, [rbx + 0x10]
mov r9, r14
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r10
mov rcx, r15
mov qword [rsp + 0x20], rbx
call r13
mov r13, qword [rsp + 0x38]
shl rdi, 4
add r13, rdi
add r15, rdi
sub rbp, rdi
je 0x180078e3d
shr rdi, 4
mov r8d, 8
mov rdx, rsi
nop dword [rax]
movzx eax, byte [r8 + rbx + 7]
dec r8
movzx ecx, dil
add rdx, rax
shr rdi, 8
add rdx, rcx
mov byte [r8 + rbx + 8], dl
shr rdx, 8
test r8, r8
je 0x180078dd6
test rdi, rdi
jne 0x180078da0
test rdx, rdx
jne 0x180078da0
jmp 0x180078dd6
mov r13, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
test rbp, rbp
je 0x180078e42
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rbx
call rdi
test rbp, rbp
je 0x180078e2f
lea rax, [rsp + 0x48]
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x48]
sub r15, rax
lea rax, [rsp + 0x48]
sub r13, rax
nop dword [rax + rax]
movzx eax, byte [r15 + rcx]
inc esi
inc rcx
xor al, byte [rcx - 1]
inc rdx
mov byte [r13 + rcx - 1], al
xor byte [rdx - 1], al
mov eax, esi
cmp rax, rbp
jb 0x180078e10
lea rcx, [rbx + 0x10]
mov r8, r14
mov rdx, rcx
call rdi
jmp 0x180078e42
mov rdi, qword [rsp + 0x40]
movsxd rax, r12d
cmp r12d, 0x10
jae 0x180078e5f
mov r8d, 0x10
lea rcx, [rax + rbx]
xor edx, edx
sub r8d, r12d
call fcn.180037390
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rbx
call rdi
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
mov al, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180037360
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18007e8e0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9, rcx
test rcx, rcx
je 0x18007e937
movzx eax, byte [rcx]
test al, al
je 0x18007e937
mov r10d, 0x100
nop dword [rax + rax]
movsx edx, al
inc r9
or edx, r10d
add r10d, 0x100
mov eax, edx
shr eax, 2
xor eax, edx
and eax, 0xf
movzx ecx, al
mov al, byte [r9]
imul edx, edx
rol r8d, cl
xor r8d, edx
test al, al
jne 0x18007e900
mov eax, r8d
shr eax, 0x10
xor eax, r8d
ret
xor eax, eax
ret
Function at 0x180085a00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r13
mov eax, 0x68
call fcn.1800c7940
sub rsp, rax
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r12, qword [rsp + 0xb0]
lea edi, [rdx - 1]
mov esi, r9d
lea eax, [rdi - 0x29]
mov r13, r8
cmp r9d, eax
jle 0x180085a63
mov edx, 0x79
lea r9, [0x18011f420]
mov dword [rsp + 0x20], 0x2d
lea ecx, [rdx - 0x75]
lea r8d, [rdx - 0xb]
call fcn.18005eba0
xor eax, eax
jmp 0x180085c3d
cmp edi, 0x29
jge 0x180085a8f
mov edx, 0x79
lea r9, [0x18011f438]
mov dword [rsp + 0x20], 0x33
lea ecx, [rdx - 0x75]
lea r8d, [rdx - 1]
call fcn.18005eba0
xor eax, eax
jmp 0x180085c3d
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rbp
mov byte [rcx], 0
lea rbp, [rcx + 0x15]
lea rbx, [rcx + 1]
call fcn.18005a530
movsxd rdx, dword [rsp + 0xb8]
xor r9d, r9d
mov r8, rbp
mov rcx, r12
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call fcn.18005b230
test eax, eax
je 0x180085b56
mov eax, edi
lea rcx, [rbp + 0x14]
xor edx, edx
sub eax, esi
sub eax, 0x29
movsxd r8, eax
call fcn.180037390
movsxd r11, esi
movsxd rax, edi
sub rax, r11
mov r8, rsi
mov rdx, r13
lea rcx, [rax + rbp - 0x14]
mov byte [rax + rbp - 0x15], 1
call fcn.180036ef0
mov edx, 0x14
mov rcx, rbx
call fcn.1800543b0
test eax, eax
jle 0x180085b56
add edi, 0xffffffec
lea rdx, [0x18011f450]
mov r8d, 0x49
mov ecx, edi
call fcn.180055b80
mov rsi, rax
test rax, rax
jne 0x180085b5d
lea r9, [0x18011f468]
lea edx, [rax + 0x79]
lea ecx, [rax + 4]
lea r8d, [rax + 0x41]
mov dword [rsp + 0x20], 0x4c
call fcn.18005eba0
mov r9d, 0x14
mov r8, rbx
mov edx, edi
mov rcx, rax
call fcn.1800859a0
test eax, eax
js 0x180085b56
test edi, edi
jle 0x180085ba1
mov r11, rsi
Function at 0x180085ff0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1800c7940
sub rsp, rax
mov r10, rcx
cmp dword [rsp + 0x60], r9d
jne 0x1800860dd
movzx eax, byte [r8]
cmp al, 0x6a
je 0x18008601b
cmp al, 0x6b
jne 0x1800860dd
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp al, 0x6b
jne 0x18008608c
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x180086048
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x180086048
cmp cl, 0xbb
jne 0x18008607b
inc eax
cmp eax, ebx
jl 0x180086032
sub ebx, eax
test eax, eax
jne 0x180086090
mov dword [rsp + 0x20], 0x8a
lea r9, [0x18011f528]
mov edx, pe_nt_image_headers64
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.18005eba0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x81
lea r9, [0x18011f510]
jmp 0x18008605d
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x1800860c6
mov edx, pe_nt_image_headers64
lea r9, str..crypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], SysAllocStringByteLen
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.18005eba0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r10
call fcn.180036ef0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, pe_nt_image_headers64
lea r9, [0x18011f4f8]
mov dword [rsp + 0x20], WSACleanup
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.18005eba0
or eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x180086d70
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.1800c7940
sub rsp, rax
cmp dword [0x18011fe64], 0
je 0x180086db9
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x180086d9d
mov dword [0x18011fe64], eax
jmp 0x180086db9
xorpd xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.180054360
cmp dword [0x18011fe64], 0
jne 0x180086dd6
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorpd xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.180054360
add rsp, 0x28
ret
Function at 0x18008d510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x1e8
call fcn.1800c7940
sub rsp, rax
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov rdi, qword [rsp + 0x248]
mov rbp, qword [rsp + 0x258]
mov r14, rcx
mov ebx, 1
mov rcx, rdi
mov dword [rsp + 0x4c], r9d
mov qword [rsp + 0x58], r8
mov esi, edx
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x44], ebx
call fcn.18005a770
mov r12d, eax
mov dword [rsp + 0x48], eax
test eax, eax
jns 0x18008d57f
xor eax, eax
jmp 0x18008d769
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x1e0], r13
call fcn.180095e00
mov r13d, dword [rsp + 0x250]
test r14, r14
jne 0x18008d5a2
xor esi, esi
jmp 0x18008d5c7
cmp esi, 0xffffffff
jne 0x18008d5c7
xor esi, esi
mov rax, r14
cmp byte [r14], sil
je 0x18008d5c3
cmp esi, 0x80000000
jae 0x18008d5c3
inc rax
inc esi
cmp byte [rax], 0
jne 0x18008d5b1
btr esi, 0x1f
mov qword [rsp + 0x1d8], r15
test r13d, r13d
je 0x18008d74a
nop dword [rax + rax]
mov eax, ebx
mov r15d, r13d
cmp r13d, r12d
cmovg r15d, r12d
shr eax, 0x18
lea rcx, [rsp + 0x60]
mov byte [rsp + 0x40], al
mov eax, ebx
mov r9, rdi
shr eax, 0x10
mov r8d, esi
mov rdx, r14
mov byte [rsp + 0x41], al
mov eax, ebx
mov byte [rsp + 0x43], bl
shr eax, 8
mov qword [rsp + 0x20], 0
mov byte [rsp + 0x42], al
call fcn.180095ab0
test eax, eax
je 0x18008d789
movsxd r8, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.180095d30
test eax, eax
je 0x18008d789
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov r8d, 4
call fcn.180095d30
test eax, eax
je 0x18008d789
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x60]
xor r8d, r8d
call fcn.180095d50
test eax, eax
je 0x18008d789
movsxd rdi, r15d
lea rdx, [rsp + 0x180]
mov rcx, rbp
mov r8, rdi
call fcn.180036ef0
mov eax, dword [rsp + 0x240]
cmp eax, 1
jle 0x18008d728
mov r13, qword [rsp + 0x50]
movsxd r12, r12d
lea ebx, [rax - 1]
lea rax, [rsp + 0x180]
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x180]
mov qword [rsp + 0x28], rax
mov r8d, esi
mov rdx, r14
mov rcx, r13
mov qword [rsp + 0x20], r12
call fcn.180095f80
test r15d, r15d
jle 0x18008d711
lea r8, [rsp + 0x180]
mov rcx, rbp
mov rdx, rdi
sub r8, rbp
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor byte [rcx - 1], al
sub rdx, 1
jne 0x18008d700
sub rbx, 1
jne 0x18008d6b4
mov r13d, dword [rsp + 0x250]
mov ebx, dword [rsp + 0x44]
mov r12d, dword [rsp + 0x48]
sub r13d, r15d
inc ebx
add rbp, rdi
mov rdi, qword [rsp + 0x50]
mov dword [rsp + 0x250], r13d
mov dword [rsp + 0x44], ebx
test r13d, r13d
jne 0x18008d5e0
lea rcx, [rsp + 0x60]
call fcn.180095ee0
mov eax, 1
mov r15, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.180037360
add rsp, 0x1e8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x60]
call fcn.180095ee0
xor eax, eax
jmp 0x18008d759
Function at 0x180092900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1800c7940
sub rsp, rax
mov eax, dword [r8 + 8]
mov rsi, rdx
mov rdi, rcx
cmp dword [rdx + 8], eax
jge 0x18009292c
mov rbx, r8
jmp 0x180092932
mov rbx, rdx
mov rsi, r8
mov edx, dword [rbx + 8]
cmp edx, dword [rcx + 0xc]
jg 0x18009293f
mov rax, rcx
jmp 0x180092944
call fcn.180053390
test rax, rax
jne 0x180092959
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x180092994
mov r9, r8
nop word [rax + rax]
mov rax, qword [rbx]
mov rcx, qword [rsi]
inc r8d
mov rdx, qword [rcx + r9]
add r9, 8
xor rdx, qword [rax + r9 - 8]
mov rax, qword [rdi]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x180092970
cmp r8d, dword [rbx + 8]
movsxd rdx, r8d
jge 0x1800929bd
shl rdx, 3
mov rax, qword [rbx]
mov rcx, qword [rdi]
inc r8d
mov rax, qword [rdx + rax]
add rdx, 8
mov qword [rdx + rcx - 8], rax
cmp r8d, dword [rbx + 8]
jl 0x1800929a1
mov edx, dword [rbx + 8]
mov dword [rdi + 8], edx
test edx, edx
jle 0x1800929e9
lea eax, [rdx - 1]
movsxd rcx, eax
mov rax, qword [rdi]
lea r8, [rax + rcx*8]
mov rax, qword [r8]
sub r8, 8
test rax, rax
jne 0x1800929e6
dec edx
test edx, edx
jg 0x1800929d4
mov dword [rdi + 8], edx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x180095ab0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0xd0
call fcn.1800c7940
sub rsp, rax
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r15, qword [rsp + 0x120]
xor eax, eax
mov r12, r9
movsxd rdi, r8d
mov r14, rdx
mov rsi, rcx
test r9, r9
je 0x180095afd
mov eax, 1
mov qword [rcx], r9
jmp 0x180095b00
mov r12, qword [rcx]
mov qword [rsp + 0xc8], rbx
mov qword [rsp + 0xc0], rbp
mov qword [rsp + 0xb8], r13
test rdx, rdx
je 0x180095bf9
mov rcx, r12
call fcn.18005a750
mov ebx, pe_nt_image_headers64
cmp eax, ebx
mov ebp, eax
jle 0x180095b4a
lea r8, str.j____int_sizeof_ctx__key_
lea edx, [rbx - 0x18]
lea rcx, [0x180121420]
call fcn.180066430
cmp ebp, edi
jge 0x180095ba0
lea rcx, [rsi + 8]
mov r8, r15
mov rdx, r12
call fcn.18005ac80
test eax, eax
je 0x180095ce1
lea rcx, [rsi + 8]
mov r8, rdi
mov rdx, r14
call fcn.18005aed0
test eax, eax
je 0x180095ce1
lea rbp, [rsi + 0x98]
lea rdx, [rsi + 0x9c]
lea rcx, [rsi + 8]
mov r8, rbp
call fcn.18005aef0
test eax, eax
je 0x180095ce1
jmp 0x180095bdc
test edi, edi
js 0x180095ba8
cmp edi, ebx
jle 0x180095bc0
lea r8, str.len_0__len__int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, 0x75
call fcn.180066430
lea rcx, [rsi + 0x9c]
mov r8, rdi
mov rdx, r14
call fcn.180036ef0
lea rbp, [rsi + 0x98]
mov dword [rbp], edi
mov eax, dword [rbp]
cmp eax, ebx
je 0x180095c01
sub ebx, eax
lea rcx, [rax + rsi + 0x9c]
xor edx, edx
mov r8d, ebx
call fcn.180037390
jmp 0x180095c01
test eax, eax
je 0x180095cd0
lea rbx, [rsi + 0x9d]
mov edi, 0x40
lea rcx, [rsp + 0x21]
mov rdx, rbx
mov r8, rdi
nop dword [rax + rax]
movzx eax, byte [rdx - 1]
add rcx, 2
add rdx, 2
xor al, 0x36
mov byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor al, 0x36
sub r8, 1
mov byte [rcx - 2], al
jne 0x180095c20
lea rcx, [rsi + 0x38]
mov r8, r15
mov rdx, r12
call fcn.18005ac80
test eax, eax
je 0x180095ce1
mov rcx, r12
call fcn.18005a750
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x38]
movsxd r8, eax
call fcn.18005aed0
test eax, eax
je 0x180095ce1
lea rdx, [rsp + 0x21]
nop dword [rax]
movzx eax, byte [rbx - 1]
add rdx, 2
add rbx, 2
xor al, 0x5c
mov byte [rdx - 3], al
movzx eax, byte [rbx - 2]
xor al, 0x5c
sub rdi, 1
mov byte [rdx - 2], al
jne 0x180095c80
lea rcx, [rsi + 0x68]
mov r8, r15
mov rdx, r12
call fcn.18005ac80
test eax, eax
je 0x180095ce1
mov rcx, r12
call fcn.18005a750
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x68]
movsxd r8, eax
call fcn.18005aed0
test eax, eax
je 0x180095ce1
lea rdx, [rsi + 0x38]
lea rcx, [rsi + 8]
call fcn.18005b050
test eax, eax
jne 0x180095ce5
xor eax, eax
jmp 0x180095cea
mov eax, 1
mov r13, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180037360
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret