joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18028ed00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push r12
push r13
push r14
mov eax, 0x50
call fcn.1803146e0
sub rsp, rax
mov r14, qword [rsp + 0xa8]
lea r10, [rax - 0x51]
mov rbp, qword [rsp + 0xb0]
xor r11d, r11d
cmp r14, 1
mov eax, r11d
mov r13, r9
mov r12, r8
mov r9, qword [rcx]
setne al
add rax, rbp
mov rsi, rcx
cmp rax, r9
jbe 0x18028ed5e
xor eax, eax
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0x80], rbx
cmp r14, 1
je 0x18028ee60
lea r10, [r8 - 1]
add r10, r9
movzx ebx, byte [r10]
cmp dword [rsp + 0xb8], r11d
je 0x18028ed9b
sub r9, rbx
mov eax, 1
sub r9, rbp
dec r9
mov qword [rcx], r9
jmp 0x18028ee97
lea rcx, [rbx + rax]
mov qword [rsp + 0x98], r15
mov r15d, 0x100
mov r8, r9
sub r8, rcx
mov rax, r9
xor r8, rcx
xor rax, rcx
or r8, rax
xor r8, r9
shr r8, 0x3f
dec r8
cmp r9, r15
cmovb r15, r9
test r15, r15
je 0x18028ee3a
mov qword [rsp + 0x90], rdi
mov rdi, rbx
shr rdi, 0x3f
nop dword [rax]
nop dword [rax + rax]
mov rax, r11
lea r10, [r10 - 1]
shr rax, 0x3f
mov rcx, rbx
sub rcx, r11
inc r11
shr rcx, 0x3f
xor cl, al
xor al, dil
or cl, al
dec cl
movzx edx, cl
movzx ecx, byte [r10 + 1]
xor rcx, rbx
and rdx, rcx
not rdx
and r8, rdx
cmp r11, r15
jb 0x18028edf0
mov rdi, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov r15, qword [rsp + 0x98]
lea rax, [rbx + 1]
not r8
movzx r10d, r8b
dec r10
shr r10, 0x3f
neg r10
and rax, r10
sub r9, rax
mov qword [rsi], r9
mov rax, qword [rsp + 0xc0]
mov r9, r13
mov qword [rsp + 0x40], rax
mov r8, r12
mov rax, qword [rsp + 0xa0]
mov rcx, rsi
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.18028e930
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x180293370
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x68
call fcn.1803146e0
sub rsp, rax
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x3c]
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test eax, eax
je 0x1802934a3
movups xmm0, xmmword [rcx + 0x10]
mov r15, qword [rcx + 0x20]
lea rbx, [rcx + 0x10]
dec eax
mov dword [rsp + 0x28], 1
mov dword [rcx + 0x3c], eax
xor r9d, r9d
mov eax, dword [rbx + 8]
xor r8d, r8d
and al, 0x7f
mov dword [rsp + 0x30], edi
movups xmmword [rsp + 0x48], xmm0
and byte [rsp + 0x54], 0x7f
xor edx, edx
mov byte [rsp + 0x50], al
mov rcx, r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.18011fd40
test eax, eax
je 0x1802934a3
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov r9, r14
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, r15
call fcn.180120a70
test eax, eax
je 0x1802934a3
mov r9, rdi
lea rdx, [rsp + 0x38]
mov r8, rbp
mov rcx, rsi
call fcn.180293aa0
test eax, eax
je 0x1802934a3
lea rax, [rbx + 0xf]
xor r8d, r8d
lea rcx, [rsp + 0x38]
cmp rcx, rax
ja 0x180293479
lea rax, [rsp + 0x47]
cmp rax, rbx
jb 0x180293479
lea rcx, [rsp + 0x38]
mov eax, r8d
sub rbx, rcx
nop
lea rdx, [rsp + 0x38]
add rdx, rax
inc rax
movzx ecx, byte [rbx + rdx]
xor byte [rdx], cl
cmp rax, 0x10
jl 0x180293460
jmp 0x18029348c
movdqu xmm1, xmmword [rsp + 0x38]
movdqu xmm0, xmmword [rbx]
xorps xmm1, xmm0
movdqu xmmword [rsp + 0x38], xmm1
mov rax, qword [rsp + 0x38]
or rax, qword [rsp + 0x40]
je 0x1802934bf
mov rdx, rdi
mov rcx, rbp
call fcn.18012d900
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180313c00
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsi + 0x38], r8d
mov eax, edi
jmp 0x1802934a5
Function at 0x1802abbc0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
mov rsi, qword [rdx + 0x10]
lea rcx, [rsi + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
xor r8d, r8d
mov rcx, rdi
call fcn.18002fe10
mov r8, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1802abc22
mov r8, qword [rdi]
xor edx, edx
lea r9, [rsi - 2]
lea r10, [0x18046f750]
test r9, r9
je 0x1802abcfe
nop dword [rax + rax]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1802abc4d
mov rax, qword [rbx]
movzx eax, byte [rax + rdx]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [r8], al
cmp qword [rbx + 0x18], 0xf
jbe 0x1802abc6d
mov rax, qword [rbx]
lea rcx, [rdx + rax]
jmp 0x1802abc74
lea rcx, [rbx + rdx]
mov rax, rbx
movsx rcx, byte [rcx]
and ecx, 3
shl rcx, 4
movzx eax, byte [rax + rdx + 1]
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [r8 + 1], al
cmp qword [rbx + 0x18], 0xf
jbe 0x1802abca4
mov rax, qword [rbx]
lea rcx, [rax + 1]
jmp 0x1802abcab
lea rcx, [rbx + 1]
mov rax, rbx
add rcx, rdx
movsx rcx, byte [rcx]
and ecx, 0xf
shl rcx, 2
movzx eax, byte [rax + rdx + 2]
shr rax, 6
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [r8 + 2], al
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1802abcdb
mov rax, qword [rbx]
movsx rax, byte [rax + rdx + 2]
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [r8 + 3], al
add r8, 4
add rdx, 3
cmp rdx, r9
jb 0x1802abc40
cmp rdx, rsi
jae 0x1802abdb4
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1802abd14
mov rax, qword [rbx]
movzx eax, byte [rax + rdx]
shr rax, 2
movzx eax, byte [rax + r10]
mov byte [r8], al
lea rax, [rsi - 1]
cmp rdx, rax
jne 0x1802abd56
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1802abd3a
mov rax, qword [rbx]
movsx rax, byte [rax + rdx]
and eax, 3
add rax, rax
movzx eax, byte [r10 + rax*8]
mov byte [r8 + 1], al
mov al, 0x3d
add r8, 2
jmp 0x1802abdac
cmp qword [rbx + 0x18], 0xf
jbe 0x1802abd66
mov rax, qword [rbx]
lea rcx, [rdx + rax]
jmp 0x1802abd6d
lea rcx, [rbx + rdx]
mov rax, rbx
movsx rcx, byte [rcx]
and ecx, 3
shl rcx, 4
movzx eax, byte [rax + rdx + 1]
shr rax, 4
or rcx, rax
movzx eax, byte [rcx + r10]
mov byte [r8 + 1], al
add r8, 2
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1802abd9e
mov rax, qword [rbx]
movsx rax, byte [rax + rdx + 1]
and eax, 0xf
movzx eax, byte [r10 + rax*4]
mov byte [r8], al
mov byte [r8 + 1], 0x3d
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1802abdea
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1802abde5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1802abe1d
mov rcx, r8
call fcn.180313c20
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180313c00
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
call fcn.180329f88
int3
Function at 0x1802ade80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x13f0
call fcn.1803146e0
sub rsp, rax
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
movsxd rsi, r8d
mov rdi, rdx
mov qword [rsp + 0x28], rdx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea ecx, [rbx + 0x20]
call fcn.180313d50
mov rbp, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x1a
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [0x18046f7d8]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x18046f7e8]
movsd qword [rax + 0x10], xmm0
movzx eax, word [0x18046f7f0]
mov word [rbp + 0x18], ax
mov byte [rbp + 0x1a], bl
call fcn.1803137d8
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [rbx + 1]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x1802adf20
mov dword [rsp + 0x50], 0x270
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.18002fb20
test rsi, rsi
jle 0x1802adfce
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.18008cda0
mov ecx, eax
imul rax, rcx, 0x1a
cmp eax, 0x15
ja 0x1802adfab
lea rcx, [rsp + 0x28]
call fcn.18008cda0
mov ecx, eax
imul rax, rcx, 0x1a
cmp eax, 0x16
jb 0x1802adf96
shr rax, 0x20
movsxd rcx, eax
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1802adfbf
mov rax, qword [rdi]
movzx ecx, byte [rcx + rbp]
mov byte [rbx + rax], cl
inc rbx
cmp rbx, rsi
jl 0x1802adf81
mov edx, 0x20
mov rcx, rbp
call fcn.180313c20
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.180313c00
mov rbx, qword [rsp + 0x1410]
add rsp, 0x13f0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1802b4170
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x3f]
sub rsp, 0xe0
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, r8
mov rdi, rdx
mov qword [rbp - 0x59], rdx
mov rsi, qword [rbp + 0x7f]
xor r14d, r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x35], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x25], xmm1
mov dword [rbp - 0x15], r14d
mov qword [rbp - 0x41], 0x408
mov dword [rbp - 0x39], 1
lea r10, [rbp + 0x2c]
test r9d, r9d
jns 0x1802b4220
neg r9d
nop dword [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r9b, cl
add r9b, 0x30
mov byte [r10], r9b
mov r9d, edx
test edx, edx
jne 0x1802b41e0
dec r10
mov byte [r10], 0x2d
jmp 0x1802b424a
dec r10
mov eax, 0xcccccccd
mul r9d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r9b, cl
add r9b, 0x30
mov byte [r10], r9b
mov r9d, edx
test edx, edx
jne 0x1802b4220
lea r9, [rbp - 0x61]
lea r8, [rbp + 0x2c]
mov rdx, r10
lea rcx, [rbp - 9]
call fcn.18003e540
nop
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 0xf
cmova rdx, qword [rbp - 9]
cmp qword [rbx + 0x18], 0xf
jbe 0x1802b4277
mov rbx, qword [rbx]
lea r9, [rbp - 0x51]
lea r8, [rbp - 0x41]
mov rcx, rbx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1802b42e0
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x400
lea rbx, [0x1805143e0]
mov qword [rsp + 0x20], rbx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x12ff
call qword [sym.imp.kernel32.dll_FormatMessageA]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x1802b42c2
mov rdx, rbx
mov rcx, rsi
call fcn.180034f60
mov rbx, r14
mov qword [rbp - 0x51], rbx
jmp 0x1802b42e4
mov rbx, qword [rbp - 0x51]
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov rax, qword [sym.imp.ws2_32.dll_FreeAddrInfoW]
mov qword [rbp - 0x59], rax
mov qword [rbp + 0x17], rbx
lea rax, [rbp - 0x59]
mov qword [rbp + 0x1f], rax
mov byte [rbp + 0x27], 1
mov ecx, 0x20
call fcn.180313d50
mov rcx, rax
mov qword [rbp - 0x11], rax
test rax, rax
je 0x1802b4348
mov rax, qword [rbp - 0x59]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rcx + 8], 1
mov dword [rcx + 0xc], 1
lea rdx, [0x18046ff88]
mov qword [rcx], rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rbx
jmp 0x1802b434b
mov rcx, r14
mov qword [rdi], rbx
mov qword [rdi + 8], rcx
mov rdx, qword [rbp + 0xf]
cmp rdx, 0xf
jbe 0x1802b4389
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1802b4384
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1802b43b0
call fcn.180313c20
mov rax, rdi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180313c00
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180329f88
int3
Function at 0x1802bea00
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x70]
add rcx, 0x4ac
call fcn.1802ecd20
mov rcx, qword [rbx + 0x70]
add rcx, 0x504
call fcn.1802ee970
mov rcx, qword [rbx + 0x70]
xor edx, edx
add rcx, 0x560
call fcn.1802efd70
mov rcx, qword [rbx + 0x70]
mov edx, 1
add rcx, 0x5d0
add rsp, 0x20
pop rbx
jmp fcn.1802f0fa0
Function at 0x1802efd70
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
xor eax, eax
mov r8d, 0xc1059ed8
mov qword [rcx], rax
test edx, edx
mov eax, 0x6a09e667
cmovne eax, r8d
mov r8d, 0x367cd507
mov dword [rcx + 8], eax
mov eax, 0xbb67ae85
cmovne eax, r8d
mov r8d, 0x3070dd17
mov dword [rcx + 0xc], eax
mov eax, 0x3c6ef372
cmovne eax, r8d
mov r8d, 0xf70e5939
mov dword [rcx + 0x10], eax
mov eax, 0xa54ff53a
cmovne eax, r8d
mov r8d, 0xffc00b31
mov dword [rcx + 0x14], eax
mov eax, 0x510e527f
cmovne eax, r8d
mov r8d, 0x68581511
mov dword [rcx + 0x18], eax
mov eax, 0x9b05688c
cmovne eax, r8d
mov r8d, 0x64f98fa7
mov dword [rcx + 0x1c], eax
mov eax, 0x1f83d9ab
cmovne eax, r8d
mov r8d, 0xbefa4fa4
mov dword [rcx + 0x20], eax
mov eax, 0x5be0cd19
cmovne eax, r8d
mov dword [rcx + 0x24], eax
xor eax, eax
mov dword [rcx + 0x68], edx
ret
Function at 0x1802f0fa0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
xor eax, eax
movabs r8, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
test edx, edx
mov qword [rcx + 8], rax
movabs rax, 0x6a09e667f3bcc908
cmovne rax, r8
movabs r8, 0x629a292a367cd507
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
cmovne rax, r8
movabs r8, 0x9159015a3070dd17
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
cmovne rax, r8
movabs r8, 0x152fecd8f70e5939
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
cmovne rax, r8
movabs r8, 0x67332667ffc00b31
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
cmovne rax, r8
movabs r8, 0x8eb44a8768581511
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
cmovne rax, r8
movabs r8, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
cmovne rax, r8
movabs r8, 0x47b5481dbefa4fa4
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
cmovne rax, r8
mov qword [rcx + 0x48], rax
xor eax, eax
mov dword [rcx + 0xd0], edx
ret

Function at 0x1802f1c70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r15
mov rax, qword [rdx + 8]
mov r15, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 8], rax
je 0x1802f1c99
mov eax, 0xfffffffc
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov r11d, dword [rcx]
mov eax, dword [rdx]
sar eax, 1
mov qword [rsp + 0x18], rbx
and eax, 1
sar r11d, 1
and r11d, 1
mov qword [rsp + 0x28], r14
xor eax, r11d
mov ebx, eax
and ebx, r11d
mov dword [r8], ebx
mov r14, qword [rcx + 8]
test r14, r14
je 0x1802f1d90
mov qword [rsp + 0x20], rbp
mov ebp, 1
sub ebp, r11d
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov r10d, 1
sub r10d, eax
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
and ecx, r8d
shr r9, 0x3f
and r9d, edx
or r9d, ecx
and r10d, r9d
or eax, r9d
and r10d, r11d
or r10d, ebx
mov ebx, 1
mov dword [r15], r10d
sub ebx, eax
mov rcx, qword [rsi + 0x10]
and ebx, ebp
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
shr r9, 0x3f
and ecx, r8d
and r9d, edx
or r9d, ecx
and ebx, r9d
or eax, r9d
or ebx, r10d
mov dword [r15], ebx
sub r14, 1
jne 0x1802f1ce0
mov rbp, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
Function at 0x1802f2eb0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x18048e780]
mov r14, rdx
mov rcx, rbx
test rsi, rsi
je 0x1802f2f0e
cmp qword [0x18048e780], 0
je 0x1802f2f0e
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x1802f2f01
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.1803bbe20
test eax, eax
je 0x1802f2f29
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x1802f2ee8
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
test rbx, rbx
je 0x1802f2f0e
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
xor eax, eax
jmp 0x1802f2f13

Function at 0x1802f2fe0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x18048e550]
mov r14, r8
mov r15, rdx
mov rcx, rbx
test rsi, rsi
je 0x1802f3046
cmp qword [0x18048e550], 0
je 0x1802f3046
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x1802f3039
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call fcn.1803bbe20
test eax, eax
je 0x1802f3066
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x1802f3020
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
test rbx, rbx
je 0x1802f3046
mov eax, dword [rbx + 0x20]
mov dword [r15], eax
mov eax, dword [rbx + 0x24]
mov dword [r14], eax
xor eax, eax
jmp 0x1802f304b
Function at 0x1802f3e70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
test r8b, 0xf
je 0x1802f3ea6
mov eax, 0xffffffde
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
movaps xmmword [rsp + 0x20], xmm6
test r8, r8
je 0x1802f3ff6
mov rbx, qword [rsp + 0x78]
test r15d, r15d
jne 0x1802f3f5b
mov rbp, qword [rsp + 0x70]
mov rdi, rsi
sub rdi, rbx
nop dword [rax]
movups xmm6, xmmword [rbp]
mov r9, rbx
mov r8, rbp
xor edx, edx
mov rcx, r12
call fcn.1802f43d0
test eax, eax
jne 0x1802f3ff8
lea rax, [rsi + 0xf]
cmp rbx, rax
ja 0x1802f3f32
lea rax, [rbx + 0xf]
cmp rax, rsi
jb 0x1802f3f32
mov rax, rbx
mov edx, 0x10
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1802f3f20
jmp 0x1802f3f41
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rsi]
xorps xmm1, xmm0
movdqu xmmword [rbx], xmm1
add rbx, 0x10
add rbp, 0x10
sub rdi, 0x10
movups xmmword [rsi], xmm6
sub r14, 0x10
jne 0x1802f3ee0
jmp 0x1802f3ff6
mov rdi, qword [rsp + 0x70]
mov rbp, rsi
sub rbp, rdi
nop word [rax + rax]
lea rax, [rdi + 0xf]
lea rcx, [rbx + 0xf]
cmp rbx, rax
ja 0x1802f3f82
cmp rcx, rdi
jae 0x1802f3f90
lea rax, [rsi + 0xf]
cmp rbx, rax
ja 0x1802f3fb6
cmp rcx, rsi
jb 0x1802f3fb6
mov r8, rbx
mov rcx, rdi
sub r8, rdi
mov edx, 0x10
nop
movzx eax, byte [rcx + rbp]
xor al, byte [rcx]
mov byte [r8 + rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1802f3fa0
jmp 0x1802f3fc5
movdqu xmm1, xmmword [rsi]
movdqu xmm0, xmmword [rdi]
xorps xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov r9, rbx
mov r8, rbx
mov edx, r15d
mov rcx, r12
call fcn.1802f43d0
test eax, eax
jne 0x1802f3ff8
movups xmm0, xmmword [rbx]
add rbx, 0x10
add rdi, 0x10
sub rbp, 0x10
movups xmmword [rsi], xmm0
sub r14, 0x10
jne 0x1802f3f70
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x1802f43d0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rsi
mov rdi, rcx
mov rsi, qword [rcx + 8]
mov rbp, r9
sub rsi, rcx
mov r14, r8
sub rsi, 0x10
mov ecx, 0x2000000
sar rsi, 2
mov r15d, edx
call fcn.180305800
test eax, eax
je 0x1802f4421
mov rcx, rdi
shr rcx, 2
and ecx, 3
je 0x1802f4421
mov eax, 4
sub eax, ecx
jmp 0x1802f4423
xor eax, eax
cmp eax, esi
je 0x1802f445b
mov qword [rsp + 0x40], rbx
mov ebx, eax
mov eax, dword [rdi]
add rbx, 4
inc eax
shl eax, 4
movsxd r8, eax
mov eax, esi
lea rbx, [rdi + rbx*4]
add rax, 4
mov rcx, rbx
lea rdx, [rdi + rax*4]
call fcn.1803bbf20
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x40]
mov ecx, 0x2000000
call fcn.180305800
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
test eax, eax
je 0x1802f448d
mov r9, rbp
mov r8, r14
mov edx, r15d
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.180305490
mov r8, rbp
mov rdx, r14
cmp r15d, 1
jne 0x1802f44ac
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.1802f6330
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.1802f5b40
Function at 0x1802fffb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
xor r15d, r15d
mov r12, r9
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
test rdx, rdx
je 0x18030000e
mov r10, rbx
mov rcx, r9
sub r10, r9
mov rdx, qword [rdi + 0x80]
cmp rdx, 0x40
jae 0x18030000e
movzx eax, byte [r10 + rcx]
inc r15
xor al, byte [rdx + rdi + 0x40]
mov byte [rcx], al
inc rcx
inc qword [rdi + 0x80]
sub rbp, 1
jne 0x1802fffe3
lea rsi, [rdi + 0x40]
cmp rbp, 0x40
jb 0x180300119
mov qword [rsp + 0x60], r13
mov r12, rbp
mov qword [rsp + 0x20], r14
mov r13, rbx
shr r12, 6
lea rbx, [r9 + 1]
imul rax, r12, 0xffffffffffffffc0
mov r14, rdi
sub r13, r9
sub r14, r15
add rbp, rax
sub r14, r9
mov rax, r12
shl rax, 6
add rbx, r15
add r14, 0x40
add r15, rax
nop dword [rax + rax]
mov rdx, rsi
mov rcx, rdi
call fcn.1802ff7e0
inc dword [rdi + 0x30]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rbx - 1]
xor al, byte [rbx + r13 - 1]
mov byte [rbx - 1], al
movzx eax, byte [r14 + rbx]
xor al, byte [rbx + r13]
mov byte [rbx], al
movzx eax, byte [r14 + rbx + 1]
xor al, byte [rbx + r13 + 1]
mov byte [rbx + 1], al
movzx eax, byte [r14 + rbx + 2]
xor al, byte [rbx + r13 + 2]
mov byte [rbx + 2], al
movzx eax, byte [r14 + rbx + 3]
xor al, byte [rbx + r13 + 3]
mov byte [rbx + 3], al
movzx eax, byte [r14 + rbx + 4]
xor al, byte [rbx + r13 + 4]
mov byte [rbx + 4], al
movzx eax, byte [r14 + rbx + 5]
xor al, byte [rbx + r13 + 5]
mov byte [rbx + 5], al
movzx eax, byte [r14 + rbx + 6]
xor al, byte [rbx + r13 + 6]
mov byte [rbx + 6], al
add rbx, 8
sub rcx, 1
jne 0x180300080
sub r14, 0x40
sub r12, 1
jne 0x180300060
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test rbp, rbp
je 0x18030015d
mov rdx, rsi
mov rcx, rdi
call fcn.1802ff7e0
inc dword [rdi + 0x30]
mov rcx, rbp
sub r15, rdi
lea rdx, [r15 + rbx]
lea r8, [r15 + r12]
nop word [rax + rax]
movzx eax, byte [rsi + rdx - 0x40]
xor al, byte [rsi]
mov byte [r8 + rsi - 0x40], al
lea rsi, [rsi + 1]
sub rcx, 1
jne 0x180300140
mov qword [rdi + 0x80], rbp
xor eax, eax
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret