joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18030c910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.1803e3dd0
sub rsp, rax
mov rax, qword [0x18053d0c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rsp + 0xa0]
mov esi, r8d
mov r12, qword [rsp + 0xa8]
mov r13, r9
mov rdi, rcx
mov r15, rdx
xor ebp, ebp
movzx r10d, byte [r14]
movzx r8d, byte [r14 + 1]
movzx eax, byte [r14 + 2]
movzx ecx, byte [r14 + 6]
movzx edx, byte [r14 + 4]
movzx r9d, byte [r14 + 5]
mov ebx, dword [r12]
shl eax, 8
shl r8d, 0x10
shl r10d, 0x18
or r8d, r10d
shl edx, 0x18
or r8d, eax
shl r9d, 0x10
movzx eax, byte [r14 + 3]
or r9d, edx
or r8d, eax
shl ecx, 8
movzx eax, byte [r14 + 7]
or ecx, eax
mov dword [rsp + 0x20], r8d
or r9d, ecx
mov byte [rsp + 0x2b], r8b
mov eax, r8d
mov dword [rsp + 0x24], r9d
shr eax, 0x10
mov byte [rsp + 0x29], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x2a], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x2d], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x2e], al
mov byte [rsp + 0x2f], r9b
bswap r10d
mov byte [rsp + 0x28], r10b
bswap edx
mov byte [rsp + 0x2c], dl
test esi, esi
je 0x18030cad3
sub r15, rdi
movzx r10d, r9b
movzx edx, r8b
dec esi
test ebx, ebx
jne 0x18030ca72
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.18030c220
mov r8d, dword [rsp + 0x20]
mov eax, r8d
mov r9d, dword [rsp + 0x24]
mov edx, r8d
shr eax, 0x18
mov r10d, r9d
mov byte [rsp + 0x28], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x29], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x2a], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x2c], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x2d], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x2e], al
inc ebp
mov byte [rsp + 0x2b], dl
mov byte [rsp + 0x2f], r10b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x28]
xor cl, byte [rdi]
mov byte [r15 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x18030ca08
test ebp, ebp
je 0x18030cad3
mov eax, r8d
mov byte [r14 + 3], dl
shr eax, 0x18
mov byte [r14], al
mov eax, r8d
shr eax, 0x10
mov byte [r14 + 1], al
mov eax, r9d
shr eax, 0x18
mov byte [r14 + 4], al
mov eax, r9d
shr eax, 0x10
shr r8d, 8
shr r9d, 8
mov byte [r14 + 6], r9b
mov byte [r14 + 2], r8b
mov byte [r14 + 5], al
mov byte [r14 + 7], r10b
mov dword [r12], ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1803e3250
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180310e10
Capabilities:
Encode data using xor

Disassembly:
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.1803e3dd0
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x180310e39
lea rax, [0x18030f470]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.180268030
lea rax, [0x18030e620]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.180267d70
Function at 0x1803138f0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.1803e3dd0
sub rsp, rax
mov rbx, rcx
call fcn.180265170
test eax, eax
jne 0x180313911
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 0x5c]
add rsp, 0x20
pop rbx
jmp fcn.1802b47b0

Function at 0x180316070
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1803e3dd0
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
add rcx, 0x40
xor edx, edx
mov r8d, 0xb0
call fcn.1803e5f50
movabs rsi, 0x1f83d9abfb41bd6b
movabs rbp, 0x5be0cd19137e2179
mov qword [rdi + 0x30], rsi
movabs rcx, 0x6a09e667f3bcc908
mov qword [rdi + 0x38], rbp
movabs rdx, 0xbb67ae8584caa73b
mov qword [rdi], rcx
movabs r8, 0x3c6ef372fe94f82b
mov qword [rdi + 8], rdx
movabs r9, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x10], r8
movabs r10, 0x510e527fade682d1
mov qword [rdi + 0x18], r9
movabs r11, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x20], r10
mov qword [rdi + 0x28], r11
movzx eax, byte [rbx]
mov qword [rdi + 0xe8], rax
mov rax, qword [rbx]
xor rax, rcx
mov qword [rdi], rax
mov rax, qword [rbx + 8]
xor rax, rdx
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor rax, r8
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor rax, r9
mov qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor rax, r10
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor rax, r11
mov qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor rax, rsi
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
mov rbx, qword [rsp + 0x30]
xor rax, rbp
mov rbp, qword [rsp + 0x38]
mov qword [rdi + 0x38], rax
add rsp, 0x20
pop rdi
ret
Function at 0x180317fe0
Capabilities:
Hash data using sha256

Disassembly:
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x70], xmm0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
movzx eax, byte [rdx]
mov qword [rcx + 0x78], rax
mov eax, dword [rdx]
xor eax, 0x6a09e667
mov dword [rcx], eax
mov eax, dword [rdx + 4]
xor eax, 0xbb67ae85
mov dword [rcx + 4], eax
mov eax, dword [rdx + 8]
xor eax, 0x3c6ef372
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
xor eax, 0xa54ff53a
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
xor eax, 0x510e527f
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
xor eax, 0x9b05688c
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
xor eax, 0x1f83d9ab
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x1c]
xor eax, 0x5be0cd19
mov dword [rcx + 0x1c], eax
ret
Function at 0x18033dce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.1803e3dd0
sub rsp, rax
mov rdi, qword [rsp + 0x88]
mov rsi, rdx
mov qword [rsp + 0x68], rbp
mov r14, r9
mov rbp, qword [rsp + 0x80]
mov rbx, rcx
mov qword [rsp + 0x30], r12
mov r10, rcx
shl rsi, 5
mov r12, rdx
mov qword [rsp + 0x28], r13
mov r13, r8
test rsi, rsi
je 0x18033dd78
mov r8, rsi
nop dword [rax]
movzx eax, byte [r10]
lea r10, [r10 + 4]
mov dword [rdi], eax
movzx ecx, byte [r10 - 3]
shl ecx, 8
or ecx, eax
mov dword [rdi], ecx
movzx edx, byte [r10 - 2]
shl edx, 0x10
or edx, ecx
mov dword [rdi], edx
movzx eax, byte [r10 - 1]
shl eax, 0x18
or eax, edx
mov dword [rdi], eax
add rdi, 4
sub r8, 1
jne 0x18033dd40
mov qword [rsp + 0x20], r15
mov r15, r12
shl r15, 7
cmp r13, 1
jbe 0x18033ddaf
dec r13
nop dword [rax]
mov rdx, rdi
mov r8, r12
sub rdx, r15
mov rcx, rdi
call fcn.18033d840
add rdi, r15
sub r13, 1
jne 0x18033dd90
mov r13, qword [rsp + 0x70]
mov rdx, r13
mov r8, r12
shl rdx, 7
mov rcx, r14
add rdx, 0xffffffffffffff80
imul rdx, r12
add rdx, qword [rsp + 0x88]
call fcn.18033d840
xor edi, edi
test r13, r13
je 0x18033def6
lea rbx, [r15 + r14]
mov r15, r13
mov eax, dword [rbx - 0x40]
xor edx, edx
div r13
mov r8, rdi
mov eax, edx
imul rax, r12
shl rax, 7
add rax, qword [rsp + 0x88]
test rsi, rsi
je 0x18033ded9
cmp rsi, 0x10
jb 0x18033deb2
lea rcx, [rsi - 1]
lea rcx, [rax + rcx*4]
lea rdx, [rbp - 4]
lea rdx, [rdx + rsi*4]
cmp rbp, rcx
ja 0x18033de31
cmp rdx, rax
jae 0x18033deb2
lea rcx, [r14 - 4]
lea rcx, [rcx + rsi*4]
cmp rbp, rcx
ja 0x18033de43
cmp rdx, r14
jae 0x18033deb2
mov rcx, r14
lea rdx, [rbp + 0x10]
sub rcx, rbp
nop dword [rax]
movdqu xmm0, xmmword [rax]
add r8, 0x10
lea rax, [rax + 0x40]
movdqu xmm1, xmmword [rcx + rdx - 0x10]
lea rdx, [rdx + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmmword [rdx - 0x50], xmm1
movdqu xmm1, xmmword [rdx + rcx - 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmmword [rdx - 0x40], xmm1
movdqu xmm1, xmmword [rcx + rdx - 0x30]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmmword [rdx - 0x30], xmm1
movdqu xmm1, xmmword [rcx + rdx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rdx - 0x20], xmm1
cmp r8, rsi
jb 0x18033de50
jmp 0x18033ded9
mov r9, r14
mov rdx, rbp
sub r9, rbp
nop dword [rax + rax]
mov ecx, dword [r9 + rdx]
lea rdx, [rdx + 4]
xor ecx, dword [rax]
lea rax, [rax + 4]
inc r8
mov dword [rdx - 4], ecx
cmp r8, rsi
jb 0x18033dec0
mov r8, r12
mov rdx, rbp
mov rcx, r14
call fcn.18033d840
sub r15, 1
jne 0x18033dde3
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
test rsi, rsi
je 0x18033df38
nop
mov ecx, dword [r14 + rdi*4]
mov eax, ecx
mov byte [rbx], cl
lea rbx, [rbx + 4]
shr eax, 8
inc rdi
mov byte [rbx - 3], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rbx - 2], al
mov byte [rbx - 1], cl
cmp rdi, rsi
jb 0x18033df10
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x18033ee20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r15
mov eax, 0x50
call fcn.1803e3dd0
sub rsp, rax
mov r12, rdx
test rdx, rdx
mov rdx, r8
mov r15, r9
mov rbp, r8
je 0x18033f05a
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0xa8]
mov qword [rsp + 0x78], rsi
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x48], r13
mov r13, qword [rsp + 0x98]
mov qword [rsp + 0x40], r14
lea r14, [r9 + 1]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rbx
shr r14, 1
mov r8, r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
call fcn.18033ec10
test eax, eax
je 0x18033f053
mov r8d, 0x1bb
mov qword [rsp + 0x80], rdi
lea rdx, str.providersimplementationskdfs_tls1_prf.c
mov rcx, rbx
call fcn.18020e610
mov rdi, rax
test rax, rax
jne 0x18033ef1c
call fcn.18020d3a0
lea r8, str.tls1_prf_alg
mov edx, 0x1bc
lea rcx, str.providersimplementationskdfs_tls1_prf.c
call fcn.18020d4c0
xor r8d, r8d
lea ecx, [rdi + 0x39]
mov edx, 0xc0100
call fcn.18020d5c0
xor eax, eax
mov rdi, qword [rsp + 0x80]
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r12
pop rbp
ret
mov r9, qword [rsp + 0x90]
sub rbp, r14
mov qword [rsp + 0x30], rbx
mov r8, r14
mov qword [rsp + 0x28], rdi
mov rcx, r12
mov qword [rsp + 0x20], r13
lea rdx, [r15 + rbp]
call fcn.18033ec10
test eax, eax
jne 0x18033ef63
mov r9d, 0x1c2
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rdi
call fcn.18020e750
jmp 0x18033eef4
xor ecx, ecx
test rbx, rbx
je 0x18033f031
cmp rbx, 0x40
jb 0x18033f002
lea rdx, [rsi - 1]
lea rax, [rbx - 1]
add rdx, rbx
add rax, rdi
cmp rsi, rax
ja 0x18033ef90
cmp rdx, rdi
jae 0x18033f002
mov r8, rbx
and r8, 0xffffffffffffffc0
mov rdx, rdi
lea rax, [rsi + 0x10]
sub rdx, rsi
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, r8
jb 0x18033efa1
cmp rcx, rbx
jae 0x18033f031
mov r8, rdi
lea rax, [rcx + rsi]
sub r8, rsi
mov rdx, rbx
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax + r8]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18033f020
mov r9d, 0x1c7
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rdi
call fcn.18020e750
mov eax, 1
jmp 0x18033eef6
xor eax, eax
jmp 0x18033eefe
mov rax, qword [rsp + 0xa8]
mov r8, r15
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call fcn.18033ec10
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x50
pop r15
pop r12
pop rbp
ret
Function at 0x180347b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, gethostbyaddr
call fcn.1803e3dd0
sub rsp, rax
movsxd rbx, r9d
xor edi, edi
mov qword [rsp + 0x40], rbp
mov r10, rdx
mov dword [rsp + 0x58], reloc.WS2_32.dll_recv
mov rbp, rcx
mov r9d, edi
test ebx, ebx
jle 0x180347c15
cmp ebx, 0x40
jb 0x180347c15
lea rax, [rbx - 1]
lea rcx, [rax + rdx]
add rax, r8
cmp rdx, rax
ja 0x180347b88
cmp rcx, r8
jae 0x180347c15
mov qword [rsp + 0x48], rsi
lea rcx, [rdx + 0x10]
mov r11, rbx
mov rdx, r8
and r11, 0xffffffffffffffc0
sub rdx, r10
mov rsi, 0xfffffffffffffff0
sub rsi, r10
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx - 0x10]
add r9d, 0x40
movdqu xmm1, xmmword [rdx + rcx - 0x10]
movdqu xmm2, xmmword [rdx + rcx]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
lea rax, [rsi + rcx]
movdqu xmmword [rcx - 0x50], xmm1
movdqu xmm0, xmmword [rcx - 0x40]
movdqu xmm1, xmmword [rdx + rcx - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm2
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [rdx + rcx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp rax, r11
jl 0x180347bb0
mov rsi, qword [rsp + 0x48]
movsxd rcx, r9d
mov rdx, rbx
cmp rcx, rbx
jge 0x180347c41
sub r8, r10
lea rax, [rcx + r10]
sub rdx, rcx
nop word [rax + rax]
movzx ecx, byte [rax + r8]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180347c30
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x58]
mov r9, r10
mov dword [rsp + 0x20], ebx
mov rdx, r10
call fcn.180207750
mov rbp, qword [rsp + 0x40]
test eax, eax
je 0x180347c77
cmp dword [rsp + 0x58], ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x180347e20
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x180347ea8
test r8, r8
je 0x180347ea8
mov r9, qword [rcx + 0x28]
cmp r8, r9
cmovb r9, r8
test r9, r9
je 0x180347e62
add rcx, 0x34
mov r11, rdx
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + rcx - 0x34]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x180347e50
mov rax, qword [r10 + 0x28]
cmp r8, rax
jbe 0x180347ea8
sub r8, rax
cmp r8, 0x10
jbe 0x180347e7c
mov r8d, reloc.WS2_32.dll_recv
jmp 0x180347e81
test r8, r8
je 0x180347ea8
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x28]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x54], al
inc rcx
cmp rcx, r8
jb 0x180347e90
ret
Function at 0x18037a120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov r11, qword [rcx]
mov rsi, rdx
mov r10, qword [rcx + 8]
mov rbx, rcx
mov r9, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov rax, qword [rcx + 0x20]
shl r11, 0x38
cmp dword [rcx + 0x30], 0
je 0x18037a35f
test r8, r8
je 0x18037a35f
mov r14d, dword [rcx + 0x2c]
cmp r8, r14
jne 0x18037a35f
mov ecx, dword [rcx + 0x28]
dec ecx
cmp ecx, 6
ja case.default.0x18037a18d
lea r8, [0x180000000]
mov edx, dword [r8 + rcx*4 + 0x37a378]
add rdx, r8
jmp rdx
movzx ecx, byte [rbx + 0x3e]
shl rcx, 0x30
or r11, rcx
movzx ecx, byte [rbx + 0x3d]
shl rcx, 0x28
or r11, rcx
movzx ecx, byte [rbx + 0x3c]
shl rcx, 0x20
or r11, rcx
movzx ecx, byte [rbx + 0x3b]
shl rcx, 0x18
or r11, rcx
movzx ecx, byte [rbx + 0x3a]
shl rcx, 0x10
or r11, rcx
movzx ecx, byte [rbx + 0x39]
shl rcx, 8
or r11, rcx
movzx ecx, byte [rbx + 0x38]
or r11, rcx
xor rax, r11
cmp dword [rbx + 0x30], 0
jbe 0x18037a226
mov ecx, dword [rbx + 0x30]
nop dword [rax]
nop dword [rax + rax]
add r10, r9
add rdi, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, rdi
rol r10, 0x20
add rdi, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, rdi
xor rax, r10
rol rdi, 0x20
sub rcx, 1
jne 0x18037a1f0
xor r10, r11
mov ecx, 0xff
cmp r14d, 0x10
mov r8d, 0xee
cmovne r8d, ecx
mov ecx, dword [rbx + 0x34]
xor r8, rdi
test ecx, ecx
je 0x18037a286
nop word [rax + rax]
add r10, r9
add r8, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r8
rol r10, 0x20
add r8, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r8
xor rax, r10
rol r8, 0x20
sub rcx, 1
jne 0x18037a250
mov rdx, rax
xor rdx, r8
xor rdx, r9
xor rdx, r10
mov ecx, edx
mov byte [rsi], dl
shr ecx, 8
mov byte [rsi + 1], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rsi + 2], cl
mov ecx, edx
shr ecx, 0x18
shr rdx, 0x20
mov byte [rsi + 3], cl
mov ecx, edx
shr ecx, 8
mov byte [rsi + 5], cl
mov ecx, edx
mov byte [rsi + 4], dl
shr ecx, 0x10
shr edx, 0x18
mov byte [rsi + 6], cl
mov byte [rsi + 7], dl
cmp dword [rbx + 0x2c], 8
je 0x18037a358
mov ecx, dword [rbx + 0x34]
xor r9, 0xdd
test ecx, ecx
je 0x18037a317
add r10, r9
add r8, rax
rol r9, 0xd
xor r9, r10
rol rax, 0x10
xor rax, r8
rol r10, 0x20
add r8, r9
add r10, rax
rol r9, 0x11
rol rax, 0x15
xor r9, r8
xor rax, r10
rol r8, 0x20
sub rcx, 1
jne 0x18037a2e1
xor rax, r8
xor rax, r9
xor rax, r10
mov ecx, eax
mov byte [rsi + 8], al
shr ecx, 8
mov byte [rsi + 9], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 0xa], cl
mov ecx, eax
shr ecx, 0x18
shr rax, 0x20
mov byte [rsi + 0xb], cl
mov ecx, eax
shr ecx, 8
mov byte [rsi + 0xd], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 0xc], al
shr eax, 0x18
mov byte [rsi + 0xf], al
mov byte [rsi + 0xe], cl
mov eax, 1
jmp 0x18037a361
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
Function at 0x18037a4f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.1803e3dd0
sub rsp, rax
add qword [rcx], r8
mov r14, rcx
mov rsi, qword [rcx + 8]
mov r15, r8
mov rdi, qword [rcx + 0x10]
mov r13, rdx
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov ecx, dword [rcx + 0x28]
test ecx, ecx
je 0x18037a61b
mov r12d, 8
sub r12d, ecx
add rcx, 0x38
add rcx, r14
cmp r8, r12
jae 0x18037a55f
call fcn.1803e57a0
add dword [r14 + 0x28], r15d
jmp 0x18037a711
mov r8, r12
call fcn.1803e57a0
movzx eax, byte [r14 + 0x3e]
lea r11, [r14 + 0x38]
movzx ecx, byte [r14 + 0x3f]
sub r15, r12
shl rcx, 8
add r13, r12
or rcx, rax
movzx eax, byte [r14 + 0x3d]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 0x3c]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 0x3b]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 0x3a]
shl rcx, 8
or rcx, rax
movzx eax, byte [r14 + 0x39]
shl rcx, 8
or rcx, rax
movzx eax, byte [r11]
shl rcx, 8
or rcx, rax
mov eax, dword [r14 + 0x30]
xor rbx, rcx
test eax, eax
je 0x18037a616
nop dword [rax]
nop dword [rax + rax]
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rdi, 0x11
rol rbx, 0x15
xor rdi, rbp
xor rbx, rsi
rol rbp, 0x20
sub rax, 1
jne 0x18037a5e0
xor rsi, rcx
jmp 0x18037a61f
lea r11, [r14 + 0x38]
mov r12d, r15d
mov rdx, r13
and r12d, 7
sub rdx, r12
add rdx, r15
cmp r13, rdx
je 0x18037a6ed
mov r10d, dword [r14 + 0x30]
lea r9, [r13 + 6]
movzx eax, byte [r9]
movzx r8d, byte [r9 + 1]
shl r8, 8
or r8, rax
movzx eax, byte [r9 - 1]
shl r8, 8
or r8, rax
movzx eax, byte [r9 - 2]
shl r8, 8
or r8, rax
movzx eax, byte [r9 - 3]
shl r8, 8
or r8, rax
movzx eax, byte [r9 - 4]
shl r8, 8
or r8, rax
movzx eax, byte [r9 - 5]
shl r8, 8
or r8, rax
movzx eax, byte [r9 - 6]
shl r8, 8
or r8, rax
xor rbx, r8
test r10d, r10d
je 0x18037a6d9
mov rax, r10
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rdi, 0x11
rol rbx, 0x15
xor rdi, rbp
xor rbx, rsi
rol rbp, 0x20
sub rax, 1
jne 0x18037a6a3
add r9, 8
xor rsi, r8
lea rax, [r9 - 6]
cmp rax, rdx
jne 0x18037a640
test r12d, r12d
je 0x18037a6fd
mov r8, r12
mov rcx, r11
call fcn.1803e57a0
mov dword [r14 + 0x28], r12d
mov qword [r14 + 8], rsi
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], rbp
mov qword [r14 + 0x20], rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1803833d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x68
call fcn.1803e3dd0
sub rsp, rax
mov rax, qword [0x18053d0c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x3c]
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test eax, eax
je 0x180383504
movups xmm0, xmmword [rcx + 0x10]
mov r15, qword [rcx + 0x20]
lea rbx, [rcx + 0x10]
dec eax
mov dword [rsp + 0x28], 1
mov dword [rcx + 0x3c], eax
xor r9d, r9d
mov eax, dword [rbx + 8]
xor r8d, r8d
and al, 0x7f
mov dword [rsp + 0x30], edi
movups xmmword [rsp + 0x48], xmm0
and byte [rsp + 0x54], 0x7f
xor edx, edx
mov byte [rsp + 0x50], al
mov rcx, r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.180207710
test eax, eax
je 0x180383504
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov r9, r14
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, r15
call fcn.1802083e0
test eax, eax
je 0x180383504
mov r9, rdi
lea rdx, [rsp + 0x38]
mov r8, rbp
mov rcx, rsi
call fcn.180383a20
test eax, eax
je 0x180383504
lea rax, [rbx + 0xf]
xor r8d, r8d
lea rcx, [rsp + 0x38]
cmp rcx, rax
ja 0x1803834d9
lea rax, [rsp + 0x47]
cmp rax, rbx
jb 0x1803834d9
lea rcx, [rsp + 0x38]
mov eax, r8d
sub rbx, rcx
nop
lea rdx, [rsp + 0x38]
add rdx, rax
inc rax
movzx ecx, byte [rbx + rdx]
xor byte [rdx], cl
cmp rax, 0x10
jl 0x1803834c0
jmp 0x1803834ed
movdqu xmm1, xmmword [rsp + 0x38]
movdqu xmm0, xmmword [rbx]
pxor xmm1, xmm0
movdqu xmmword [rsp + 0x38], xmm1
mov rax, qword [rsp + 0x38]
or rax, qword [rsp + 0x40]
je 0x180383520
mov rdx, rdi
mov rcx, rbp
call fcn.180001240
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1803e3250
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsi + 0x38], r8d
mov eax, edi
jmp 0x180383506
Function at 0x18039c410
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.180406c3c
cdqe
add rsp, 0x28
ret