joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800be6f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
shr r8d, 3
mov r10, rdx
mov r9, rcx
test r8d, r8d
je 0x1800be771
mov qword [rsp], rbx
sub r10, rcx
mov r11d, r8d
movabs rbx, 0xffff0000ffff
movabs r8, 0xff00ff00ff00ff
mov rcx, qword [r10 + r9]
lea r9, [r9 + 8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r8
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, rbx
xor rcx, rdx
rol rcx, 0x20
mov qword [r9 - 8], rcx
sub r11, 1
jne 0x1800be721
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x1800be780
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x1800be78b
mov eax, 0xffffff53
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret

Function at 0x1800be820
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x1800be82b
mov eax, 0xffffff53
ret
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret

Function at 0x1800c0a50
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x1800c0a5b
mov eax, 0xffffff53
ret
xor r8d, r8d
movabs rdx, 0x152fecd8f70e5939
mov qword [rcx + 0xd8], r8
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx + 0x18], rdx
movabs rdx, 0x67332667ffc00b31
mov qword [rcx + 0x20], rdx
movabs rdx, 0x8eb44a8768581511
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x28], rdx
movabs rdx, 0xdb0c2e0d64f98fa7
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x30], rdx
movabs rdx, 0x47b5481dbefa4fa4
mov qword [rcx + 0x10], rax
mov eax, r8d
mov qword [rcx + 0x38], rdx
mov dword [rcx + 0xc0], r8d
mov qword [rcx + 0xc8], r8
mov qword [rcx + 0xd0], r8
ret
Function at 0x1800c0af0
Capabilities:
Hash data using sha384

Disassembly:
test rcx, rcx
jne 0x1800c0afb
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret

Function at 0x1800c0b90
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x1800c0b9b
mov eax, 0xffffff53
ret
xor r8d, r8d
movabs rdx, 0xa54ff53a5f1d36f1
mov qword [rcx + 0xd8], r8
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 0x18], rdx
movabs rdx, 0x510e527fade682d1
mov qword [rcx + 0x20], rdx
movabs rdx, 0x9b05688c2b3e6c1f
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x28], rdx
movabs rdx, 0x1f83d9abfb41bd6b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x30], rdx
movabs rdx, 0x5be0cd19137e2179
mov qword [rcx + 0x10], rax
mov eax, r8d
mov qword [rcx + 0x38], rdx
mov dword [rcx + 0xc0], r8d
mov qword [rcx + 0xc8], r8
mov qword [rcx + 0xd0], r8
ret

Function at 0x1800c0c30
Capabilities:
Hash data using sha512

Disassembly:
test rcx, rcx
jne 0x1800c0c3b
mov eax, 0xffffff53
ret
mov qword [rcx + 0xd8], rdx
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov dword [rcx + 0xc0], eax
mov qword [rcx + 0xc8], rax
mov qword [rcx + 0xd0], rax
ret

Function at 0x1800c0cd0
Capabilities:
Hash data using sha384

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1800c0d1b
test rdx, rdx
je 0x1800c0d1b
call fcn.1800be8c0
test eax, eax
jne 0x1800c0d20
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800be780
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800c1070
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1800c10c3
test rdx, rdx
je 0x1800c10c3
call fcn.1800be8c0
test eax, eax
jne 0x1800c10c8
movups xmm0, xmmword [rbx]
mov rcx, rbx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x30], xmm1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800be820
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800c2bb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, r8d
mov r9, rdx
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x1800c2ca3
shr r8d, 3
xor eax, eax
test r8d, r8d
je 0x1800c2db1
cmp r8d, 8
jb 0x1800c2c80
lea ecx, [r8 - 1]
lea r11, [r10 + rcx*8]
lea rcx, [rdx + rcx*8]
cmp r10, rcx
ja 0x1800c2bfa
cmp r11, rdx
jae 0x1800c2c80
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
nop word [rax + rax]
movdqu xmm0, xmmword [r10 + rax*8]
lea ecx, [rbx - 2]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rax*8], xmm1
add eax, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
mov ecx, ebx
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
lea ecx, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [r10 + rcx*8]
movdqu xmm1, xmmword [rdx + rcx*8]
pxor xmm1, xmm0
movdqu xmmword [r10 + rcx*8], xmm1
cmp eax, r11d
jb 0x1800c2c10
cmp eax, r8d
jae 0x1800c2db1
sub r9, r10
lea rdx, [r10 + rax*8]
sub r8d, eax
mov ecx, r8d
nop dword [rax]
mov rax, qword [r9 + rdx]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x1800c2c90
pop rbx
ret
xor eax, eax
test r8d, r8d
je 0x1800c2db1
cmp r8d, 8
jb 0x1800c2d92
lea ecx, [r8 - 1]
lea r11, [rcx + r10]
add rcx, rdx
cmp r10, rcx
ja 0x1800c2cd1
cmp r11, r9
jae 0x1800c2d92
cmp r8d, 0x40
jb 0x1800c2d65
mov qword [rsp + 0x10], rdi
mov ebx, r8d
and ebx, 0x3f
mov edi, r8d
sub edi, ebx
mov r11d, 0x20
movdqu xmm0, xmmword [rax + r10]
lea ecx, [r11 - 0x10]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + r10], xmm1
add eax, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
mov ecx, r11d
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
lea ecx, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rcx + r10]
movdqu xmm1, xmmword [rcx + rdx]
pxor xmm1, xmm0
movdqu xmmword [rcx + r10], xmm1
cmp eax, edi
jb 0x1800c2cf1
mov rdi, qword [rsp + 0x10]
cmp ebx, 8
jb 0x1800c2d8d
mov edx, r8d
and edx, 0xfffffff8
nop dword [rax + rax]
movq xmm0, qword [rax + r10]
movq xmm1, qword [rax + r9]
pxor xmm1, xmm0
movq qword [rax + r10], xmm1
add eax, 8
cmp eax, edx
jb 0x1800c2d70
cmp eax, r8d
jae 0x1800c2db1
mov edx, eax
sub r9, r10
add rdx, r10
sub r8d, eax
mov ecx, r8d
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x1800c2da0
pop rbx
ret
Function at 0x1800c7300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, r9d
mov rdi, r8
shr esi, 4
mov rbp, rdx
mov r14, rcx
test rcx, rcx
je 0x1800c73e1
test rdx, rdx
je 0x1800c73e1
test r8, r8
je 0x1800c73e1
test esi, esi
je 0x1800c73dd
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0xf8]
movzx eax, bl
dec esi
or al, dil
test al, 7
jne 0x1800c736f
mov rax, qword [rdi]
xor qword [rbx], rax
mov rax, qword [rdi + 8]
xor qword [rbx + 8], rax
jmp 0x1800c73b3
lea rax, [rdi + 0xf]
lea rcx, [rbx + 0xf]
cmp rbx, rax
ja 0x1800c73a3
cmp rcx, rdi
jb 0x1800c73a3
mov r8, rdi
mov rax, rbx
sub r8, rbx
mov edx, 0x10
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1800c7390
jmp 0x1800c73b3
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
mov r8, rbx
mov rdx, rbx
mov rcx, r14
call fcn.1800c79e0
movups xmm0, xmmword [rbx]
add rdi, 0x10
movups xmmword [rbp], xmm0
add rbp, 0x10
test esi, esi
jne 0x1800c7353
mov rbx, qword [rsp + 0x30]
xor eax, eax
jmp 0x1800c73e6
mov eax, 0xffffff53
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800c8380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test rcx, rcx
je 0x1800c83b1
lea eax, [r8 - 0x10]
test eax, 0xffffffe7
jne 0x1800c83b1
cmp r8d, 0x28
je 0x1800c83b1
mov eax, r8d
mov dword [rcx + 0xf4], r8d
shr eax, 2
add eax, 6
mov dword [rcx + 0xf0], eax
jmp fcn.1800c83c0
mov eax, 0xffffff53
ret
Function at 0x1800caf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
mov r11, r8
mov rbx, rdx
mov r10, rcx
test rcx, rcx
je 0x1800caf98
test rdx, rdx
je 0x1800caf98
test r8, r8
je 0x1800caf98
mov qword [rsp + 0x10], rsi
movzx esi, byte [rcx + 1]
mov qword [rsp + 0x18], rdi
movzx edi, byte [rcx]
test r9d, r9d
je 0x1800caf83
sub rbx, r8
nop dword [rax + rax]
movzx r8d, byte [rdi + r10 + 2]
lea r11, [r11 + 1]
lea eax, [r8 + rsi]
movzx esi, al
lea eax, [rdi + 1]
movzx ecx, byte [rsi + r10 + 2]
mov byte [rdi + r10 + 2], cl
movzx edi, al
mov byte [rsi + r10 + 2], r8b
lea eax, [r8 + rcx]
movzx ecx, al
movzx eax, byte [rcx + r10 + 2]
xor al, byte [r11 - 1]
mov byte [rbx + r11 - 1], al
add r9d, 0xffffffff
jne 0x1800caf40
mov byte [r10], dil
xor eax, eax
mov rdi, qword [rsp + 0x18]
mov byte [r10 + 1], sil
mov rsi, qword [rsp + 0x10]
pop rbx
ret
mov eax, 0xffffff53
pop rbx
ret
Function at 0x1800d0b70
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1801459c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
mov r15, r8
mov word [rsp + 0x20], bx
movzx ebp, dl
mov qword [rsp + 0x28], rbx
mov r14, rcx
movzx esi, bx
test rcx, rcx
je 0x1800d0d41
call fcn.180095870
test eax, eax
jne 0x1800d0bc3
cmp byte [r14 + 0x548], 0xfe
jne 0x1800d0d41
cmp bpl, 1
jne 0x1800d0cd4
mov r9, qword [r14 + 8]
movzx ecx, bx
mov qword [rsp + 0x78], rdi
movzx r8d, word [r9]
cmp bx, r8w
jae 0x1800d0c11
movzx eax, cx
movzx edx, byte [rax + r9 + 4]
cmp dl, 0x13
je 0x1800d0c8a
cmp dl, 0xc0
je 0x1800d0c80
cmp dl, 0xcc
je 0x1800d0c80
add cx, 2
cmp cx, r8w
jb 0x1800d0be3
movzx edi, byte [rsp + 0x29]
movzx ecx, bx
bts edi, 2
mov byte [rsp + 0x29], dil
cmp bx, r8w
jae 0x1800d0c52
nop dword [rax + rax]
movzx eax, cx
movzx edx, byte [rax + r9 + 4]
cmp dl, 0x13
je 0x1800d0c61
cmp dl, 0xc0
je 0x1800d0c61
cmp dl, 0xcc
je 0x1800d0c61
add cx, 2
cmp cx, r8w
jb 0x1800d0c30
movzx eax, dil
bts eax, 3
movzx edi, al
mov byte [rsp + 0x29], al
lea rcx, [r14 + 0x31b0]
mov rax, qword [rcx]
test rax, rax
je 0x1800d0cb9
cmp dword [rax], 0x23
je 0x1800d0c93
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x1800d0c70
jmp 0x1800d0cb9
movzx edi, byte [rsp + 0x29]
movzx ecx, bx
jmp 0x1800d0c30
movzx edi, byte [rsp + 0x29]
mov ecx, ebx
jmp 0x1800d0c30
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1800d0cb9
cmp dword [rdx], 0xfffffff
jne 0x1800d0cb9
test rcx, rcx
je 0x1800d0cb9
mov r9, qword [r14 + 0x48]
xor r8d, r8d
lea edx, [r8 + 0x23]
call fcn.1800d1760
mov rax, qword [r14 + 8]
cmp word [rax + 2], bx
jne 0x1800d0ccf
movzx eax, dil
bts eax, 5
mov byte [rsp + 0x29], al
mov rdi, qword [rsp + 0x78]
mov rcx, qword [r14 + 0x31b0]
test rcx, rcx
je 0x1800d0cfe
lea r9, [rsp + 0x20]
movzx r8d, bpl
lea rdx, [rsp + 0x28]
call fcn.1800d0e30
mov ebx, eax
test eax, eax
jne 0x1800d0d43
movzx esi, word [rsp + 0x20]
mov rax, qword [r14]
test rax, rax
je 0x1800d0d30
mov rcx, qword [rax + 0x2f8]
test rcx, rcx
je 0x1800d0d30
lea r9, [rsp + 0x20]
movzx r8d, bpl
lea rdx, [rsp + 0x28]
call fcn.1800d0e30
mov ebx, eax
test eax, eax
jne 0x1800d0d43
movzx esi, word [rsp + 0x20]
test si, si
je 0x1800d0d39
add si, 2
add word [r15], si
mov eax, ebx
jmp 0x1800d0d43
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800d9ea0
add rsp, 0x40
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d2d70
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rbp
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1801459c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov r12, r9
mov qword [rsp + 0x38], rbx
movzx ebp, r8b
mov r15, rdx
mov r14, rcx
test rcx, rcx
je 0x1800d2f6f
call fcn.180095870
test eax, eax
jne 0x1800d2dc0
cmp byte [r14 + 0x548], 0xfe
jne 0x1800d2f6f
test r15, r15
je 0x1800d2f6f
mov qword [rsp + 0x58], rsi
mov esi, 2
mov word [rsp + 0x30], si
cmp bpl, 1
jne 0x1800d2ea3
mov r9, qword [r14 + 8]
movzx ecx, bx
mov qword [rsp + 0x50], rdi
movzx r8d, word [r9]
cmp bx, r8w
jae 0x1800d2e2d
nop dword [rax + rax]
movzx eax, cx
movzx edx, byte [rax + r9 + 4]
cmp dl, 0x13
je 0x1800d2f63
cmp dl, 0xc0
je 0x1800d2f56
cmp dl, 0xcc
je 0x1800d2f56
add cx, si
cmp cx, r8w
jb 0x1800d2e00
movzx edi, byte [rsp + 0x39]
movzx ecx, bx
bts edi, 2
mov byte [rsp + 0x39], dil
cmp bx, r8w
jae 0x1800d2e71
nop dword [rax]
nop dword [rax + rax]
movzx eax, cx
movzx edx, byte [rax + r9 + 4]
cmp dl, 0x13
je 0x1800d2e80
cmp dl, 0xc0
je 0x1800d2e80
cmp dl, 0xcc
je 0x1800d2e80
add cx, si
cmp cx, r8w
jb 0x1800d2e50
movzx eax, dil
bts eax, 3
movzx edi, al
mov byte [rsp + 0x39], al
mov rcx, r14
call fcn.1800d2010
mov rax, qword [r14 + 8]
cmp word [rax + 2], bx
jne 0x1800d2e9e
movzx eax, dil
bts eax, 5
mov byte [rsp + 0x39], al
mov rdi, qword [rsp + 0x50]
mov rcx, qword [r14 + 0x31b0]
test rcx, rcx
je 0x1800d2ed6
lea rax, [rsp + 0x30]
movzx r9d, bpl
lea rdx, [r15 + 2]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
call fcn.1800d2910
mov ebx, eax
test eax, eax
jne 0x1800d2f37
movzx esi, word [rsp + 0x30]
mov rax, qword [r14]
test rax, rax
je 0x1800d2f13
mov rcx, qword [rax + 0x2f8]
test rcx, rcx
je 0x1800d2f13
lea rax, [rsp + 0x30]
movzx edx, si
add rdx, r15
mov qword [rsp + 0x20], rax
movzx r9d, bpl
lea r8, [rsp + 0x38]
call fcn.1800d2910
mov ebx, eax
test eax, eax
jne 0x1800d2f37
movzx esi, word [rsp + 0x30]
cmp si, 2
ja 0x1800d2f1f
cmp bpl, 1
je 0x1800d2f30
lea ecx, [rsi - 2]
movzx eax, cx
mov byte [r15 + 1], cl
shr ax, 8
mov byte [r15], al
add word [r12], si
mov eax, ebx
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800d9ea0
add rsp, 0x60
pop r15
pop r14
pop r12
pop rbp
pop rbx
ret
movzx edi, byte [rsp + 0x39]
movzx ecx, bx
jmp 0x1800d2e50
movzx edi, byte [rsp + 0x39]
mov ecx, ebx
jmp 0x1800d2e50
xor eax, eax
jmp 0x1800d2f3c
Function at 0x2390c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9b, byte [rcx + 1]
mov dil, byte [rcx + 2]
mov r11b, byte [rcx]
shr dil, 7
mov al, r9b
mov rbx, rcx
shr al, 5
not dil
and al, 1
and dil, 1
mov byte [rcx + 0xa], al
jne 0x23951
not r11b
and dword [rsp + 0x50], 0
mov esi, 0x1f
mov r10b, byte [rsp + 0x50]
lea edx, [rsi - 0x1b]
and r9b, sil
mov al, r10b
mov cl, r9b
shl al, 2
add cl, cl
not cl
and cl, 2
mov r10b, cl
or r10b, al
mov al, r9b
shr r9b, 1
and al, 1
or r10b, al
sub rdx, 1
jne 0x23966
mov bpl, r10b
xor r12d, r12d
mov byte [rsp + 0x50], r10b
not bpl
or r13d, 0xffffffff
lea r14d, [rdx + 0x18]
mov byte [rsp + 0x52], bpl
mov r15d, 0xfe
lea rax, [r14 - 0x10]
mov r8d, r13d
dec r13d
sar rax, 2
and r8d, 7
and rax, r15
mov cl, r8b
mov dl, byte [rax + rbx + 2]
mov rax, r14
inc r14
shr dl, cl
mov ecx, r12d
sar rax, 2
and dl, 1
and rax, r15
xor dl, r9b
shl dl, cl
mov cl, r8b
xor r10b, dl
mov dl, byte [rax + rbx + 2]
shr dl, cl
mov ecx, r12d
inc r12d
and dl, 1
xor dl, r9b
shl dl, cl
xor bpl, dl
cmp r13d, 0xfffffff7
jg 0x239ae
and dword [rbx + 0xb], 0
movzx r12d, r11b
xor r13d, r13d
mov r14d, r12d
mov byte [rsp + 0x51], r10b
mov byte [rsp + 0x53], bpl
shl r14d, 3
mov r15, rsi
mov dword [rbx + 0xf], r14d
mov ebp, 0xc
mov rdx, rbx
mov ecx, esi
call fcn.00023850
sub rbp, 1
mov r11d, eax
jne 0x23a2f
mov eax, dword [rsp + 0x50]
mov rcx, r15
dec r15
sar rcx, 2
and ecx, 0xfe
movzx edx, byte [rcx + rbx + 2]
mov ecx, 0xff
sub cl, sil
and ecx, 7
shr edx, cl
mov ecx, esi
shr eax, cl
xor edx, eax
movzx eax, r11b
xor edx, esi
and edx, 1
xor edx, eax
lea eax, [r13 + r13]
mov r13d, edx
or r13d, eax
sub esi, 1
jns 0x23a26
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movzx eax, dil
lea ecx, [r12 + r12]
mov dword [rbx + 0xb], r13d
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
mov dword [rbx + 0xf], ecx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1409a5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409a51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409a5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409a506f
add dl, dl
jne 0x1409a5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409a50f6
xor eax, eax
add dl, dl
jne 0x1409a50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409a51ad
add dl, dl
jne 0x1409a50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409a50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409a50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409a50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409a50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409a507e
mov eax, 1
add dl, dl
jne 0x1409a5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409a5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409a50fb
sub eax, ebx
mov ebx, 1
jne 0x1409a514c
mov ecx, 1
add dl, dl
jne 0x1409a512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409a513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409a5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409a507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409a5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409a5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409a515d
cmp eax, 0x7d00
jae 0x1409a519b
cmp eax, 0x500
jb 0x1409a5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409a507e
cmp eax, 0x7f
ja 0x1409a519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409a507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409a51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409a507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002860
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400028aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400028aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.api_ms_win_crt_runtime_l1_1_0.dll__get_initial_wide_environment
jne 0x1400028aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400028aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400028aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400028ac
xor al, al
add rsp, 0x28
ret
Function at 0x140008d40
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
add rcx, 0x48
xorps xmm0, xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
mov rdx, rbp
mov r8d, 0x20
call fcn.140032630
test rax, rax
je 0x140008dab
mov qword [rbp + 0x28], rax
mov rcx, rax
mov qword [rbp + 0x30], rdx
call qword [rdx]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140008df4
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.14000dc40
jmp 0x140008df4
movaps xmm0, xmmword [rbp]
movaps xmm1, xmmword [rbp + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x50]
lea r8, [0x1400a9540]
lea rdx, [rbp - 0x20]
mov r9d, 8
call fcn.140032420
mov rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movaps xmm2, xmmword [rbp - 0x30]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
mov qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
jmp fcn.14002ff30