joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009f64c
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3e8]
sub rsp, 0x4e8
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov rax, qword [rbp + 0x450]
lea r14d, [r9 + 1]
shr r14d, 1
mov rdi, rcx
mov rcx, qword [rbp + 0x460]
mov qword [rsp + 0x60], rax
mov eax, dword [rbp + 0x458]
mov dword [rsp + 0x50], r9d
mov qword [rsp + 0x58], r8
mov esi, edx
mov dword [rsp + 0x54], eax
mov qword [rsp + 0x68], rcx
cmp r14d, 0x104
ja 0x18009f842
mov r13d, dword [rbp + 0x468]
lea r12d, [rax + r13]
cmp r12d, 0x80
ja 0x18009f842
cmp esi, 0xe0
ja 0x18009f842
mov r8d, esi
lea rcx, [rbp + 0xd0]
xor edx, edx
mov r15d, esi
call fcn.1800bb5a0
mov r8d, esi
lea rcx, [rbp - 0x10]
xor edx, edx
call fcn.1800bb5a0
mov rdx, qword [rsp + 0x58]
lea rcx, [rbp + 0x1b0]
mov r8d, r14d
call fcn.1800baef0
mov eax, dword [rsp + 0x50]
lea rcx, [rbp + 0x2c0]
and eax, 1
mov edx, r14d
sub rdx, rax
mov r8d, r14d
add rdx, qword [rsp + 0x58]
call fcn.1800baef0
mov ebx, dword [rsp + 0x54]
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x60]
mov r8d, ebx
call fcn.1800baef0
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x70]
add rcx, rbx
mov r8d, r13d
call fcn.1800baef0
mov r13, qword [rbp + 0x470]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], r13
lea r8, [rbp + 0x1b0]
mov dword [rsp + 0x30], 1
lea rcx, [rbp + 0xd0]
mov dword [rsp + 0x28], r12d
mov r9d, r14d
mov edx, esi
mov qword [rsp + 0x20], rax
call fcn.18009f3e4
mov ebx, eax
test eax, eax
jne 0x18009f83e
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 2
lea r8, [rbp + 0x2c0]
mov dword [rsp + 0x28], r12d
lea rcx, [rbp - 0x10]
mov r9d, r14d
mov qword [rsp + 0x20], rax
mov edx, esi
call fcn.18009f3e4
mov ebx, eax
test eax, eax
jne 0x18009f83e
mov r8d, esi
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call fcn.1800baef0
mov eax, esi
lea rcx, [rbp - 0x10]
or rax, rdi
or rax, rcx
test al, 7
jne 0x18009f825
shr esi, 3
test esi, esi
je 0x18009f83e
lea rcx, [rbp - 0x10]
mov edx, esi
sub rcx, rdi
mov rax, qword [rcx + rdi]
xor qword [rdi], rax
lea rdi, [rdi + 8]
sub rdx, 1
jne 0x18009f812
jmp 0x18009f83e
test esi, esi
je 0x18009f83e
lea rcx, [rbp - 0x10]
sub rcx, rdi
mov al, byte [rdi + rcx]
xor byte [rdi], al
inc rdi
sub r15, 1
jne 0x18009f830
mov eax, ebx
jmp 0x18009f847
mov eax, 0xffffff7c
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.1800b8e30
add rsp, 0x4e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800a1e0c
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r12d, r12d
mov r15, r8
mov qword [rbp - 0x18], r12
movzx ebx, r12w
mov word [rbp - 0x20], bx
mov rdi, rcx
mov esi, r12d
test rcx, rcx
je 0x1800a1e63
mov al, byte [rcx + 0x548]
cmp al, 3
jne 0x1800a1e8a
cmp byte [rcx + 0x549], 1
jae 0x1800a1e8e
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800b8e30
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
cmp al, 0xfe
jne 0x1800a1e63
mov r9, qword [rcx + 8]
movzx edx, r12w
movzx r8d, word [r9]
cmp r12w, r8w
jae 0x1800a1ecd
movzx eax, dx
mov cl, byte [rax + r9 + 4]
cmp cl, 0x13
je 0x1800a1fa8
cmp cl, 0xc0
je 0x1800a1fa2
cmp cl, 0xcc
je 0x1800a1fa2
add dx, 2
cmp dx, r8w
jb 0x1800a1ea0
movzx r14d, byte [rbp - 0x17]
movzx ecx, r12w
bts r14d, 2
mov byte [rbp - 0x17], r14b
cmp r12w, r8w
jae 0x1800a1f06
movzx eax, cx
mov dl, byte [rax + r9 + 4]
cmp dl, 0x13
je 0x1800a1f14
cmp dl, 0xc0
je 0x1800a1f14
cmp dl, 0xcc
je 0x1800a1f14
add cx, 2
cmp cx, r8w
jb 0x1800a1ee5
movzx eax, r14b
bts eax, 3
mov r14b, al
mov byte [rbp - 0x17], al
mov rcx, rdi
call fcn.1800a135c
mov rax, qword [rdi + 8]
cmp word [rax + 2], r12w
jne 0x1800a1f32
movzx eax, r14b
bts eax, 5
mov byte [rbp - 0x17], al
mov rcx, qword [rdi + 0x31b0]
test rcx, rcx
je 0x1800a1f5c
lea r9, [rbp - 0x20]
mov r8b, 1
lea rdx, [rbp - 0x18]
call fcn.1800a1708
mov esi, eax
test eax, eax
jne 0x1800a1e65
movzx ebx, word [rbp - 0x20]
mov rax, qword [rdi]
test rax, rax
je 0x1800a1f8e
mov rcx, qword [rax + 0x2f8]
test rcx, rcx
je 0x1800a1f8e
lea r9, [rbp - 0x20]
mov r8b, 1
lea rdx, [rbp - 0x18]
call fcn.1800a1708
mov esi, eax
test eax, eax
jne 0x1800a1e65
movzx ebx, word [rbp - 0x20]
test bx, bx
je 0x1800a1f97
add bx, 2
add word [r15], bx
mov eax, esi
jmp 0x1800a1e65
movzx ecx, r12w
jmp 0x1800a1fab
mov ecx, r12d
mov r14b, byte [rbp - 0x17]
jmp 0x1800a1ee5
Function at 0x1800a1fb4
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r13d, r13d
mov r12, r9
mov qword [rbp - 0x18], r13
mov r15, rdx
mov rbx, rcx
mov esi, r13d
test rcx, rcx
je 0x1800a2004
mov al, byte [rcx + 0x548]
cmp al, 3
jne 0x1800a202a
cmp byte [rcx + 0x549], 1
jae 0x1800a202e
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800b8e30
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp al, 0xfe
jne 0x1800a2004
test r15, r15
je 0x1800a2004
mov r9, qword [rcx + 8]
mov r10d, 2
movzx r14d, r10w
mov word [rbp - 0x20], r10w
movzx edx, r13w
movzx r8d, word [r9]
cmp r13w, r8w
jae 0x1800a2081
movzx eax, dx
mov cl, byte [rax + r9 + 4]
cmp cl, 0x13
je 0x1800a2189
cmp cl, 0xc0
je 0x1800a2183
cmp cl, 0xcc
je 0x1800a2183
add dx, r10w
cmp dx, r8w
jb 0x1800a2054
movzx edi, byte [rbp - 0x17]
movzx ecx, r13w
bts edi, 2
mov byte [rbp - 0x17], dil
cmp r13w, r8w
jae 0x1800a20b8
movzx eax, cx
mov dl, byte [rax + r9 + 4]
cmp dl, 0x13
je 0x1800a20c6
cmp dl, 0xc0
je 0x1800a20c6
cmp dl, 0xcc
je 0x1800a20c6
add cx, r10w
cmp cx, r8w
jb 0x1800a2097
movzx eax, dil
bts eax, 3
mov dil, al
mov byte [rbp - 0x17], al
mov rcx, rbx
call fcn.1800a135c
mov rax, qword [rbx + 8]
cmp word [rax + 2], r13w
jne 0x1800a20e4
movzx eax, dil
bts eax, 5
mov byte [rbp - 0x17], al
mov rcx, qword [rbx + 0x31b0]
test rcx, rcx
je 0x1800a2118
lea rax, [rbp - 0x20]
mov r9b, 1
lea rdx, [r15 + 2]
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x18]
call fcn.1800a1944
mov esi, eax
test eax, eax
jne 0x1800a2006
movzx r14d, word [rbp - 0x20]
mov rax, qword [rbx]
test rax, rax
je 0x1800a2157
mov rcx, qword [rax + 0x2f8]
test rcx, rcx
je 0x1800a2157
lea rax, [rbp - 0x20]
movzx edx, r14w
add rdx, r15
mov qword [rsp + 0x20], rax
mov r9b, 1
lea r8, [rbp - 0x18]
call fcn.1800a1944
mov esi, eax
test eax, eax
jne 0x1800a2006
movzx r14d, word [rbp - 0x20]
mov eax, 2
cmp r14w, ax
jbe 0x1800a2177
movzx ecx, r14w
sub cx, ax
movzx eax, cx
mov byte [r15 + 1], cl
shr ax, 8
mov byte [r15], al
add word [r12], r14w
mov eax, esi
jmp 0x1800a2006
movzx ecx, r13w
jmp 0x1800a218c
mov ecx, r13d
mov dil, byte [rbp - 0x17]
jmp 0x1800a2097
Function at 0x1800a2644
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov esi, r9d
mov rbx, r8
mov r11, rdx
mov r10, rcx
test rcx, rcx
je 0x1800a26c7
test rdx, rdx
je 0x1800a26c7
test rbx, rbx
je 0x1800a26c7
movzx r9d, byte [rcx]
movzx edi, byte [rcx + 1]
test esi, esi
je 0x1800a26bc
sub r11, rbx
movzx r8d, byte [r9 + r10 + 2]
lea eax, [r8 + rdi]
movzx edi, al
lea eax, [r9 + 1]
movzx ecx, byte [rdi + r10 + 2]
mov byte [r9 + r10 + 2], cl
movzx r9d, al
mov byte [rdi + r10 + 2], r8b
lea eax, [r8 + rcx]
movzx ecx, al
mov al, byte [rcx + r10 + 2]
xor al, byte [rbx]
mov byte [r11 + rbx], al
inc rbx
add esi, 0xffffffff
jne 0x1800a267d
mov byte [r10], r9b
xor eax, eax
mov byte [r10 + 1], dil
jmp 0x1800a26cc
mov eax, 0xffffff53
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1800a2760
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
xor ebx, ebx
lea eax, [rdx + 0x3f]
and dword [rbp + 0x58], ebx
mov r10d, edx
shr eax, 6
mov r14, r9
sub r10d, eax
mov rdi, r8
inc r10d
mov rsi, rcx
lea eax, [r10 + r10*2]
shr eax, 2
cmp eax, dword [r9]
ja 0x1800a2965
cmp edx, 3
jbe 0x1800a2950
lea r8, [rbp + 0x58]
mov rcx, rsi
lea rdx, [rbp + 0x48]
call fcn.1800a26dc
test eax, eax
jne 0x1800a2949
mov ecx, dword [rbp + 0x58]
movzx r12d, byte [rcx + rsi]
inc ecx
mov dword [rbp + 0x58], ecx
test r12b, r12b
je 0x1800a2950
dec dword [rbp + 0x48]
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x48]
mov rcx, rsi
call fcn.1800a26dc
test eax, eax
jne 0x1800a296a
mov ecx, dword [rbp + 0x58]
lea r8, [rbp + 0x58]
dec dword [rbp + 0x48]
lea rdx, [rbp + 0x48]
movzx r13d, byte [rcx + rsi]
inc ecx
mov dword [rbp + 0x58], ecx
mov rcx, rsi
call fcn.1800a26dc
test eax, eax
jne 0x1800a296a
mov ecx, dword [rbp + 0x58]
lea r8, [rbp + 0x58]
dec dword [rbp + 0x48]
lea rdx, [rbp + 0x48]
movzx r15d, byte [rcx + rsi]
inc ecx
mov dword [rbp + 0x58], ecx
mov rcx, rsi
call fcn.1800a26dc
test eax, eax
jne 0x1800a296a
mov ecx, dword [rbp + 0x58]
mov al, 0x2b
dec dword [rbp + 0x48]
movzx r8d, byte [rcx + rsi]
inc ecx
mov dword [rbp + 0x58], ecx
cmp r12b, al
jb 0x1800a2942
cmp r13b, al
jb 0x1800a2942
cmp r15b, al
jb 0x1800a2942
cmp r8b, al
jb 0x1800a2942
mov al, 0x7a
cmp r12b, al
ja 0x1800a2942
cmp r13b, al
ja 0x1800a2942
cmp r15b, al
ja 0x1800a2942
cmp r8b, al
ja 0x1800a2942
xor eax, eax
cmp r15b, 0x3d
setne al
xor ecx, ecx
inc eax
cmp r8b, 0x3d
setne cl
add eax, ebx
add ecx, eax
cmp ecx, dword [r14]
ja 0x1800a2965
mov eax, r12d
lea r12, [0x1800fc980]
mov r10b, byte [r13 + r12 - 0x2b]
mov r11b, byte [rax + r12 - 0x2b]
cmp r15b, 0x3d
jne 0x1800a28e5
xor dl, dl
jmp 0x1800a28ea
mov dl, byte [r15 + r12 - 0x2b]
cmp r8b, 0x3d
jne 0x1800a28f4
xor al, al
jmp 0x1800a28f9
mov al, byte [r8 + r12 - 0x2b]
shl r11b, 2
mov cl, r10b
shr cl, 4
mov r9b, dl
or cl, r11b
shl r9b, 6
mov byte [rbx + rdi], cl
or r9b, al
inc ebx
cmp r15b, 0x3d
je 0x1800a292a
shr dl, 2
shl r10b, 4
or dl, r10b
mov byte [rbx + rdi], dl
inc ebx
cmp r8b, 0x3d
je 0x1800a2950
mov byte [rbx + rdi], r9b
inc ebx
cmp dword [rbp + 0x48], 3
ja 0x1800a27b1
jmp 0x1800a2950
mov eax, 0xffffff66
jmp 0x1800a296a
cmp eax, 0xffffff7c
jne 0x1800a296a
test rdi, rdi
je 0x1800a295e
cmp dword [r14], ebx
jbe 0x1800a295e
mov byte [rbx + rdi], 0
mov dword [r14], ebx
xor eax, eax
jmp 0x1800a296a
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a9be0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
test rcx, rcx
je 0x1800a9d7b
test rdx, rdx
je 0x1800a9d7b
mov eax, dword [rcx]
lea rdi, [rcx + 0xc]
mov ebp, 0x10
mov byte [rax + rdi], pe_nt_image_headers64
mov ecx, dword [rcx]
lea esi, [rbp + 0x28]
inc ecx
mov dword [rbx], ecx
cmp ecx, esi
jbe 0x1800a9c83
lea r15d, [rbp + 0x30]
xor edx, edx
mov r8d, r15d
sub r8d, ecx
add rcx, rdi
call fcn.1800bb5a0
mov rdx, rdi
mov dword [rbx], r15d
mov r8d, ebp
mov eax, dword [rdx]
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov dword [rdx], ecx
lea rdx, [rdx + 4]
sub r8, 1
jne 0x1800a9c49
mov rdx, rdi
mov rcx, rbx
call fcn.1800a8874
test eax, eax
jne 0x1800a9d80
and dword [rbx], eax
xor ecx, ecx
sub esi, ecx
xor edx, edx
mov r8d, esi
add rcx, rdi
call fcn.1800bb5a0
mov rdx, rdi
mov eax, dword [rdx]
mov ecx, eax
ror ecx, 8
rol eax, 8
and ecx, 0xff00ff00
and eax, 0xff00ff
or ecx, eax
mov dword [rdx], ecx
lea rdx, [rdx + 4]
sub rbp, 1
jne 0x1800a9c95
lea r15, [rbx + 8]
mov ecx, dword [r15]
lea rsi, [rbx + 4]
mov r8d, dword [rsi]
mov rdx, r15
mov eax, r8d
shr eax, 0x1d
lea eax, [rax + rcx*8]
mov dword [r15], eax
lea rcx, [rdi + 0x38]
lea eax, [r8*8]
lea r8d, [rbp + 4]
mov dword [rsi], eax
call fcn.1800baef0
lea rcx, [rdi + 0x3c]
mov rdx, rsi
lea r8d, [rbp + 4]
call fcn.1800baef0
mov rdx, rdi
mov rcx, rbx
call fcn.1800a8874
lea rdi, [rbx + 0x4c]
mov ebp, eax
mov r8, rdi
mov r9d, 5
mov ecx, dword [r8]
mov edx, ecx
ror edx, 8
rol ecx, 8
and edx, 0xff00ff00
and ecx, 0xff00ff
or edx, ecx
mov dword [r8], edx
lea r8, [r8 + 4]
sub r9, 1
jne 0x1800a9d16
lea r8d, [r9 + 0x14]
mov rdx, rdi
mov rcx, r14
call fcn.1800baef0
and dword [rbx], 0
mov eax, ebp
and dword [rsi], 0
and dword [r15], 0
mov dword [rdi], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov dword [rbx + 0x5c], 0xc3d2e1f0
jmp 0x1800a9d80
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800aa79c
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov r14d, dword [rbp + 0x248]
mov edi, r8d
mov eax, dword [rbp + 0x238]
xor r8d, r8d
mov qword [rsp + 0x30], r9
mov r12, rdx
mov r15, rcx
mov r13d, 1
test rcx, rcx
je 0x1800aa9d2
test edi, edi
js 0x1800aa9d2
cmp dword [rbp + 0x230], r8d
jl 0x1800aa9d2
mov esi, dword [rbp + 0x240]
test esi, esi
js 0x1800aa9d2
test eax, eax
mov ecx, r13d
cmovg ecx, eax
lea eax, [r14 - 1]
mov dword [rsp + 0x28], ecx
cmp eax, 0xe
mov ecx, r14d
cmova ecx, r8d
call fcn.18009ecf8
mov dword [rsp + 0x24], eax
test eax, eax
js 0x1800aa9d2
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1800ace9c
mov ebx, eax
test eax, eax
jne 0x1800aa9ce
mov r9d, edi
lea rcx, [rsp + 0x40]
mov r8, r12
mov edx, r14d
call fcn.1800ac824
mov ebx, eax
test eax, eax
jne 0x1800aa9ce
test esi, esi
je 0x1800aa9ce
mov r8d, dword [rbp + 0x230]
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
call fcn.1800acb40
mov ebx, eax
test eax, eax
jne 0x1800aa9ce
lea edi, [rax + 0x18]
mov eax, r13d
lea rdx, [rsp + 0x20]
mov ecx, edi
mov r8d, 1
shr eax, cl
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x20], al
call fcn.1800acb40
mov ebx, eax
test eax, eax
jne 0x1800aa9ce
sub edi, 8
cmp edi, 0xfffffff8
jg 0x1800aa8a2
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x40]
call fcn.1800acc24
mov ebx, eax
test eax, eax
jne 0x1800aa9ce
mov edi, dword [rsp + 0x24]
lea rdx, [rbp + 0x170]
cmp esi, edi
mov rcx, r15
cmovl edi, esi
movsxd r12, edi
mov r8, r12
call fcn.1800baef0
lea r14d, [rbx + 1]
cmp dword [rsp + 0x28], r14d
jle 0x1800aa9c1
mov r8d, dword [rsp + 0x24]
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x40]
call fcn.1800acb40
mov ebx, eax
test eax, eax
jne 0x1800aa9ce
lea rdx, [rbp + 0x170]
lea rcx, [rsp + 0x40]
call fcn.1800acc24
mov ebx, eax
test eax, eax
jne 0x1800aa9ce
mov eax, edi
lea rcx, [rbp + 0x170]
or rax, r15
mov r8d, edi
or rax, rcx
test al, 7
jne 0x1800aa995
mov eax, edi
shr eax, 3
test eax, eax
je 0x1800aa9b3
lea rdx, [rbp + 0x170]
mov r8d, eax
sub rdx, r15
mov rcx, r15
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1800aa982
jmp 0x1800aa9b3
test edi, edi
je 0x1800aa9b3
lea rdx, [rbp + 0x170]
mov rcx, r15
mov al, byte [rdx]
inc rdx
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800aa9a3
inc r14d
cmp r14d, dword [rsp + 0x28]
jl 0x1800aa91c
add r15, r12
sub esi, edi
inc r13d
jmp 0x1800aa877
mov eax, ebx
jmp 0x1800aa9d7
mov eax, 0xffffff53
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1800b8e30
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800aaf68
Capabilities:
Hash data using sha512

Disassembly:
xor edx, edx
test rcx, rcx
jne 0x1800aaf75
mov eax, 0xffffff53
ret
movabs rax, 0x6a09e667f3bcc908
mov dword [rcx + 0xc0], edx
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
xor eax, eax
mov qword [rcx + 0xc8], rdx
mov qword [rcx + 0xd0], rdx
ret

Function at 0x1800ac030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov edi, r8d
lea r12, [rcx + 0x40]
mov r8d, dword [rcx + 0xc0]
xor r15d, r15d
mov r13d, pe_nt_image_headers64
mov rbp, rdx
mov rsi, rcx
cmp r8d, r13d
jb 0x1800ac078
mov eax, 0xffffff7c
jmp 0x1800ac21c
mov rdx, qword [rcx + 0xc8]
lea rcx, [rdx + rdi]
mov qword [rsi + 0xc8], rcx
cmp rcx, rdx
jae 0x1800ac096
inc qword [rsi + 0xd0]
movabs rbx, 0xff00ff00ff00ff
movabs r14, 0xffff0000ffff
test r8d, r8d
je 0x1800ac1fc
mov r14d, r13d
sub r14d, r8d
cmp edi, r14d
cmovb r14d, edi
test r14d, r14d
je 0x1800ac17a
lea rcx, [r12 + r8]
mov ebx, r14d
mov r8d, r14d
mov rdx, rbp
call fcn.1800baef0
add dword [rsi + 0xc0], r14d
add rbp, rbx
sub edi, r14d
movabs rbx, 0xff00ff00ff00ff
movabs r14, 0xffff0000ffff
cmp dword [rsi + 0xc0], r13d
jne 0x1800ac1fc
mov r8, r12
mov r9d, 0x10
mov rcx, qword [r8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, rbx
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, r14
xor rcx, rdx
rol rcx, 0x20
mov qword [r8], rcx
lea r8, [r8 + 8]
sub r9, 1
jne 0x1800ac112
mov rcx, rsi
call fcn.1800aaffc
mov r15d, eax
test eax, eax
jne 0x1800ac219
and dword [rsi + 0xc0], eax
jmp 0x1800ac1fc
movabs r14, 0xffff0000ffff
jmp 0x1800ac1fc
mov r8, r13
mov rdx, rbp
mov rcx, r12
call fcn.1800baef0
add rbp, r13
mov r8, r12
add edi, 0xffffff80
mov r9d, 0x10
mov rcx, qword [r8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, rbx
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, r14
xor rcx, rdx
rol rcx, 0x20
mov qword [r8], rcx
lea r8, [r8 + 8]
sub r9, 1
jne 0x1800ac1a3
mov rcx, rsi
call fcn.1800aaffc
mov r15d, eax
test eax, eax
jne 0x1800ac201
cmp edi, r13d
jae 0x1800ac186
test edi, edi
je 0x1800ac219
mov r8d, edi
mov rdx, rbp
mov rcx, r12
call fcn.1800baef0
mov dword [rsi + 0xc0], edi
mov eax, r15d
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800ac23c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r15
sub rsp, 0x20
lea rdi, [rcx + 0x40]
mov rbx, rcx
test rcx, rcx
jne 0x1800ac26b
mov eax, 0xffffff53
jmp 0x1800ac42e
mov eax, dword [rcx + 0xc0]
mov esi, 0x70
movabs r15, 0xff00ff00ff00ff
movabs r12, 0xffff0000ffff
mov byte [rax + rdi], pe_nt_image_headers64
mov ecx, dword [rcx + 0xc0]
inc ecx
mov dword [rbx + 0xc0], ecx
cmp ecx, esi
jbe 0x1800ac328
lea r8d, [rsi + 0x10]
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.1800bb5a0
mov r8, rdi
mov dword [rbx + 0xc0], pe_nt_image_headers64
lea r9d, [rsi - 0x60]
mov rcx, qword [r8]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r15
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, r12
xor rcx, rdx
rol rcx, 0x20
mov qword [r8], rcx
lea r8, [r8 + 8]
sub r9, 1
jne 0x1800ac2c6
mov rcx, rbx
call fcn.1800aaffc
test eax, eax
jne 0x1800ac42e
and dword [rbx + 0xc0], eax
xor ecx, ecx
sub esi, ecx
xor edx, edx
mov r8d, esi
add rcx, rdi
call fcn.1800bb5a0
mov rdx, qword [rbx + 0xc8]
mov r8d, 0xe
mov rcx, qword [rbx + 0xd0]
mov rax, rdx
shr rax, 0x3d
lea rax, [rax + rcx*8]
mov qword [rbx + 0xd0], rax
lea rax, [rdx*8]
mov qword [rbx + 0xc8], rax
mov rcx, qword [rdi]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r15
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, r12
xor rcx, rdx
rol rcx, 0x20
mov qword [rdi], rcx
lea rdi, [rdi + 8]
sub r8, 1
jne 0x1800ac36c
mov rax, qword [rbx + 0xd0]
mov rcx, rbx
mov qword [rbx + 0xb0], rax
mov rax, qword [rbx + 0xc8]
mov qword [rbx + 0xb8], rax
call fcn.1800aaffc
test eax, eax
jne 0x1800ac42e
lea r8d, [rax + 8]
mov rcx, qword [rbx]
mov rdx, rcx
mov rax, rcx
shl rcx, 8
shr rdx, 8
shl rax, 8
xor rdx, rax
and rdx, r15
xor rdx, rcx
mov rcx, rdx
mov rax, rdx
shr rcx, 0x10
shl rax, 0x10
xor rcx, rax
shl rdx, 0x10
and rcx, r12
xor rcx, rdx
rol rcx, 0x20
mov qword [rbx], rcx
lea rbx, [rbx + 8]
sub r8, 1
jne 0x1800ac3e2
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
Function at 0x1800ac44c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r10, rdx
mov r9, rcx
test rcx, rcx
je 0x1800ac4ff
test rdx, rdx
je 0x1800ac4ff
lea rax, [rsp + 0x20]
mov ebx, 8
sub r9, rax
lea r11, [rsp + 0x20]
mov rcx, qword [r9 + r11]
mov r8, rcx
mov rax, rcx
shl rax, 8
shr r8, 8
xor r8, rax
shl rcx, 8
movabs rax, 0xff00ff00ff00ff
and r8, rax
xor r8, rcx
mov rdx, r8
mov rax, r8
shr rdx, 0x10
shl rax, 0x10
xor rdx, rax
shl r8, 0x10
movabs rax, 0xffff0000ffff
and rdx, rax
xor rdx, r8
rol rdx, 0x20
mov qword [r11], rdx
lea r11, [r11 + 8]
sub rbx, 1
jne 0x1800ac48b
lea r8d, [rbx + 0x40]
mov rcx, r10
lea rdx, [rsp + 0x20]
call fcn.1800baef0
xor eax, eax
jmp 0x1800ac504
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800b8e30
add rsp, 0x70
pop rbx
ret

Function at 0x1800ac564
Capabilities:
Hash data using sha384

Disassembly:
xor edx, edx
test rcx, rcx
jne 0x1800ac571
mov eax, 0xffffff53
ret
movabs rax, 0xcbbb9d5dc1059ed8
mov dword [rcx + 0xc0], edx
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
xor eax, eax
mov qword [rcx + 0xc8], rdx
mov qword [rcx + 0xd0], rdx
ret

Function at 0x1800ac5f8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r10, rdx
mov r9, rcx
test rcx, rcx
je 0x1800ac6ab
test rdx, rdx
je 0x1800ac6ab
lea rax, [rsp + 0x20]
mov ebx, 6
sub r9, rax
lea r11, [rsp + 0x20]
mov rcx, qword [r9 + r11]
mov r8, rcx
mov rax, rcx
shl rax, 8
shr r8, 8
xor r8, rax
shl rcx, 8
movabs rax, 0xff00ff00ff00ff
and r8, rax
xor r8, rcx
mov rdx, r8
mov rax, r8
shr rdx, 0x10
shl rax, 0x10
xor rdx, rax
shl r8, 0x10
movabs rax, 0xffff0000ffff
and rdx, rax
xor rdx, r8
rol rdx, 0x20
mov qword [r11], rdx
lea r11, [r11 + 8]
sub rbx, 1
jne 0x1800ac637
lea r8d, [rbx + 0x30]
mov rcx, r10
lea rdx, [rsp + 0x20]
call fcn.1800baef0
xor eax, eax
jmp 0x1800ac6b0
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800b8e30
add rsp, 0x60
pop rbx
ret
Function at 0x1800ac778
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
sub edx, 3
je 0x1800ac7dc
sub edx, 1
je 0x1800ac7d3
sub edx, 2
je 0x1800ac7c2
sub edx, 1
je 0x1800ac7ae
cmp edx, 1
jne 0x1800ac7e1
test rcx, rcx
je 0x1800ac7e1
and qword [rcx + 0xd8], 0
call fcn.1800aaf68
jmp 0x1800ac816
test rbx, rbx
je 0x1800ac7e1
and qword [rcx + 0xd8], 0
call fcn.1800ac564
jmp 0x1800ac816
test rbx, rbx
je 0x1800ac7e1
and qword [rcx + 0x70], 0
call fcn.1800ad06c
jmp 0x1800ac816
xor edx, edx
call fcn.1800a9a20
jmp 0x1800ac816
test rbx, rbx
jne 0x1800ac7e8
mov eax, 0xffffff53
jmp 0x1800ac816
and qword [rcx + 0x60], 0
and dword [rcx], 0
and dword [rcx + 4], 0
and dword [rcx + 8], 0
xor eax, eax
mov dword [rcx + 0x4c], 0x67452301
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x58], 0x10325476
and qword [rbx + 0x220], 0
add rsp, 0x20
pop rbx
ret