joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ac824
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, r9d
mov rdi, r8
mov r14, rcx
test rcx, rcx
je 0x1800aca78
test r8, r8
jne 0x1800ac85c
test r9d, r9d
jne 0x1800aca78
lea eax, [rdx - 3]
cmp eax, 5
jbe 0x1800ac870
lea eax, [rdx - 0xa]
cmp eax, 3
ja 0x1800aca78
mov byte [rcx + 0x229], 0
mov byte [rcx + 0x228], dl
call fcn.1800ac778
mov ebx, eax
test eax, eax
jne 0x1800aca7d
movzx ecx, byte [r14 + 0x228]
lea rsi, [r14 + 0xe0]
sub ecx, 3
je 0x1800ac9f8
sub ecx, 1
je 0x1800ac9b8
sub ecx, 2
je 0x1800ac962
sub ecx, 1
je 0x1800ac912
cmp ecx, 1
jne 0x1800aca78
lea eax, [rcx + 0x7f]
mov r15d, eax
cmp ebp, eax
jbe 0x1800aca04
test rdi, rdi
je 0x1800ac9ae
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call fcn.1800ac030
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov rdx, rsi
mov rcx, r14
call fcn.1800ac518
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov ecx, 0x40
jmp 0x1800aca4b
mov eax, pe_nt_image_headers64
mov r15d, eax
cmp ebp, eax
jbe 0x1800aca04
test rdi, rdi
je 0x1800ac9ae
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call fcn.1800ac030
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov rdx, rsi
mov rcx, r14
call fcn.1800ac6c4
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov ecx, 0x30
jmp 0x1800aca4b
mov ecx, 0x40
mov r15d, ecx
cmp ebp, ecx
jbe 0x1800aca04
test rdi, rdi
je 0x1800ac9ae
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call fcn.1800ad528
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov rdx, rsi
mov rcx, r14
call fcn.1800ad7f0
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov ecx, 0x20
jmp 0x1800aca4b
mov ebx, 0xffffff53
jmp 0x1800aca74
mov ecx, 0x40
mov r15d, ecx
cmp ebp, ecx
jbe 0x1800aca04
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call fcn.1800a9a5c
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov rdx, rsi
mov rcx, r14
call fcn.1800a9be0
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov ecx, 0x14
jmp 0x1800aca4b
mov ecx, 0x40
mov r15d, ecx
cmp ebp, ecx
ja 0x1800aca21
test rdi, rdi
je 0x1800aca17
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call fcn.1800baef0
mov rcx, rbp
cmp ebp, r15d
jae 0x1800aca5b
jmp 0x1800aca4b
mov r8d, ebp
mov rdx, rdi
mov rcx, r14
call fcn.1800b04e4
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov rdx, rsi
mov rcx, r14
call fcn.1800b060c
mov ebx, eax
test eax, eax
jne 0x1800aca74
mov ecx, 0x10
mov r8d, r15d
xor edx, edx
sub r8d, ecx
add rcx, rsi
call fcn.1800bb5a0
mov ecx, r15d
mov al, byte [rsi]
xor al, 0x5c
mov byte [rsi + 0x80], al
xor byte [rsi], 0x36
inc rsi
sub rcx, 1
jne 0x1800aca5e
mov eax, ebx
jmp 0x1800aca7d
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800ad06c
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1800ad081
mov eax, 0xffffff53
jmp 0x1800ad0d1
xor edx, edx
lea r8d, [rdx + 0x20]
call fcn.1800bb5a0
and dword [rbx + 0x60], 0
and dword [rbx + 0x64], 0
and dword [rbx + 0x68], 0
xor eax, eax
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret
Function at 0x1800aec18
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rbx, r8
shr edi, 4
mov r14, rdx
mov rbp, rcx
test rcx, rcx
je 0x1800aecd2
test rdx, rdx
je 0x1800aecd2
test rbx, rbx
je 0x1800aecd2
test edi, edi
je 0x1800aecce
lea rsi, [rcx + 0xf8]
sub r14, rbx
mov al, sil
mov rdx, rbx
or al, bl
sub rdx, rsi
dec edi
mov rcx, rsi
test al, 7
jne 0x1800aec92
mov r8d, 2
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1800aec7f
jmp 0x1800aeca6
mov r8d, 0x10
mov al, byte [rcx + rdx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800aec98
mov r8, rsi
mov rdx, rsi
mov rcx, rbp
call fcn.1800ad8d0
lea rcx, [r14 + rbx]
mov r8d, 0x10
mov rdx, rsi
call fcn.1800baef0
add rbx, 0x10
test edi, edi
jne 0x1800aec65
xor eax, eax
jmp 0x1800aecd7
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800aecf4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x1800aedd8
test rdx, rdx
je 0x1800aedd8
test r8, r8
je 0x1800aedd8
test dil, 0xf
jne 0x1800aedd8
shr edi, 4
test edi, edi
je 0x1800aedd4
lea r15, [rcx + 0x108]
sub rsi, rdx
lea r14, [rcx + 0xf8]
mov r12d, 0x10
lea rdx, [rsi + rbx]
mov r8, r12
mov rcx, r15
dec edi
call fcn.1800baef0
mov r8, rbx
mov rdx, r15
mov rcx, rbp
call fcn.1800adedc
mov al, r14b
mov rdx, r14
or al, bl
sub rdx, rbx
mov rcx, rbx
test al, 7
jne 0x1800aedae
mov r8d, 2
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r8, 1
jne 0x1800aed9b
jmp 0x1800aedbf
mov r8, r12
mov al, byte [rcx + rdx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800aedb1
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.1800baef0
add rbx, r12
test edi, edi
jne 0x1800aed64
xor eax, eax
jmp 0x1800aeddd
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800b060c
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
test rcx, rcx
je 0x1800b071e
test rdx, rdx
je 0x1800b071e
mov eax, dword [rcx]
lea rbx, [rcx + 0xc]
mov edi, 0x38
mov byte [rax + rbx], pe_nt_image_headers64
mov ecx, dword [rcx]
inc ecx
mov dword [r14], ecx
cmp ecx, edi
jbe 0x1800b067e
lea esi, [rdi + 8]
xor edx, edx
mov r8d, esi
sub r8d, ecx
add rcx, rbx
call fcn.1800bb5a0
mov rdx, rbx
mov dword [r14], esi
mov rcx, r14
call fcn.1800afcfc
and dword [r14], 0
xor ecx, ecx
sub edi, ecx
xor edx, edx
mov r8d, edi
add rcx, rbx
call fcn.1800bb5a0
lea rsi, [r14 + 4]
mov r8d, dword [rsi]
lea rdi, [r14 + 8]
mov ecx, dword [rdi]
mov eax, r8d
shr eax, 0x1d
mov rdx, rsi
lea eax, [rax + rcx*8]
mov dword [rdi], eax
lea rcx, [rbx + 0x38]
lea eax, [r8*8]
mov r8d, 4
mov dword [rsi], eax
call fcn.1800baef0
lea rcx, [rbx + 0x3c]
mov r8d, 4
mov rdx, rdi
call fcn.1800baef0
mov rdx, rbx
mov rcx, r14
call fcn.1800afcfc
mov r8d, 0x10
lea rdx, [r14 + 0x4c]
mov rcx, rbp
call fcn.1800baef0
and dword [r14], 0
and dword [rsi], 0
and dword [rdi], 0
xor eax, eax
mov dword [r14 + 0x4c], 0x67452301
mov dword [r14 + 0x50], 0xefcdab89
mov dword [r14 + 0x54], 0x98badcfe
mov dword [r14 + 0x58], 0x10325476
jmp 0x1800b0723
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1800b1760
Capabilities:
Encrypt data using des

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor ebx, ebx
lea r15, [0x180000000]
mov rdi, r8
mov r14d, edx
mov r8d, ebx
mov r9, rcx
movzx edx, byte [r8 + r15 + 0xffb80]
dec rdx
mov rax, rdx
and edx, 7
sar rax, 3
mov cl, byte [rax + r9]
test byte [r15 + rdx*4 + 0xffb30], cl
setne al
mov byte [rbp + r8 - 0x59], al
inc r8
cmp r8, 0x38
jl 0x1800b17a1
mov rsi, rbx
mov r12d, 0x1c
xor edx, edx
lea rcx, [rbp + 0x17]
lea r8d, [rdx + 8]
call fcn.1800bb5a0
movzx r9d, byte [rsi + r15 + 0xffbc0]
mov r8, rbx
mov edx, r9d
lea r10d, [r9 - 0x1c]
mov eax, edx
mov ecx, 0x38
sub eax, r9d
cmp eax, r12d
mov eax, r10d
cmovl ecx, r12d
cmp edx, ecx
cmovl eax, edx
inc edx
cdqe
inc r10d
mov cl, byte [rbp + rax - 0x59]
mov byte [rbp + r8 - 0x21], cl
inc r8
cmp r8, 0x38
jl 0x1800b17ff
mov r9d, ebx
lea r10, [0x1800ffb50]
movzx eax, byte [r10]
cmp byte [rbp + rax - 0x22], bl
je 0x1800b186c
mov eax, 0xaaaaaaab
mul r9d
mov eax, r9d
shr edx, 2
lea ecx, [rdx + rdx*2]
add ecx, ecx
sub eax, ecx
movsxd rcx, eax
mov eax, dword [r15 + rcx*4 + 0xffb30]
sar eax, 2
or byte [rbp + rdx + 0x17], al
inc r9d
inc r10
cmp r9d, 0x30
jl 0x1800b183b
movzx eax, byte [rbp + 0x19]
movzx ecx, byte [rbp + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp + 0x1a]
mov dword [rdi + rsi*8], ecx
movzx ecx, byte [rbp + 0x18]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp + 0x1c]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbp + 0x1e]
shl ecx, 8
or ecx, eax
mov dword [rdi + rsi*8 + 4], ecx
inc rsi
cmp rsi, 0x10
jl 0x1800b17dd
cmp r14d, 1
jne 0x1800b18fa
lea rdx, [rdi + 0x7c]
mov eax, dword [rdx - 4]
mov ecx, dword [rdi + rbx*4]
mov dword [rdi + rbx*4], eax
mov dword [rdx - 4], ecx
mov ecx, dword [rdi + rbx*4 + 4]
mov eax, dword [rdx]
mov dword [rdi + rbx*4 + 4], eax
add rbx, 2
mov dword [rdx], ecx
lea rdx, [rdx - 8]
cmp rbx, 0x10
jl 0x1800b18d4
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800b8e30
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1800b19ec
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
mov edi, dword [rcx]
lea r12, [0x1800ff330]
mov esi, dword [rdx]
mov rbp, r8
mov r11, rdx
mov rbx, rcx
xor r14d, r14d
lea r10d, [r14*4]
mov r9d, esi
mov ecx, dword [rbp + r10*4]
lea eax, [r10 + 1]
mov r8d, dword [rbp + rax*4]
inc r14d
ror r9d, 4
xor r9, rcx
mov eax, esi
xor r8, rax
mov rcx, r8
mov rax, r8
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [r12 + rcx*4 + 0x100]
xor edx, dword [r12 + rax*4 + 0x300]
mov rax, r8
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [r12 + rax*4 + 0x500]
mov rax, r9
shr rax, 0x18
and eax, 0x3f
xor edx, dword [r12 + rax*4]
mov rax, r9
shr rax, 0x10
and eax, 0x3f
xor edx, dword [r12 + rax*4 + 0x200]
mov rax, r9
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [r12 + rax*4 + 0x400]
lea eax, [r10 + 2]
mov eax, dword [rbp + rax*4]
xor edx, dword [r12 + r8*4 + 0x700]
xor edx, dword [r12 + r9*4 + 0x600]
xor edi, edx
mov r9d, edi
mov edx, edi
ror r9d, 4
xor r9, rax
lea eax, [r10 + 3]
mov r8d, dword [rbp + rax*4]
xor r8, rdx
mov rcx, r8
mov rax, r8
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [r12 + rcx*4 + 0x100]
xor edx, dword [r12 + rax*4 + 0x300]
mov rax, r8
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [r12 + rax*4 + 0x500]
mov rax, r9
shr rax, 0x18
and eax, 0x3f
xor edx, dword [r12 + rax*4]
mov rax, r9
shr rax, 0x10
and eax, 0x3f
xor edx, dword [r12 + rax*4 + 0x200]
mov rax, r9
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [r12 + rax*4 + 0x400]
xor edx, dword [r12 + r8*4 + 0x700]
xor edx, dword [r12 + r9*4 + 0x600]
xor esi, edx
cmp r14d, 8
jb 0x1800b1a1a
mov rbp, qword [rsp + 0x20]
mov dword [rbx], edi
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x30]
mov dword [r11], esi
mov rsi, qword [rsp + 0x28]
pop r14
pop r12
ret

Function at 0x1800b1f60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov esi, r9d
mov r14, r8
shr esi, 3
mov rbx, rdx
mov rdi, rcx
test esi, esi
je 0x1800b1ff6
lea rbp, [rcx + 8]
sub r14, rdx
mov r15d, 8
lea rdx, [r14 + rbx]
mov r8, r15
mov rcx, rbp
dec esi
call fcn.1800baef0
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.1800b1b90
mov al, dil
or al, bl
test al, 7
jne 0x1800b1fc8
mov rax, qword [rdi]
xor qword [rbx], rax
jmp 0x1800b1fe1
mov rcx, rbx
mov rdx, rdi
mov r8, r15
mov al, byte [rdx]
inc rdx
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800b1fd1
mov r8, r15
mov rdx, rbp
mov rcx, rdi
call fcn.1800baef0
add rbx, r15
test esi, esi
jne 0x1800b1f98
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800b2014
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rbx, r8
mov r14, rdx
mov rbp, rcx
test rcx, rcx
je 0x1800b20b5
test rdx, rdx
je 0x1800b20b5
test rbx, rbx
je 0x1800b20b5
shr edi, 3
test edi, edi
je 0x1800b20b1
lea rsi, [rcx + 0x180]
sub r14, rbx
mov al, sil
dec edi
or al, bl
test al, 7
jne 0x1800b206c
mov rax, qword [rbx]
xor qword [rsi], rax
jmp 0x1800b2089
mov rdx, rbx
mov rcx, rsi
sub rdx, rsi
mov r8d, 8
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800b207b
mov r8, rsi
mov rdx, rsi
mov rcx, rbp
call fcn.1800b1d64
lea rcx, [r14 + rbx]
mov r8d, 8
mov rdx, rsi
call fcn.1800baef0
add rbx, 8
test edi, edi
jne 0x1800b2059
xor eax, eax
jmp 0x1800b20ba
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1800b20d8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov rbx, rdx
mov rbp, rcx
test rcx, rcx
je 0x1800b219d
test rdx, rdx
je 0x1800b219d
test r8, r8
je 0x1800b219d
shr edi, 3
test edi, edi
je 0x1800b2199
lea r15, [rcx + 0x188]
sub rsi, rdx
lea r14, [rcx + 0x180]
mov r12d, 8
lea rdx, [rsi + rbx]
mov r8, r12
mov rcx, r15
dec edi
call fcn.1800baef0
mov r8, rbx
mov rdx, r15
mov rcx, rbp
call fcn.1800b1d64
mov al, r14b
or al, bl
test al, 7
jne 0x1800b216a
mov rax, qword [r14]
xor qword [rbx], rax
jmp 0x1800b2184
mov rdx, r14
mov rcx, rbx
sub rdx, rbx
mov r8, r12
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1800b2176
mov r8, r12
mov rdx, r15
mov rcx, r14
call fcn.1800baef0
add rbx, r12
test edi, edi
jne 0x1800b213a
xor eax, eax
jmp 0x1800b21a2
mov eax, 0xffffff53
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800b328c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
xor r9d, r9d
lea r11d, [rdx - 4]
xor r10d, r10d
mov eax, r11d
mov esi, edx
mov rbp, rcx
lea r14d, [r9 + 4]
cmp r11d, r14d
cmova eax, r14d
test r11d, r11d
je 0x1800b3308
xor r8d, r8d
test eax, eax
jle 0x1800b32ee
mov edx, r10d
add rdx, rbp
mov ebx, eax
mov edi, eax
movzx ecx, byte [rbx + rdx]
movzx eax, byte [rdx]
inc rdx
xor ecx, eax
or r8d, ecx
sub rdi, 1
jne 0x1800b32d4
test r8d, r8d
jne 0x1800b32f4
mov r9d, 3
add r10d, r14d
mov eax, esi
sub eax, r10d
cmp eax, r14d
cmova eax, r14d
cmp r10d, r11d
jb 0x1800b32c3
mov rbx, qword [rsp + 0x10]
mov eax, r9d
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x1800b3704
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x100
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor r8d, r8d
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x38], rax
test ecx, ecx
je 0x1800b37de
lea rax, [0x1800ffc30]
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x28], rax
lea r9, str.c63w
lea ecx, [rdx + 1]
mov dword [rsp + 0x20], 0x30
call fcn.1800b35f4
mov edx, eax
test eax, eax
jne 0x1800b3918
xorps xmm3, xmm3
lea rdi, [0x180000000]
xor eax, eax
movd xmm2, dword [rax + rdi + 0xffd00]
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax + 0x60]
add rax, 4
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rax, 0x80
jl 0x1800b377d
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x1800b3918
jmp 0x1800b3870
and dword [rsp + 0x30], 0
lea r9, [0x1800fca08]
and qword [rsp + 0x28], 0
xor ecx, ecx
mov dword [rsp + 0x20], 0x30
call fcn.1800b35f4
mov edx, eax
test eax, eax
jne 0x1800b3918
xorps xmm6, xmm6
lea rdi, [0x180000000]
xorps xmm3, xmm3
xor eax, eax
movd xmm2, dword [rax + rdi + 0xffc80]
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax + 0x60]
add rax, 4
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rax, 0x80
jl 0x1800b3818
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x1800b3878
or edx, 0xffffffff
jmp 0x1800b3918
lea rax, [rsp + 0x60]
mov r8d, 0x10
mov qword [rsp + 0x38], rax
lea r9, [0x1800fca08]
and dword [rsp + 0x30], 0
lea rdx, [0x1800fca28]
and qword [rsp + 0x28], 0
xor ecx, ecx
mov dword [rsp + 0x20], 0x20
call fcn.1800b35f4
mov edx, eax
test eax, eax
jne 0x1800b3918
xor eax, eax
movd xmm2, dword [rax + rdi + 0xffc80]
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax + 0x60]
add rax, 4
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm6, xmm2
cmp rax, 0x80
jl 0x1800b38b8
movdqa xmm0, xmm6
mov eax, edx
psrldq xmm0, 8
or edx, 0xffffffff
por xmm6, xmm0
movdqa xmm0, xmm6
psrldq xmm0, 4
por xmm6, xmm0
movd ecx, xmm6
test ecx, ecx
cmovne eax, edx
mov edx, eax
mov eax, edx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1800b8e30
movaps xmm6, xmmword [rsp + 0xf0]
add rsp, 0x100
pop rdi
ret
Function at 0x1800b492c
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rsi, rcx
xor edx, edx
movzx ecx, byte [rcx + 0x559]
movzx eax, word [rsi + 0x54e]
lea r8d, [rdx + 0x14]
add ecx, eax
movzx eax, word [rsi + 0x54c]
add ecx, eax
lea r15d, [rcx*2 + 0xf]
lea rcx, [rbp]
shr r15d, 4
call fcn.1800bb5a0
and qword [rbp - 0x80], 0
lea rcx, [rbp - 0x70]
and dword [rsp + 0x20], 0
xor edx, edx
and dword [rsp + 0x24], 0
and dword [rsp + 0x28], 0
mov dword [rsp + 0x6c], 0x67452301
mov dword [rsp + 0x70], 0xefcdab89
mov dword [rsp + 0x74], 0x98badcfe
mov dword [rsp + 0x78], 0x10325476
call fcn.1800a9a20
mov ebx, eax
test eax, eax
jne 0x1800b4b19
mov rdx, qword [rsi + 0x10]
lea r8d, [rax + 0x30]
add rdx, 0x1c3
lea rcx, [rbp + 0x20]
call fcn.1800baef0
test r15d, r15d
je 0x1800b4b08
xor r14d, r14d
lea edi, [rbx + 0x31]
lea edx, [rdi - 0x31]
lea rcx, [rbp + 0x70]
call fcn.1800b3dec
test eax, eax
je 0x1800b4b47
mov rdx, qword [rsi + 0x10]
lea eax, [rdi - 0x30]
movsxd rcx, eax
add rdx, 0x1c3
lea rax, [rbp + 0x70]
mov r8d, 0x30
add rcx, rax
call fcn.1800baef0
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x70]
movsxd rax, edi
add rdx, 0x182
add rcx, rax
mov r8d, 0x20
call fcn.1800baef0
mov rdx, qword [rsi + 0x10]
lea eax, [rdi + 0x20]
movsxd rcx, eax
add rdx, 0x162
lea rax, [rbp + 0x70]
mov r8d, 0x20
add rcx, rax
call fcn.1800baef0
test ebx, ebx
jne 0x1800b4aaa
lea r8d, [rdi + 0x40]
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.1800a9a5c
mov ebx, eax
test eax, eax
jne 0x1800b4aaa
lea rdx, [rbp]
lea rcx, [rbp - 0x70]
call fcn.1800a9be0
mov ebx, eax
mov r8d, 0x14
lea rdx, [rbp]
lea rcx, [rbp + 0x50]
call fcn.1800baef0
test ebx, ebx
jne 0x1800b4af2
lea r8d, [rbx + 0x44]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x20]
call fcn.1800b04e4
mov ebx, eax
test eax, eax
jne 0x1800b4af2
movsxd rax, r14d
lea rdx, [rbp + 0xf0]
add rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800b060c
mov ebx, eax
inc edi
add r14d, 0x10
lea eax, [rdi - 0x31]
cmp eax, r15d
jl 0x1800b4a06
test ebx, ebx
jne 0x1800b4b19
lea rdx, [rbp + 0xf0]
mov rcx, rsi
call fcn.1800b47e4
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1800b8e30
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ebx, 0xfffffed2
jmp 0x1800b4b19
Function at 0x1800b4cdc
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4e8]
sub rsp, 0x5c0
mov rax, qword [0x18011d1a8]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov rax, qword [rcx + 0x10]
xor edx, edx
mov rsi, rcx
lea rcx, [rbp + 0x20]
mov r15d, dword [rax + 0x10]
lea r8d, [rdx + 0x14]
call fcn.1800bb5a0
xor r14d, r14d
mov dword [rsp + 0x7c], 0x67452301
xor edx, edx
mov qword [rbp - 0x70], r14
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x38], r14d
mov dword [rbp - 0x80], 0xefcdab89
mov dword [rbp - 0x7c], 0x98badcfe
mov dword [rbp - 0x78], 0x10325476
call fcn.1800a9a20
mov edi, eax
test eax, eax
jne 0x1800b4edf
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x290]
mov r8d, r15d
mov rdx, qword [rdx + 8]
call fcn.1800baef0
mov ebx, 0xffffffe0
lea r12d, [rdi - 0x21]
sub ebx, r15d
mov r13d, r14d
mov dword [rsp + 0x20], ebx
lea r14d, [r15 + 0x21]
sub r12d, r15d
lea edx, [r12 + r14]
lea rcx, [rbp + 0x10]
call fcn.1800b3dec
test eax, eax
je 0x1800b4eda
add ebx, r14d
lea rdx, [rbp + 0x10]
movsxd r8, ebx
lea rcx, [rbp + 0x40]
call fcn.1800baef0
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x40]
mov eax, ebx
mov r8, r15
add rcx, rax
mov rdx, qword [rdx + 8]
call fcn.1800baef0
mov rdx, qword [rsi + 0x10]
lea rax, [rbp + 0x40]
lea ecx, [r14 - 0x20]
add rdx, 0x162
add rcx, rax
mov r8d, 0x20
call fcn.1800baef0
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x40]
mov eax, r14d
add rdx, 0x182
add rcx, rax
mov r8d, 0x20
call fcn.1800baef0
test edi, edi
jne 0x1800b4e4d
lea r8d, [r14 + 0x20]
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.1800a9a5c
mov edi, eax
test eax, eax
jne 0x1800b4e4d
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x60]
call fcn.1800a9be0
mov edi, eax
lea rcx, [rbp + 0x290]
mov r8d, 0x14
add rcx, r15
lea rdx, [rbp + 0x20]
call fcn.1800baef0
test edi, edi
jne 0x1800b4ea2
lea r8d, [r15 + 0x14]
lea rdx, [rbp + 0x290]
lea rcx, [rsp + 0x30]
call fcn.1800b04e4
mov edi, eax
test eax, eax
jne 0x1800b4ea2
mov rdx, qword [rsi + 0x10]
add rdx, 0x1c3
movsxd rcx, r13d
add rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.1800b060c
mov edi, eax
mov ebx, dword [rsp + 0x20]
inc r14d
add r13d, 0x10
mov ecx, edi
lea eax, [r12 + r14]
cmp eax, 3
jl 0x1800b4da1
test ecx, ecx
jne 0x1800b4edf
mov rcx, rsi
call fcn.1800b492c
mov edi, eax
test eax, eax
jne 0x1800b4edf
mov rcx, rsi
call fcn.1800b4b50
mov edi, eax
jmp 0x1800b4ee7
mov edi, 0xfffffed2
mov rcx, rsi
call fcn.1800b4b50
mov eax, edi
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.1800b8e30
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret