joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005d00
Capabilities:
Encode data using base64

Disassembly:
push rbx
mov rbx, rdx
lea r10d, [r9*4]
mov eax, 0xaaaaaaab
mov r11, rcx
mul r10d
shr edx, 1
add edx, 5
cmp dword [rbx], edx
jae 0x180005d25
xor eax, eax
pop rbx
ret
mov r9d, r9d
mov rax, r11
mov qword [rsp + 0x10], rdi
lea rdi, [0x18014d6c0]
lea r10, [r9 + r8]
cmp r9, 3
jb 0x180005dbf
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8]
sub r9, 3
shr rcx, 2
movzx ecx, byte [rcx + rdi]
mov byte [rax], cl
movzx edx, byte [r8]
movzx ecx, byte [r8 + 1]
and edx, 3
shr rcx, 4
shl rdx, 4
or rdx, rcx
movzx ecx, byte [rdx + rdi]
mov byte [rax + 1], cl
movzx edx, byte [r8 + 1]
movzx ecx, byte [r8 + 2]
and edx, 0xf
shr rcx, 6
shl rdx, 2
or rdx, rcx
movzx ecx, byte [rdx + rdi]
mov byte [rax + 2], cl
lea rcx, [rax + 3]
movzx eax, byte [r8 + 2]
add r8, 3
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov byte [rcx], al
lea rax, [rcx + 1]
cmp r9, 3
jge 0x180005d50
mov r9, rax
sub r10, r8
je 0x180005e24
movzx ecx, byte [r8]
shr rcx, 2
movzx ecx, byte [rcx + rdi]
mov byte [rax], cl
movzx edx, byte [r8]
and edx, 3
shl rdx, 4
cmp r10, 1
jne 0x180005df5
movzx ecx, byte [rdx + rdi]
mov byte [rax + 1], cl
mov cl, 0x3d
add rax, 2
jmp 0x180005e18
movzx ecx, byte [r8 + 1]
shr rcx, 4
or rcx, rdx
movzx ecx, byte [rcx + rdi]
mov byte [rax + 1], cl
movzx eax, byte [r8 + 1]
and eax, 0xf
movzx ecx, byte [rdi + rax*4]
lea rax, [r9 + 2]
mov byte [r9 + 2], cl
mov byte [rax + 1], 0x3d
add rax, 2
mov rdi, qword [rsp + 0x10]
mov byte [rax], 0
sub eax, r11d
mov dword [rbx], eax
mov eax, 1
pop rbx
ret
Function at 0x1800074f0
Capabilities:
Get disk information

Disassembly:
mov r11, rsp
push rbx
push rbp
push r14
push r15
sub rsp, 0x258
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [r11 + 0x10], rsi
mov r14, rcx
mov qword [r11 + 0x18], rdi
mov ebx, 0x3e8
mov qword [r11 - 0x28], r12
mov rbp, 0xffffffffffffffff
nop dword [rax]
mov edx, ebx
mov eax, 2
mul rdx
lea rdx, [0x1801423a8]
cmovo rax, rbp
mov rcx, rax
call fcn.18010fb14
mov r15, rax
test rax, rax
je 0x180007581
mov r8d, ebx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x180007637
mov rcx, r15
call sym.SafeBase64.dll_SafeBase_free
add ebx, 0x3e8
cmp ebx, 0x186a0
jb 0x180007530
movabs rax, 0x5c003a0043
lea rdx, [rsp + 0x30]
mov ecx, 0x104
mov qword [rsp + 0x28], rax
lea rbx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
je 0x180007601
movzx eax, word [rsp + 0x30]
xor r12d, r12d
mov dword [r14], r12d
test ax, ax
je 0x1800075fc
nop dword [rax]
lea rcx, [rsp + 0x28]
mov word [rsp + 0x28], ax
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 5
jne 0x1800075d8
inc dword [r14]
mov rcx, rbp
nop dword [rax + rax]
cmp word [rbx + rcx*2 + 2], r12w
lea rcx, [rcx + 1]
jne 0x1800075e0
lea rbx, [rbx + rcx*2]
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x1800075c0
mov eax, 1
mov r12, qword [rsp + 0x250]
mov rdi, qword [rsp + 0x290]
mov rsi, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x258
pop r15
pop r14
pop rbp
pop rbx
ret
xor r12d, r12d
mov dword [r14], r12d
call fcn.1800f3548
mov rcx, rax
test rax, rax
je 0x18000774b
mov rax, qword [rax]
call qword [rax + 0x18]
mov rdi, r15
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
cmp word [r15], r12w
je 0x180007718
nop word [rax + rax]
mov rax, rbp
inc rax
cmp word [rdi + rax*2], r12w
jne 0x180007673
mov r8d, eax
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.180007b10
mov rbx, qword [rsp + 0x20]
movsxd rsi, dword [rbx - 0x10]
test esi, esi
js 0x180007740
mov eax, dword [rbx - 0xc]
mov ecx, 1
sub ecx, dword [rbx - 8]
sub eax, esi
or ecx, eax
jge 0x1800076c0
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.180007df0
mov rbx, qword [rsp + 0x20]
lea eax, [rsi + 1]
mov rcx, rbx
movsxd rdx, eax
call fcn.18011aa04
cmp esi, dword [rbx - 0xc]
jg 0x180007740
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], r12w
cmp dword [rbx - 0x10], r12d
jl 0x180007702
lea rdx, str.cdrom
mov rcx, rbx
call fcn.18011273c
test rax, rax
je 0x180007702
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x180007702
inc dword [r14]
movsxd rax, dword [rbx - 0x10]
lea rdi, [rdi + rax*2]
add rdi, 2
cmp word [rdi], r12w
jne 0x180007670
mov rcx, r15
call sym.SafeBase64.dll_SafeBase_free
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], ebp
sub ebp, 1
jg 0x1800075fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x1800075fc
mov ecx, 0x80070057
call fcn.180007f70
int3
mov ecx, 0x80004005
call fcn.180007f70
int3
Function at 0x180007760
Capabilities:
Unmount volume via ioctl

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor esi, esi
mov edi, esi
call sym.SafeBase64.dll_OpenCDRomDriver
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180007797
xor eax, eax
jmp 0x18000789c
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov edx, 0x90018
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180007891
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov edx, 0x90020
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x180007865
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], esi
mov r9d, 1
mov edx, 0x2d4804
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov byte [rsp + 0x40], sil
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
test eax, eax
je 0x180007865
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov edx, 0x2d4808
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edi, eax
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov edx, 0x9001c
mov qword [rsp + 0x20], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x180008410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov edi, edx
mov esi, edx
mov rbx, rcx
shr edi, 3
mov rdx, r8
lea rcx, [rsp + 0x20]
call fcn.180011b60
xor ecx, ecx
lea r8, [rsp + 0x9c]
nop word [rax + rax]
mov eax, dword [r8 - 4]
lea r8, [r8 - 8]
mov dword [rsp + rcx*4 + 0xa0], eax
mov eax, dword [r8 + 8]
mov dword [rsp + rcx*4 + 0xa4], eax
add rcx, 2
cmp rcx, 0x20
jl 0x180008460
test edi, edi
je 0x1800084ad
nop dword [rax + rax]
mov r8, rbx
lea rcx, [rsp + 0xa0]
mov rdx, rbx
call fcn.180012020
add rbx, 8
sub rdi, 1
jne 0x180008490
mov cl, 0
and esi, 7
jbe 0x1800084cf
nop dword [rax]
nop dword [rax + rax]
xor byte [rbx], cl
lea rbx, [rbx + 1]
inc cl
movzx eax, cl
cmp eax, esi
jb 0x1800084c0
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180008500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov edi, edx
mov esi, edx
mov rbx, rcx
shr edi, 3
mov rdx, r8
lea rcx, [rsp + 0x20]
call fcn.180011b60
xor ecx, ecx
lea r8, [rsp + 0x9c]
nop word [rax + rax]
mov eax, dword [r8 - 4]
lea r8, [r8 - 8]
mov dword [rsp + rcx*4 + 0xa0], eax
mov eax, dword [r8 + 8]
mov dword [rsp + rcx*4 + 0xa4], eax
add rcx, 2
cmp rcx, 0x20
jl 0x180008550
test edi, edi
je 0x18000859a
nop dword [rax + rax]
mov r8, rbx
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.180012020
add rbx, 8
sub rdi, 1
jne 0x180008580
mov cl, 0
and esi, 7
jbe 0x1800085b0
xor byte [rbx], cl
lea rbx, [rbx + 1]
inc cl
movzx eax, cl
cmp eax, esi
jb 0x1800085a1
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.18010faf0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800085e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov edi, edx
mov rbx, rcx
mov rdx, r8
lea rcx, [rsp + 0x20]
call fcn.1800499b0
cmp edi, 0x10
jb 0x180008651
mov qword [rsp + 0x1f8], rsi
mov esi, edi
shr rsi, 4
lea r9, [rsp + 0x20]
mov r8, rbx
mov rdx, rbx
lea rcx, [rsp + 0xa0]
call fcn.180049600
add rbx, 0x10
add edi, 0xfffffff0
sub rsi, 1
jne 0x180008624
mov rsi, qword [rsp + 0x1f8]
xor cl, cl
test edi, edi
je 0x18000866f
nop word [rax + rax]
xor byte [rbx], cl
lea rbx, [rbx + 1]
inc cl
movzx eax, cl
cmp eax, edi
jb 0x180008660
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x208]
add rsp, 0x1e0
pop rdi
ret
Function at 0x180008690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov edi, edx
mov rbx, rcx
mov rdx, r8
lea rcx, [rsp + 0x20]
call fcn.1800499b0
cmp edi, 0x10
jb 0x18000870a
mov qword [rsp + 0x1f8], rsi
mov esi, edi
shr rsi, 4
nop dword [rax]
nop dword [rax + rax]
lea r9, [rsp + 0x20]
mov r8, rbx
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.180049600
add rbx, 0x10
add edi, 0xfffffff0
sub rsi, 1
jne 0x1800086e0
mov rsi, qword [rsp + 0x1f8]
xor cl, cl
test edi, edi
je 0x18000871f
xor byte [rbx], cl
lea rbx, [rbx + 1]
inc cl
movzx eax, cl
cmp eax, edi
jb 0x180008710
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x208]
add rsp, 0x1e0
pop rdi
ret
Function at 0x180008740
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
movaps xmmword [rsp + 0x250], xmm6
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov rsi, r8
mov r14d, edx
mov rbx, rcx
cmp r9d, 0x20
jb 0x180008785
mov edi, 0x20
jmp 0x180008795
mov eax, 0x18
mov edi, 0x10
cmp r9d, eax
cmovae edi, eax
mov r8d, edi
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.180001720
mov r8d, edi
lea rcx, [rbp + 0x10]
mov rdx, rsi
call fcn.180002400
test al, al
movzx ecx, al
mov rax, qword [rbp + 0x1b0]
mov edx, 0xa
cmove ecx, edx
mov byte [rbp + 0x110], cl
test rax, rax
je 0x1800087d8
movups xmm6, xmmword [rax]
jmp 0x1800087dd
movups xmm6, xmmword [rsp + 0x24]
mov edi, dword [0x180196620]
mov esi, dword [rbp + 0x1b8]
movups xmmword [rbp + 0x100], xmm6
mov byte [rbp + 0x111], sil
test edi, edi
jne 0x18000880f
call fcn.180001010
movups xmm6, xmmword [rbp + 0x100]
mov edi, eax
mov dword [0x180196620], eax
mov eax, r14d
shr eax, 4
movdqu xmmword [rbp + 0x120], xmm6
cmp esi, 1
jne 0x180008891
test eax, eax
je 0x18000893b
mov esi, eax
nop dword [rax]
lea r8, [rbp + 0x130]
mov rdx, rbx
lea rcx, [rsp + 0x20]
test edi, edi
je 0x180008858
call fcn.180001130
movdqu xmm6, xmmword [rbp + 0x120]
mov edi, dword [0x180196620]
jmp 0x180008860
call sym.SafeBase64.dll_Ordinal_59
nop dword [rax]
movdqu xmm1, xmmword [rbp + 0x130]
pxor xmm1, xmm6
movups xmm6, xmmword [rbx]
movups xmmword [rbx], xmm1
add rbx, 0x10
movdqu xmmword [rbp + 0x130], xmm1
movdqu xmmword [rbp + 0x120], xmm6
sub rsi, 1
jne 0x180008830
jmp 0x18000893b
cmp esi, 2
jne 0x180008909
test eax, eax
je 0x18000893b
mov esi, eax
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x120]
lea rcx, [rsp + 0x20]
test edi, edi
je 0x1800088c4
call fcn.180001030
mov edi, dword [0x180196620]
jmp 0x1800088d0
call sym.SafeBase64.dll_Ordinal_58
nop dword [rax]
mov eax, dword [rbx]
xor dword [rbp + 0x120], eax
mov eax, dword [rbx + 4]
xor dword [rbp + 0x124], eax
mov eax, dword [rbx + 8]
xor dword [rbp + 0x128], eax
mov eax, dword [rbx + 0xc]
xor dword [rbp + 0x12c], eax
movups xmm0, xmmword [rbp + 0x120]
movups xmmword [rbx], xmm0
add rbx, 0x10
sub rsi, 1
jne 0x1800088a0
jmp 0x18000893b
test eax, eax
je 0x18000893b
mov esi, eax
nop
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, rbx
test edi, edi
je 0x18000892c
call fcn.180001130
mov edi, dword [0x180196620]
jmp 0x180008931
call sym.SafeBase64.dll_Ordinal_59
add rbx, 0x10
sub rsi, 1
jne 0x180008910
xor eax, eax
and r14d, 0xf
jbe 0x180008950
xor byte [rbx], al
lea rbx, [rbx + 1]
inc eax
cmp eax, r14d
jb 0x180008943
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.18010faf0
movaps xmm6, xmmword [rsp + 0x250]
add rsp, 0x260
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180008980
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov rsi, r8
mov r14d, edx
mov rbx, rcx
cmp r9d, 0x20
jb 0x1800089bd
mov edi, 0x20
jmp 0x1800089cd
mov eax, 0x18
mov edi, 0x10
cmp r9d, eax
cmovae edi, eax
mov r8d, edi
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.180001720
mov r8d, edi
lea rcx, [rbp + 0x10]
mov rdx, rsi
call fcn.180002400
test al, al
movzx ecx, al
mov rax, qword [rbp + 0x190]
mov edx, 0xa
cmove ecx, edx
mov byte [rbp + 0x110], cl
test rax, rax
je 0x180008a10
movups xmm0, xmmword [rax]
jmp 0x180008a15
movups xmm0, xmmword [rsp + 0x24]
mov edi, dword [0x180196620]
mov esi, dword [rbp + 0x198]
movaps xmmword [rbp + 0x100], xmm0
mov byte [rbp + 0x111], sil
test edi, edi
jne 0x180008a47
call fcn.180001010
movaps xmm0, xmmword [rbp + 0x100]
mov edi, eax
mov dword [0x180196620], eax
mov eax, r14d
shr eax, 4
movups xmmword [rbp + 0x120], xmm0
cmp esi, 1
jne 0x180008ad5
test eax, eax
je 0x180008b8b
mov esi, eax
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx]
lea r8, [rbp + 0x120]
xor dword [rbp + 0x120], eax
lea rdx, [rbp + 0x120]
mov eax, dword [rbx + 4]
lea rcx, [rsp + 0x20]
xor dword [rbp + 0x124], eax
mov eax, dword [rbx + 8]
xor dword [rbp + 0x128], eax
mov eax, dword [rbx + 0xc]
xor dword [rbp + 0x12c], eax
test edi, edi
je 0x180008ab7
call fcn.180001030
mov edi, dword [0x180196620]
jmp 0x180008abc
call sym.SafeBase64.dll_Ordinal_58
movups xmm0, xmmword [rbp + 0x120]
movups xmmword [rbx], xmm0
add rbx, 0x10
sub rsi, 1
jne 0x180008a70
jmp 0x180008b8b
cmp esi, 2
jne 0x180008b59
test eax, eax
je 0x180008b8b
mov esi, eax
nop dword [rax]
nop dword [rax + rax]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x120]
lea rcx, [rsp + 0x20]
test edi, edi
je 0x180008b14
call fcn.180001030
mov edi, dword [0x180196620]
jmp 0x180008b20
call sym.SafeBase64.dll_Ordinal_58
nop dword [rax]
mov eax, dword [rbx]
xor dword [rbp + 0x120], eax
mov eax, dword [rbx + 4]
xor dword [rbp + 0x124], eax
mov eax, dword [rbx + 8]
xor dword [rbp + 0x128], eax
mov eax, dword [rbx + 0xc]
xor dword [rbp + 0x12c], eax
movups xmm0, xmmword [rbp + 0x120]
movups xmmword [rbx], xmm0
add rbx, 0x10
sub rsi, 1
jne 0x180008af0
jmp 0x180008b8b
test eax, eax
je 0x180008b8b
mov esi, eax
nop
lea rcx, [rsp + 0x20]
mov r8, rbx
mov rdx, rbx
test edi, edi
je 0x180008b7c
call fcn.180001030
mov edi, dword [0x180196620]
jmp 0x180008b81
call sym.SafeBase64.dll_Ordinal_58
add rbx, 0x10
sub rsi, 1
jne 0x180008b60
xor eax, eax
and r14d, 0xf
jbe 0x180008ba0
xor byte [rbx], al
lea rbx, [rbx + 1]
inc eax
cmp eax, r14d
jb 0x180008b93
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x240
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180008bc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov esi, r9d
mov edi, edx
mov rbp, r8
mov qword [rsp], 0
mov r11, rcx
lea r10, [rsp + 8]
xor eax, eax
mov ebx, 0x100
mov byte [r10], al
lea r10, [r10 + 1]
inc eax
cmp eax, ebx
jb 0x180008c00
xor r8d, r8d
lea r9, [rsp + 8]
xor r10d, r10d
nop dword [rax + rax]
movzx ecx, byte [r8 + rbp]
movzx edx, byte [r9]
lea r9, [r9 + 1]
add cl, r10b
add cl, dl
movzx r10d, cl
lea rcx, [rsp + 8]
movzx eax, byte [rcx + r10]
mov byte [r9 - 1], al
lea eax, [r8 + 1]
xor r8d, r8d
mov byte [rcx + r10], dl
cmp eax, esi
cmovb r8d, eax
sub rbx, 1
jne 0x180008c20
mov r9d, dword [rsp]
mov r10d, dword [rsp + 4]
test edi, edi
je 0x180008cb0
mov rbx, rdi
nop dword [rax + rax]
inc r9b
lea rdx, [rsp + 8]
movzx r9d, r9b
lea r11, [r11 + 1]
movzx r8d, byte [rdx + r9]
add r10b, r8b
movzx r10d, r10b
movzx ecx, byte [rsp + r10 + 8]
mov byte [rdx + r9], cl
add cl, r8b
movzx eax, cl
mov byte [rsp + r10 + 8], r8b
movzx ecx, byte [rsp + rax + 8]
xor byte [r11 - 1], cl
sub rbx, 1
jne 0x180008c70
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x148]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret

Function at 0x180008ce0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov esi, r9d
mov edi, edx
mov rbp, r8
mov qword [rsp], 0
mov rbx, rcx
lea r10, [rsp + 8]
xor eax, eax
mov r11d, 0x100
mov byte [r10], al
lea r10, [r10 + 1]
inc eax
cmp eax, r11d
jb 0x180008d21
xor r8d, r8d
lea r9, [rsp + 8]
xor r10d, r10d
nop word [rax + rax]
movzx ecx, byte [r8 + rbp]
movzx edx, byte [r9]
lea r9, [r9 + 1]
add cl, r10b
add cl, dl
movzx r10d, cl
lea rcx, [rsp + 8]
movzx eax, byte [rcx + r10]
mov byte [r9 - 1], al
lea eax, [r8 + 1]
xor r8d, r8d
mov byte [rcx + r10], dl
cmp eax, esi
cmovb r8d, eax
sub r11, 1
jne 0x180008d40
mov r9d, dword [rsp]
mov r10d, dword [rsp + 4]
test edi, edi
je 0x180008dd6
mov r11, rdi
nop dword [rax + rax]
lea rcx, [rsp + 8]
inc r9b
movzx r9d, r9b
lea rbx, [rbx + 1]
movzx r8d, byte [rcx + r9]
add r10b, r8b
movzx r10d, r10b
movzx edx, byte [rsp + r10 + 8]
mov byte [rcx + r9], dl
movzx ecx, byte [rbx - 1]
mov byte [rsp + r10 + 8], r8b
sub cl, byte [rsp + rdx + 8]
add dl, r8b
movzx eax, dl
xor cl, byte [rsp + rax + 8]
mov byte [rbx - 1], cl
sub r11, 1
jne 0x180008d90
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x148]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret
Function at 0x180008e00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x120
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov esi, r9d
mov edi, edx
mov rbp, r8
mov qword [rsp], 0
mov rbx, rcx
lea r10, [rsp + 8]
xor eax, eax
mov r11d, 0x100
mov byte [r10], al
lea r10, [r10 + 1]
inc eax
cmp eax, r11d
jb 0x180008e41
xor r8d, r8d
lea r9, [rsp + 8]
xor r10d, r10d
nop word [rax + rax]
movzx ecx, byte [r8 + rbp]
movzx edx, byte [r9]
lea r9, [r9 + 1]
add cl, r10b
add cl, dl
movzx r10d, cl
lea rcx, [rsp + 8]
movzx eax, byte [rcx + r10]
mov byte [r9 - 1], al
lea eax, [r8 + 1]
xor r8d, r8d
mov byte [rcx + r10], dl
cmp eax, esi
cmovb r8d, eax
sub r11, 1
jne 0x180008e60
mov r9d, dword [rsp]
mov r10d, dword [rsp + 4]
test edi, edi
je 0x180008ef8
mov r11, rdi
nop dword [rax + rax]
lea rcx, [rsp + 8]
inc r9b
movzx r9d, r9b
lea rbx, [rbx + 1]
movzx edx, byte [rcx + r9]
add r10b, dl
movzx r10d, r10b
movzx r8d, byte [rsp + r10 + 8]
mov byte [rcx + r9], r8b
mov byte [rsp + r10 + 8], dl
lea eax, [rdx + r8]
movzx ecx, al
movzx edx, byte [rsp + rcx + 8]
xor dl, byte [rbx - 1]
add dl, byte [rsp + r8 + 8]
mov byte [rbx - 1], dl
sub r11, 1
jne 0x180008eb0
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.18010faf0
mov rbx, qword [rsp + 0x148]
add rsp, 0x120
pop rdi
pop rsi
pop rbp
ret
Function at 0x180008f90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x1f8
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rbx, rcx
mov edi, edx
mov ecx, dword [rsp + 0x240]
mov r14d, r9d
mov rsi, r8
sub ecx, 0xa
je 0x180009148
sub ecx, 1
je 0x180009063
sub ecx, 0x3b
je 0x180009044
cmp ecx, 0xa
jne 0x180009152
mov rdx, r8
lea rcx, [rsp + 0x30]
call fcn.1800499b0
cmp edi, 0x10
jb 0x180009025
mov esi, edi
shr rsi, 4
nop dword [rax]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.180049600
add rbx, 0x10
add edi, 0xfffffff0
sub rsi, 1
jne 0x180009000
xor cl, cl
test edi, edi
je 0x180009152
nop
xor byte [rbx], cl
lea rbx, [rbx + 1]
inc cl
movzx eax, cl
cmp eax, edi
jb 0x180009030
jmp 0x180009152
xor r8d, r8d
mov edx, edi
mov dword [rsp + 0x28], r8d
mov rcx, rbx
mov qword [rsp + 0x20], r8
mov r8, rsi
call sym.SafeBase64.dll_Ordinal_13
jmp 0x180009152
xor r8d, r8d
mov qword [rsp + 0x1f0], rbp
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x38]
mov eax, r8d
mov r9d, 0x100
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, r9d
jb 0x180009081
mov r10d, r8d
lea r11, [rsp + 0x38]
mov ebp, r8d
nop dword [rax]
movzx edx, byte [r11]
lea r11, [r11 + 1]
mov eax, r10d
movzx ecx, byte [rax + rsi]
add cl, bpl
add cl, dl
movzx ebp, cl
lea rcx, [rsp + 0x38]
movzx eax, byte [rcx + rbp]
mov byte [r11 - 1], al
lea eax, [r10 + 1]
cmp eax, r14d
mov byte [rcx + rbp], dl
mov r10d, r8d
cmovb r10d, eax
sub r9, 1
jne 0x1800090a0
mov r9d, dword [rsp + 0x30]
mov r10d, dword [rsp + 0x34]
mov rbp, qword [rsp + 0x1f0]
test edi, edi
je 0x180009152
mov r11, rdi
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x38]
inc r9b
movzx r9d, r9b
lea rbx, [rbx + 1]
movzx r8d, byte [rcx + r9]
add r10b, r8b
movzx r10d, r10b
movzx edx, byte [rsp + r10 + 0x38]
mov byte [rcx + r9], dl
movzx ecx, byte [rbx - 1]
mov byte [rsp + r10 + 0x38], r8b
sub cl, byte [rsp + rdx + 0x38]
add dl, r8b
movzx eax, dl
xor cl, byte [rsp + rax + 0x38]
mov byte [rbx - 1], cl
sub r11, 1
jne 0x180009100
jmp 0x180009152
mov edx, edi
mov rcx, rbx
call sym.SafeBase64.dll_Ordinal_15
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x1f8
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x180009170
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x1f8
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rbx, rcx
mov edi, edx
mov ecx, dword [rsp + 0x240]
mov r14d, r9d
mov rsi, r8
sub ecx, 0xa
je 0x18000932a
sub ecx, 1
je 0x180009243
sub ecx, 0x3b
je 0x180009224
cmp ecx, 0xa
jne 0x180009334
mov rdx, r8
lea rcx, [rsp + 0x30]
call fcn.1800499b0
cmp edi, 0x10
jb 0x180009202
mov esi, edi
shr rsi, 4
nop dword [rax]
lea r9, [rsp + 0x30]
mov r8, rbx
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180049600
add rbx, 0x10
add edi, 0xfffffff0
sub rsi, 1
jne 0x1800091e0
xor cl, cl
test edi, edi
je 0x180009334
nop dword [rax]
xor byte [rbx], cl
lea rbx, [rbx + 1]
inc cl
movzx eax, cl
cmp eax, edi
jb 0x180009210
jmp 0x180009334
xor r8d, r8d
mov edx, edi
mov dword [rsp + 0x28], r8d
mov rcx, rbx
mov qword [rsp + 0x20], r8
mov r8, rsi
call sym.SafeBase64.dll_Ordinal_14
jmp 0x180009334
xor r8d, r8d
mov qword [rsp + 0x1f0], rbp
mov qword [rsp + 0x30], r8
lea rcx, [rsp + 0x38]
mov eax, r8d
mov r9d, 0x100
mov byte [rcx], al
lea rcx, [rcx + 1]
inc eax
cmp eax, r9d
jb 0x180009261
mov r10d, r8d
lea r11, [rsp + 0x38]
mov ebp, r8d
nop dword [rax]
movzx edx, byte [r11]
lea r11, [r11 + 1]
mov eax, r10d
movzx ecx, byte [rax + rsi]
add cl, bpl
add cl, dl
movzx ebp, cl
lea rcx, [rsp + 0x38]
movzx eax, byte [rcx + rbp]
mov byte [r11 - 1], al
lea eax, [r10 + 1]
cmp eax, r14d
mov byte [rcx + rbp], dl
mov r10d, r8d
cmovb r10d, eax
sub r9, 1
jne 0x180009280
mov r9d, dword [rsp + 0x30]
mov r10d, dword [rsp + 0x34]
mov rbp, qword [rsp + 0x1f0]
test edi, edi
je 0x180009334
mov r11, rdi
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x38]
inc r9b
movzx r9d, r9b
lea rbx, [rbx + 1]
movzx edx, byte [rcx + r9]
add r10b, dl
movzx r10d, r10b
movzx r8d, byte [rsp + r10 + 0x38]
mov byte [rcx + r9], r8b
mov byte [rsp + r10 + 0x38], dl
lea eax, [rdx + r8]
movzx ecx, al
movzx edx, byte [rsp + rcx + 0x38]
xor dl, byte [rbx - 1]
add dl, byte [rsp + r8 + 0x38]
mov byte [rbx - 1], dl
sub r11, 1
jne 0x1800092e0
jmp 0x180009334
mov edx, edi
mov rcx, rbx
call sym.SafeBase64.dll_Ordinal_15
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x1f8
pop r14
pop rdi
pop rsi
pop rbx
ret