joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18031f760
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11d, 0x80
mov byte [rcx], 0
cmp edx, r11d
mov eax, r11d
mov r10, rcx
mov rdi, r8
cmovle eax, edx
mov ecx, 0x400
test r9d, r9d
cdqe
mov ebx, ecx
cmovg ebx, r9d
cmp ebx, ecx
cmovg ebx, ecx
test rax, rax
jle 0x18031f7c0
mov rdx, r10
sub rdi, r10
mov r8, rax
nop word [rax + rax]
movzx ecx, byte [rdx + rdi]
mov byte [rdx], cl
lea rdx, [rdx + 1]
sub r8, 1
jne 0x18031f7b0
movzx edx, byte [rax + r10 - 1]
lea rdi, [0x18043beb0]
cmp rax, r11
jge 0x18031f7fd
mov r8, r10
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
add ecx, edx
movzx edx, cl
movzx edx, byte [rdx + rdi]
mov byte [r10 + rax], dl
inc rax
cmp rax, r11
jl 0x18031f7e0
lea r9d, [rbx + 7]
mov eax, 0xff
sar r9d, 3
neg ebx
sub r11d, r9d
and ebx, 7
movzx ecx, bl
movsxd r8, r11d
sar eax, cl
lea rdx, [r8 + r10]
mov ecx, eax
movzx eax, byte [rdx]
and rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx], al
test r11d, r11d
je 0x18031f859
movsxd r9, r9d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx + r9 - 1]
lea rdx, [rdx - 1]
xor rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx], al
sub r8, 1
jne 0x18031f840
lea rdx, [r10 + 0xfc]
mov r8d, 4
add r10, 0x7d
nop word [rax + rax]
movzx eax, byte [r10 + 1]
lea rdx, [rdx - 0x40]
movzx ecx, byte [r10 + 2]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x40], ecx
movzx eax, byte [r10 - 1]
movzx ecx, byte [r10]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x3c], ecx
movzx eax, byte [r10 - 3]
movzx ecx, byte [r10 - 2]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x38], ecx
movzx eax, byte [r10 - 5]
movzx ecx, byte [r10 - 4]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x34], ecx
movzx eax, byte [r10 - 7]
movzx ecx, byte [r10 - 6]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x30], ecx
movzx eax, byte [r10 - 9]
movzx ecx, byte [r10 - 8]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x2c], ecx
movzx eax, byte [r10 - 0xb]
movzx ecx, byte [r10 - 0xa]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x28], ecx
movzx eax, byte [r10 - 0xd]
movzx ecx, byte [r10 - 0xc]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x24], ecx
movzx eax, byte [r10 - 0xf]
movzx ecx, byte [r10 - 0xe]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x20], ecx
movzx eax, byte [r10 - 0x11]
movzx ecx, byte [r10 - 0x10]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x1c], ecx
movzx eax, byte [r10 - 0x13]
movzx ecx, byte [r10 - 0x12]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x18], ecx
movzx eax, byte [r10 - 0x15]
movzx ecx, byte [r10 - 0x14]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x14], ecx
movzx eax, byte [r10 - 0x17]
movzx ecx, byte [r10 - 0x16]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0x10], ecx
movzx eax, byte [r10 - 0x19]
movzx ecx, byte [r10 - 0x18]
shl ecx, 8
or ecx, eax
mov dword [rdx + 0xc], ecx
movzx eax, byte [r10 - 0x1b]
movzx ecx, byte [r10 - 0x1a]
shl ecx, 8
or ecx, eax
mov dword [rdx + 8], ecx
movzx ecx, byte [r10 - 0x1c]
movzx eax, byte [r10 - 0x1d]
shl ecx, 8
or ecx, eax
mov dword [rdx + 4], ecx
lea r10, [r10 - 0x20]
sub r8, 1
jne 0x18031f870
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1803204c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1803a1670
sub rsp, rax
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x60]
mov rdi, rcx
mov r13, qword [rbp + 0x68]
mov esi, r8d
mov qword [rbp - 0x28], r9
mov r12, rdx
xor r14d, r14d
mov qword [rbp - 0x20], r13
movzx r8d, byte [r15 + 3]
movzx edx, byte [r15 + 7]
movzx eax, byte [r15 + 1]
mov ecx, edx
movzx r10d, byte [r15]
movzx r9d, byte [r15 + 4]
mov ebx, dword [r13]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [r15 + 2]
shl eax, 0x10
or r10d, eax
mov byte [rbp - 0x15], r8b
mov eax, r8d
mov byte [rbp - 0x11], dl
shl eax, 0x18
or r10d, eax
movzx eax, byte [r15 + 5]
shl eax, 8
or r9d, eax
mov dword [rbp - 0x30], r10d
movzx eax, byte [r15 + 6]
or ecx, eax
mov byte [rbp - 0x18], r10b
mov eax, ecx
mov byte [rbp - 0x12], cl
shl eax, 0x10
or r9d, eax
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r9d
shr eax, 8
mov dword [rbp - 0x2c], r9d
mov byte [rbp - 0x14], r9b
mov byte [rbp - 0x13], al
test esi, esi
je 0x180320675
mov r13, qword [rbp - 0x28]
sub r12, rdi
movzx edx, r9b
movzx r8d, r10b
nop dword [rax + rax]
dec esi
test ebx, ebx
jne 0x180320613
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.180320140
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov r9d, dword [rbp - 0x2c]
movzx r8d, byte [rbp - 0x30]
movzx edx, byte [rbp - 0x2c]
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0x11], al
inc r14d
mov byte [rbp - 0x18], r8b
mov byte [rbp - 0x14], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rdi]
mov byte [rdi + r12], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x1803205b0
mov r13, qword [rbp - 0x20]
test r14d, r14d
je 0x180320675
mov eax, r10d
mov byte [r15], r8b
shr eax, 8
mov byte [r15 + 1], al
mov eax, r10d
shr eax, 0x10
mov byte [r15 + 2], al
mov eax, r9d
shr eax, 8
mov byte [r15 + 5], al
mov eax, r9d
shr eax, 0x10
shr r10d, 0x18
shr r9d, 0x18
mov byte [r15 + 7], r9b
mov byte [r15 + 3], r10b
mov byte [r15 + 4], dl
mov byte [r15 + 6], al
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1803a0e80
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180321b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1803a1670
sub rsp, rax
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rsp + 0xb0]
mov r12, rdx
mov r13, qword [rsp + 0xb8]
mov rsi, rcx
mov qword [rsp + 0x28], r9
mov ebp, r8d
xor r15d, r15d
mov qword [rsp + 0x30], r13
movzx r10d, byte [r14]
movzx eax, byte [r14 + 1]
mov r9d, r10d
movzx r8d, byte [r14 + 4]
movzx ecx, byte [r14 + 6]
mov edx, r8d
mov ebx, dword [r13]
shl r9d, 8
or r9d, eax
shl edx, 8
movzx eax, byte [r14 + 2]
mov r11d, r9d
shl eax, 8
shl r11d, 0x10
or r11d, eax
shl ecx, 8
movzx eax, byte [r14 + 3]
or r11d, eax
mov byte [rsp + 0x38], r10b
movzx eax, byte [r14 + 5]
or edx, eax
mov dword [rsp + 0x20], r11d
movzx eax, byte [r14 + 7]
mov edi, edx
or ecx, eax
shl edi, 0x10
or edi, ecx
mov byte [rsp + 0x39], r9b
mov eax, r11d
mov dword [rsp + 0x24], edi
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3b], r11b
mov byte [rsp + 0x3c], r8b
mov byte [rsp + 0x3d], dl
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], dil
test ebp, ebp
je 0x180321d3b
mov r13, qword [rsp + 0x28]
sub r12, rsi
movzx r8d, dil
movzx edx, r11b
nop dword [rax]
dec ebp
test ebx, ebx
jne 0x180321cd7
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.1803214b0
mov r11d, dword [rsp + 0x20]
mov eax, r11d
mov edi, dword [rsp + 0x24]
mov edx, r11d
shr eax, 0x18
mov r8d, edi
mov byte [rsp + 0x38], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x39], al
mov eax, r11d
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 0x18
mov byte [rsp + 0x3c], al
mov eax, edi
shr eax, 0x10
mov byte [rsp + 0x3d], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3e], al
inc r15d
mov byte [rsp + 0x3b], dl
mov byte [rsp + 0x3f], r8b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x38]
xor cl, byte [rsi]
mov byte [rsi + r12], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x180321c70
mov r13, qword [rsp + 0x30]
test r15d, r15d
je 0x180321d3b
mov eax, r11d
mov byte [r14 + 3], dl
shr eax, 0x18
mov byte [r14], al
mov eax, r11d
shr eax, 0x10
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x18
mov byte [r14 + 4], al
mov eax, edi
shr eax, 0x10
shr r11d, 8
shr edi, 8
mov byte [r14 + 6], dil
mov byte [r14 + 2], r11b
mov byte [r14 + 5], al
mov byte [r14 + 7], r8b
mov dword [r13], ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1803a0e80
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1803246e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1803a1670
sub rsp, rax
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rsp + 0xb0]
mov r12, rdx
mov r13, qword [rsp + 0xb8]
mov rsi, rcx
mov qword [rsp + 0x28], r9
mov ebp, r8d
xor r15d, r15d
mov qword [rsp + 0x30], r13
movzx r10d, byte [r14]
movzx eax, byte [r14 + 1]
mov r9d, r10d
movzx r8d, byte [r14 + 4]
movzx ecx, byte [r14 + 6]
mov edx, r8d
mov ebx, dword [r13]
shl r9d, 8
or r9d, eax
shl edx, 8
movzx eax, byte [r14 + 2]
mov r11d, r9d
shl eax, 8
shl r11d, 0x10
or r11d, eax
shl ecx, 8
movzx eax, byte [r14 + 3]
or r11d, eax
mov byte [rsp + 0x38], r10b
movzx eax, byte [r14 + 5]
or edx, eax
mov dword [rsp + 0x20], r11d
movzx eax, byte [r14 + 7]
mov edi, edx
or ecx, eax
shl edi, 0x10
or edi, ecx
mov byte [rsp + 0x39], r9b
mov eax, r11d
mov dword [rsp + 0x24], edi
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3b], r11b
mov byte [rsp + 0x3c], r8b
mov byte [rsp + 0x3d], dl
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], dil
test ebp, ebp
je 0x1803248ab
mov r13, qword [rsp + 0x28]
sub r12, rsi
movzx r8d, dil
movzx edx, r11b
nop dword [rax]
dec ebp
test ebx, ebx
jne 0x180324847
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.180323ff0
mov r11d, dword [rsp + 0x20]
mov eax, r11d
mov edi, dword [rsp + 0x24]
mov edx, r11d
shr eax, 0x18
mov r8d, edi
mov byte [rsp + 0x38], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x39], al
mov eax, r11d
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 0x18
mov byte [rsp + 0x3c], al
mov eax, edi
shr eax, 0x10
mov byte [rsp + 0x3d], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3e], al
inc r15d
mov byte [rsp + 0x3b], dl
mov byte [rsp + 0x3f], r8b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x38]
xor cl, byte [rsi]
mov byte [rsi + r12], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x1803247e0
mov r13, qword [rsp + 0x30]
test r15d, r15d
je 0x1803248ab
mov eax, r11d
mov byte [r14 + 3], dl
shr eax, 0x18
mov byte [r14], al
mov eax, r11d
shr eax, 0x10
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x18
mov byte [r14 + 4], al
mov eax, edi
shr eax, 0x10
shr r11d, 8
shr edi, 8
mov byte [r14 + 6], dil
mov byte [r14 + 2], r11b
mov byte [r14 + 5], al
mov byte [r14 + 7], r8b
mov dword [r13], ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1803a0e80
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180328b80
Capabilities:
Encode data using xor

Disassembly:
mov eax, reloc.WS2_32.dll_getservbyport
call fcn.1803a1670
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x180328ba9
lea rax, [0x180327150]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.180276a90
lea rax, [0x180326300]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.1802767d0
Function at 0x18032b860
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1803a1670
sub rsp, rax
mov rbx, rcx
call fcn.180230760
test eax, eax
jne 0x18032b881
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 0x5c]
add rsp, 0x20
pop rbx
jmp fcn.180274480
Function at 0x18032e700
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.1803a1670
sub rsp, rax
mov rbx, rdx
mov rdi, rcx
add rcx, 0x40
xor edx, edx
mov r8d, 0xb0
call sub.VCRUNTIME140.dll_memset
movabs rsi, 0x1f83d9abfb41bd6b
movabs rbp, 0x5be0cd19137e2179
mov qword [rdi + 0x30], rsi
movabs rcx, 0x6a09e667f3bcc908
mov qword [rdi + 0x38], rbp
movabs rdx, 0xbb67ae8584caa73b
mov qword [rdi], rcx
movabs r8, 0x3c6ef372fe94f82b
mov qword [rdi + 8], rdx
movabs r9, 0xa54ff53a5f1d36f1
mov qword [rdi + 0x10], r8
movabs r10, 0x510e527fade682d1
mov qword [rdi + 0x18], r9
movabs r11, 0x9b05688c2b3e6c1f
mov qword [rdi + 0x20], r10
mov qword [rdi + 0x28], r11
movzx eax, byte [rbx]
mov qword [rdi + 0xe8], rax
mov rax, qword [rbx]
xor rax, rcx
mov qword [rdi], rax
mov rax, qword [rbx + 8]
xor rax, rdx
mov qword [rdi + 8], rax
mov rax, qword [rbx + 0x10]
xor rax, r8
mov qword [rdi + 0x10], rax
mov rax, qword [rbx + 0x18]
xor rax, r9
mov qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
xor rax, r10
mov qword [rdi + 0x20], rax
mov rax, qword [rbx + 0x28]
xor rax, r11
mov qword [rdi + 0x28], rax
mov rax, qword [rbx + 0x30]
xor rax, rsi
mov rsi, qword [rsp + 0x40]
mov qword [rdi + 0x30], rax
mov rax, qword [rbx + 0x38]
mov rbx, qword [rsp + 0x30]
xor rax, rbp
mov rbp, qword [rsp + 0x38]
mov qword [rdi + 0x38], rax
add rsp, 0x20
pop rdi
ret

Function at 0x180330e70
Capabilities:
Hash data using sha256

Disassembly:
xorps xmm0, xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x70], xmm0
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
movzx eax, byte [rdx]
mov qword [rcx + 0x78], rax
mov eax, dword [rdx]
xor eax, 0x6a09e667
mov dword [rcx], eax
mov eax, dword [rdx + 4]
xor eax, 0xbb67ae85
mov dword [rcx + 4], eax
mov eax, dword [rdx + 8]
xor eax, 0x3c6ef372
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0xc]
xor eax, 0xa54ff53a
mov dword [rcx + 0xc], eax
mov eax, dword [rdx + 0x10]
xor eax, 0x510e527f
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 0x14]
xor eax, 0x9b05688c
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 0x18]
xor eax, 0x1f83d9ab
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x1c]
xor eax, 0x5be0cd19
mov dword [rcx + 0x1c], eax
ret
Function at 0x180331470
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180331665
push rbx
mov eax, Ordinal_211
call fcn.1803a1670
sub rsp, rax
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.180231020
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1802309d0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1802aaca0
mov rcx, r15
call fcn.180231020
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.1802309d0
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1802aaca0
mov edx, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x24]
xor edx, edi
xor edi, dword [rsp + 0x28]
xor ecx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, ecx
shr eax, 8
mov byte [r14 + 5], al
mov eax, ecx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, edx
shr eax, 8
mov byte [r15 + 1], al
mov eax, edx
shr eax, 0x10
mov byte [r14], dil
shr edi, 0x18
mov byte [r14 + 4], cl
shr ecx, 0x18
mov byte [r15], dl
shr edx, 0x18
mov byte [r15 + 3], dl
mov byte [r14 + 3], dil
mov byte [r14 + 7], cl
mov byte [r15 + 2], al
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1803314e0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1803a0e80
add rsp, 0xd0
pop rbx
ret
Function at 0x180351ba0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1803a1670
sub rsp, rax
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, r8
lea rbp, [r8 + r8]
shl rax, 7
xor edi, edi
mov rsi, r8
mov rbx, rdx
mov r14, rcx
movups xmm0, xmmword [rax + rdx - 0x40]
movups xmm1, xmmword [rax + rdx - 0x30]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax + rdx - 0x20]
movups xmm1, xmmword [rax + rdx - 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
test rbp, rbp
je 0x180351ce0
nop word [rax + rax]
xor eax, eax
lea rcx, [rbx + 0x3c]
lea rdx, [rsp + 0x20]
cmp rdx, rcx
ja 0x180351c45
lea rcx, [rsp + 0x5c]
cmp rcx, rbx
jb 0x180351c45
nop word [rax + rax]
mov ecx, dword [rbx]
add rbx, 4
xor dword [rsp + rax*4 + 0x20], ecx
inc rax
cmp rax, 0x10
jb 0x180351c30
jmp 0x180351c88
movdqu xmm0, xmmword [rbx]
xorps xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
movdqu xmm0, xmmword [rbx + 0x10]
xorps xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmm0, xmmword [rbx + 0x20]
xorps xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmm0, xmmword [rbx + 0x30]
add rbx, 0x40
xorps xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x20]
call fcn.180351720
movups xmm0, xmmword [rsp + 0x20]
mov rcx, rdi
movups xmm1, xmmword [rsp + 0x30]
and ecx, 1
imul rcx, rsi
mov rax, rdi
inc rdi
shr rax, 1
add rcx, rax
shl rcx, 6
movups xmmword [rcx + r14], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx + r14 + 0x10], xmm1
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rcx + r14 + 0x20], xmm0
movups xmmword [rcx + r14 + 0x30], xmm1
cmp rdi, rbp
jb 0x180351c10
mov edx, 0x40
lea rcx, [rsp + 0x20]
call fcn.180001240
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1803a0e80
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180352d80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r15
mov eax, 0x50
call fcn.1803a1670
sub rsp, rax
mov r12, rdx
test rdx, rdx
mov rdx, r8
mov r15, r9
mov rbp, r8
je 0x180352fd3
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0xa8]
mov qword [rsp + 0x78], rsi
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x48], r13
mov r13, qword [rsp + 0x98]
mov qword [rsp + 0x40], r14
lea r14, [r9 + 1]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rbx
shr r14, 1
mov r8, r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x20], r13
call fcn.180352b70
test eax, eax
je 0x180352e68
mov r8d, 0x1c8
lea rdx, str.providersimplementationskdfs_tls1_prf.c
mov rcx, rbx
call fcn.18020ce30
mov rdi, rax
test rax, rax
je 0x180352e68
mov r9, qword [rsp + 0x90]
sub rbp, r14
mov qword [rsp + 0x30], rbx
mov r8, r14
mov qword [rsp + 0x28], rax
mov rcx, r12
mov qword [rsp + 0x20], r13
lea rdx, [r15 + rbp]
call fcn.180352b70
test eax, eax
jne 0x180352e90
mov r9d, 0x1cd
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rdi
call fcn.18020cfc0
xor eax, eax
mov rdi, qword [rsp + 0x80]
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r12
pop rbp
ret
xor ecx, ecx
test rbx, rbx
je 0x180352fb1
cmp rbx, 8
jb 0x180352f84
lea rdx, [rsi - 1]
lea rax, [rbx - 1]
add rdx, rbx
add rax, rdi
cmp rsi, rax
ja 0x180352ec1
cmp rdx, rdi
jae 0x180352f84
cmp rbx, 0x40
jb 0x180352f43
mov rdx, rbx
mov r8, rbx
and edx, 0x3f
sub r8, rdx
mov r9, rdi
lea rax, [rsi + 0x10]
sub r9, rsi
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x40
movdqu xmm1, xmmword [r9 + rax - 0x10]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r9 + rax - 0x40]
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm2, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, r8
jb 0x180352ee0
cmp rdx, 8
jb 0x180352f7f
mov rdx, rbx
and rdx, 0xfffffffffffffff8
mov r8, rdi
lea rax, [rcx + rsi]
sub r8, rsi
nop dword [rax]
nop dword [rax + rax]
movq xmm0, qword [rax]
add rcx, 8
movq xmm1, qword [r8 + rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp rcx, rdx
jb 0x180352f60
cmp rcx, rbx
jae 0x180352fb1
mov r8, rdi
lea rax, [rcx + rsi]
sub r8, rsi
mov rdx, rbx
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180352fa0
mov r9d, 0x1d2
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rdi
call fcn.18020cfc0
mov eax, 1
jmp 0x180352e6a
mov rax, qword [rsp + 0xa8]
mov r8, r15
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call fcn.180352b70
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x50
pop r15
pop r12
pop rbp
ret