joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180037f00
Capabilities:
Encode data using base64
Encrypt data using rc4 prga

Disassembly:
mov r9, r8
lea r8, [0x180125450]
jmp 0x180037f10

Function at 0x180037f10
Capabilities:
Encode data using base64

Disassembly:
push rbx
push rsi
push r12
push r15
sub rsp, 0x158
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, r9
mov r15, r8
mov esi, edx
mov r12, rcx
test edx, edx
je 0x180038188
test rcx, rcx
je 0x180038188
lea ecx, [rdx*4 + 8]
mov eax, 0xaaaaaaab
mul ecx
mov ecx, edx
xor edx, edx
shr ecx, 1
lea eax, [rcx + rcx]
div esi
lea edx, [rcx + 3]
mov rcx, rbx
add edx, eax
call fcn.18000f700
test al, al
je 0x180038098
mov qword [rsp + 0x150], rbp
mov eax, 0xaaaaaaab
mul esi
mov qword [rsp + 0x148], rdi
xor ebp, ebp
mov qword [rsp + 0x140], r14
xor r10d, r10d
mov r14d, edx
xor edi, edi
shr r14d, 1
je 0x1800380b6
xor r11d, r11d
nop
movsx ecx, byte [rbp + r12]
add r10d, 4
movzx r8d, cl
inc ebp
mov eax, r8d
and r8d, 3
shr rax, 2
shl r8d, 4
movsx ecx, byte [rbp + r12]
inc ebp
movzx r9d, cl
movzx eax, byte [rax + r15]
mov byte [rsp + r11 + 0x20], al
mov eax, r9d
shr rax, 4
and r9d, 0xf
mov edx, ebp
inc ebp
shl r9d, 2
mov ecx, r8d
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rsp + r11 + 0x21], al
movsx rax, byte [rdx + r12]
movzx edx, al
mov eax, edx
mov ecx, r9d
shr rax, 6
and edx, 0x3f
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rsp + r11 + 0x22], al
movzx eax, byte [rdx + r15]
mov byte [rsp + r11 + 0x23], al
add r11, 4
cmp r10d, 0x100
jl 0x18003805a
mov r8d, r10d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18000e0d0
test al, al
je 0x18003807e
xor r10d, r10d
xor r11d, r11d
inc edi
cmp edi, r14d
jb 0x180037fb0
test r10d, r10d
je 0x1800380b6
mov r8d, r10d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18000e0d0
test al, al
jne 0x1800380b6
xor al, al
mov rdi, qword [rsp + 0x148]
mov rbp, qword [rsp + 0x150]
mov r14, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x158
pop r15
pop r12
pop rsi
pop rbx
ret
lea eax, [r14 + r14*2]
mov cl, 1
sub esi, eax
sub esi, 1
je 0x180038124
cmp esi, 1
jne 0x180038180
movzx esi, byte [rbp + r12]
lea eax, [rbp + 1]
movzx edi, byte [rax + r12]
mov rcx, rbx
mov eax, esi
shr rax, 2
movzx edx, byte [rax + r15]
call fcn.18000d3a0
test al, al
je 0x18003817e
and esi, 3
mov eax, edi
shr rax, 4
shl esi, 4
mov ecx, esi
or rcx, rax
movzx edx, byte [rcx + r15]
mov rcx, rbx
call fcn.18000d3a0
test al, al
je 0x18003817e
and edi, 0xf
shl edi, 2
movzx edx, byte [rdi + r15]
jmp 0x18003815a
movzx edi, byte [rbp + r12]
mov rcx, rbx
mov eax, edi
shr rax, 2
movzx edx, byte [rax + r15]
call fcn.18000d3a0
test al, al
je 0x18003817e
and edi, 3
mov rcx, rbx
shl edi, 4
movzx edx, byte [rdi + r15]
call fcn.18000d3a0
test al, al
je 0x18003817e
mov dl, 0x3d
mov rcx, rbx
call fcn.18000d3a0
test al, al
je 0x18003817e
mov dl, 0x3d
mov rcx, rbx
call fcn.18000d3a0
test al, al
je 0x18003817e
mov cl, 1
movzx eax, cl
jmp 0x180038080
xor cl, cl
movzx eax, cl
jmp 0x180038080
mov al, 1
jmp 0x180038098
mov r9, r8
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
jmp 0x180037f10
Function at 0x1800382b0
Capabilities:
Encode data using base64

Disassembly:
push rbx
push rsi
push r12
push r15
sub rsp, 0x158
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, r9
mov r15, r8
mov esi, edx
mov r12, rcx
test edx, edx
je 0x180038188
test rcx, rcx
je 0x180038188
lea ecx, [rdx*4 + 8]
mov eax, 0xaaaaaaab
mul ecx
mov ecx, edx
xor edx, edx
shr ecx, 1
lea eax, [rcx + rcx]
div esi
lea edx, [rcx + 3]
mov rcx, rbx
add edx, eax
call fcn.18000f700
test al, al
je 0x180038098
mov qword [rsp + 0x150], rbp
mov eax, 0xaaaaaaab
mul esi
mov qword [rsp + 0x148], rdi
xor ebp, ebp
mov qword [rsp + 0x140], r14
xor r10d, r10d
mov r14d, edx
xor edi, edi
shr r14d, 1
je 0x1800380b6
xor r11d, r11d
nop
movsx ecx, byte [rbp + r12]
add r10d, 4
movzx r8d, cl
inc ebp
mov eax, r8d
and r8d, 3
shr rax, 2
shl r8d, 4
movsx ecx, byte [rbp + r12]
inc ebp
movzx r9d, cl
movzx eax, byte [rax + r15]
mov byte [rsp + r11 + 0x20], al
mov eax, r9d
shr rax, 4
and r9d, 0xf
mov edx, ebp
inc ebp
shl r9d, 2
mov ecx, r8d
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rsp + r11 + 0x21], al
movsx rax, byte [rdx + r12]
movzx edx, al
mov eax, edx
mov ecx, r9d
shr rax, 6
and edx, 0x3f
or rcx, rax
movzx eax, byte [rcx + r15]
mov byte [rsp + r11 + 0x22], al
movzx eax, byte [rdx + r15]
mov byte [rsp + r11 + 0x23], al
add r11, 4
cmp r10d, 0x100
jl 0x18003805a
mov r8d, r10d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18000e0d0
test al, al
je 0x18003807e
xor r10d, r10d
xor r11d, r11d
inc edi
cmp edi, r14d
jb 0x180037fb0
test r10d, r10d
je 0x1800380b6
mov r8d, r10d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18000e0d0
test al, al
jne 0x1800380b6
xor al, al
mov rdi, qword [rsp + 0x148]
mov rbp, qword [rsp + 0x150]
mov r14, qword [rsp + 0x140]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x158
pop r15
pop r12
pop rsi
pop rbx
ret
lea eax, [r14 + r14*2]
mov cl, 1
sub esi, eax
sub esi, 1
je 0x180038124
cmp esi, 1
jne 0x180038180
movzx esi, byte [rbp + r12]
lea eax, [rbp + 1]
movzx edi, byte [rax + r12]
mov rcx, rbx
mov eax, esi
shr rax, 2
movzx edx, byte [rax + r15]
call fcn.18000d3a0
test al, al
je 0x18003817e
and esi, 3
mov eax, edi
shr rax, 4
shl esi, 4
mov ecx, esi
or rcx, rax
movzx edx, byte [rcx + r15]
mov rcx, rbx
call fcn.18000d3a0
test al, al
je 0x18003817e
and edi, 0xf
shl edi, 2
movzx edx, byte [rdi + r15]
jmp 0x18003815a
movzx edi, byte [rbp + r12]
mov rcx, rbx
mov eax, edi
shr rax, 2
movzx edx, byte [rax + r15]
call fcn.18000d3a0
test al, al
je 0x18003817e
and edi, 3
mov rcx, rbx
shl edi, 4
movzx edx, byte [rdi + r15]
call fcn.18000d3a0
test al, al
je 0x18003817e
mov dl, 0x3d
mov rcx, rbx
call fcn.18000d3a0
test al, al
je 0x18003817e
mov dl, 0x3d
mov rcx, rbx
call fcn.18000d3a0
test al, al
je 0x18003817e
mov cl, 1
movzx eax, cl
jmp 0x180038080
xor cl, cl
movzx eax, cl
jmp 0x180038080
mov al, 1
jmp 0x180038098
mov r9, r8
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
jmp 0x180037f10
Function at 0x180038a79
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
je 0x180038b4b
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
xor r8d, r8d
movzx ecx, byte [rcx]
mov rdi, rdx
test cl, cl
je 0x180038b34
cmp cl, 0x2b
jne 0x180038ab3
mov byte [rsp + r8 + 0x20], 0x20
jmp 0x180038afb
cmp cl, 0x25
jne 0x180038af6
movzx eax, byte [rbx + 1]
test al, al
je 0x180038b22
movzx ecx, byte [rbx + 2]
add rbx, 2
test cl, cl
je 0x180038b22
cmp al, 0x41
movsx eax, al
jl 0x180038adb
and eax, 0x4f
sub eax, 0x37
jmp 0x180038ade
sub eax, 0x30
shl eax, 4
cmp cl, 0x41
movsx ecx, cl
jl 0x180038af1
and ecx, 0x4f
sub ecx, 0x37
jmp 0x180038af4
sub ecx, 0x30
add cl, al
mov byte [rsp + r8 + 0x20], cl
mov eax, r8d
inc r8d
cmp r8d, 0x32
jne 0x180038b17
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800135e0
xor r8d, r8d
movzx ecx, byte [rbx + 1]
inc rbx
test cl, cl
jne 0x180038aa6
test r8d, r8d
je 0x180038b34
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800135e0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800c9b90
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret

Function at 0x18003c710
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rax, qword [rcx + 0x10]
cmp rax, 0xffffffffffffffff
je 0x18003c7be
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp eax, 0xffffffff
jne 0x18003c7ba
test rdi, rdi
je 0x18003c7ba
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x30]
call fcn.1800cae70
lea rcx, [rsp + 0x30]
call fcn.18000ccc0
nop
lea rcx, [rsp + 0x30]
call fcn.18000e030
mov rbx, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.18000f9c0
mov rdx, rax
mov rcx, rdi
call qword [rbx + 0x28]
mov rax, qword [rdi]
lea rdx, str.Failed_to_get_file_size__32_
mov rcx, rdi
call qword [rax + 0x28]
nop
lea rcx, [rsp + 0x30]
call fcn.18000cd10
mov eax, esi
jmp 0x18003c7d8
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x18003c7d5
call fcn.1800d29b0
mov ecx, eax
call fcn.1800d2770
jmp 0x18003c7d8
or eax, 0xffffffff
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800c9b90
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18003c800
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x18003c8d4
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x18003c8c7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x18003c8c7
test rdi, rdi
je 0x18003c8f4
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x30]
call fcn.1800cae70
lea rcx, [rsp + 0x30]
call fcn.18000ccc0
nop
lea rcx, [rsp + 0x30]
call fcn.18000e030
mov rbx, qword [rdi]
lea rcx, [rsp + 0x30]
call fcn.18000f9c0
mov rdx, rax
mov rcx, rdi
call qword [rbx + 0x28]
mov rax, qword [rdi]
lea rdx, str.Failed_to_get_file_size__64_
mov rcx, rdi
call qword [rax + 0x28]
nop
lea rcx, [rsp + 0x30]
call fcn.18000cd10
jmp 0x18003c8f4
mov edx, dword [rsp + 0x28]
mov ecx, ebx
call fcn.18003c290
jmp 0x18003c8f8
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18003c8f4
call fcn.1800d296c
mov rcx, qword [rbx + 8]
call fcn.1800d29b0
mov ecx, eax
call fcn.1800d2778
jmp 0x18003c8f8
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800c9b90
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret
Function at 0x18003cab0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0xb0]
xor eax, eax
mov rbx, qword [rsp + 0xb8]
mov r12, r9
mov ebp, r8d
mov r14, rdx
mov r15, rcx
mov byte [rsi], 0
mov dword [r9], eax
test rdx, rdx
jne 0x18003cb12
test rbx, rbx
je 0x18003cb0b
mov rax, qword [rbx]
lea rdx, str.NULL_buf_pointer.
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
jmp 0x18003cc3e
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], r13
test r8d, r8d
je 0x18003cc32
mov r13d, 0x10000
nop dword [rax + rax]
cmp ebp, r13d
mov byte [rsi], 0
mov edi, ebp
mov dword [rsp + 0x30], eax
cmova edi, r13d
test edi, edi
je 0x18003cbf8
test r14, r14
je 0x18003cbf8
mov rcx, qword [r15 + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x18003cba9
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8d, edi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18003cb9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
jne 0x18003cb8a
mov byte [rsi], 1
mov al, 1
jmp 0x18003cc0f
test rbx, rbx
je 0x18003cc0d
mov edx, eax
mov rcx, rbx
call fcn.180039e60
jmp 0x18003cc0d
cmp dword [rsp + 0x30], 0
jne 0x18003cb83
mov byte [rsi], 1
mov al, 1
jmp 0x18003cc0f
mov r9, qword [r15 + 8]
test r9, r9
je 0x18003cbea
mov r8d, edi
mov edx, 1
mov rcx, r14
call fcn.1800d2c58
mov dword [rsp + 0x30], eax
cmp eax, edi
jne 0x18003cbce
mov al, 1
jmp 0x18003cc0f
mov rcx, qword [r15 + 8]
call fcn.1800d278c
test eax, eax
je 0x18003cb80
test rbx, rbx
je 0x18003cc0d
mov rcx, rbx
call fcn.180039d60
jmp 0x18003cc0d
test rbx, rbx
je 0x18003cc0d
lea rdx, str.No_file_is_open.
jmp 0x18003cc04
test rbx, rbx
je 0x18003cc0d
lea rdx, str.NULL_buf_or_bufSize
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x28]
xor al, al
mov ecx, dword [rsp + 0x30]
add dword [r12], ecx
sub ebp, ecx
add r14, rcx
test al, al
je 0x18003cc59
cmp byte [rsi], 0
jne 0x18003cc32
mov eax, 0
test ebp, ebp
jne 0x18003cb30
mov al, 1
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x58
pop r15
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret
xor al, al
jmp 0x18003cc34
Function at 0x18003cf90
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov r14, r9
mov rsi, qword [rsp + 0xb0]
mov rdi, r8
mov rbp, rdx
mov r15, rcx
jne 0x18003cfe9
cmp qword [rcx + 8], 0
jne 0x18003cfe9
test rsi, rsi
je 0x18003cfe2
mov rax, qword [rsi]
lea rdx, str.Failed_to_write_because_file_is_not_open.
mov rcx, rsi
call qword [rax + 0x28]
xor al, al
jmp 0x18003d0dc
mov qword [rsp + 0x48], r13
xor r13d, r13d
test r14, r14
je 0x18003cff9
mov qword [r9], r13
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], r12
test r8, r8
je 0x18003d0cb
mov edx, dword [rsp + 0x30]
mov r12d, 0x989680
nop word [rax + rax]
mov rcx, qword [r15 + 0x10]
cmp rdi, r12
mov ebx, edi
cmovg ebx, r12d
cmp rcx, 0xffffffffffffffff
je 0x18003d08b
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov r8d, ebx
mov qword [rsp + 0x20], r13
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18003d05a
mov edx, dword [rsp + 0x30]
cmp edx, ebx
je 0x18003d0b0
test rsi, rsi
je 0x18003d10a
mov rax, qword [rsi]
lea rdx, str.WriteFileError
mov r8b, 1
mov rcx, rsi
call qword [rax + 0x48]
mov rcx, rsi
call fcn.180039d60
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x50]
xor al, al
jmp 0x18003d0cd
mov r9, qword [r15 + 8]
test r9, r9
je 0x18003d0b0
mov edx, ebx
mov r8d, 1
mov rcx, rbp
call fcn.1800d3654
cmp rax, 1
jne 0x18003d0f5
mov edx, ebx
mov dword [rsp + 0x30], ebx
mov eax, ebx
add rbp, rax
sub rdi, rax
test r14, r14
je 0x18003d0c2
mov eax, edx
add qword [r14], rax
test rdi, rdi
jne 0x18003d020
mov al, 1
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov r13, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test rsi, rsi
je 0x18003d10a
mov rax, qword [rsi]
lea rdx, str.fwrite_failed.
mov rcx, rsi
call qword [rax + 0x28]
xor al, al
jmp 0x18003d0cd
Function at 0x18003da70
Capabilities:
Hash data using djb2

Disassembly:
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rdi, rcx
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x30]
call fcn.1800cae70
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.18000cc40
nop
cmp dword [rdi + 0x10], 0x6119a407
je 0x18003dad9
xor ecx, ecx
call fcn.18000a020
xor bl, bl
jmp 0x18003db59
lea rcx, [rsp + 0x30]
call fcn.18000f9c0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x18003db02
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x18003daf2
xor edx, edx
div dword [rdi + 0x14]
cmp edx, dword [rdi + 0x14]
jae 0x18003db51
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x18003db51
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x18003db51
call fcn.180092b10
mov rbx, rax
test rax, rax
je 0x18003db51
nop dword [rax + rax]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180092bd0
test al, al
jne 0x18003db53
mov rcx, rbx
call fcn.180092b70
mov rbx, rax
test rax, rax
jne 0x18003db30
xor ebx, ebx
test rbx, rbx
setne bl
lea rcx, [rsp + 0x30]
call fcn.18000cd10
movzx eax, bl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800c9b90
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop rdi
ret
Function at 0x18003db90
Capabilities:
Hash data using djb2

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rdi, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x18003dbdb
xor ecx, ecx
call fcn.18000a020
xor al, al
jmp 0x18003dcde
test rbx, rbx
je 0x18003dbd4
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x30]
call fcn.1800cae70
lea rcx, [rsp + 0x30]
call fcn.18000ccc0
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.18000d160
cmp dword [rdi + 0x10], 0x6119a407
je 0x18003dc1f
xor ecx, ecx
call fcn.18000a020
jmp 0x18003dccf
cmp qword [rdi + 0x18], 0
je 0x18003dccf
lea rcx, [rsp + 0x30]
call fcn.18000f9c0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x18003dc60
nop dword [rax]
nop word [rax + rax]
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x18003dc50
xor edx, edx
div dword [rdi + 0x14]
cmp edx, dword [rdi + 0x14]
jae 0x18003dc13
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x18003dccf
mov eax, edx
lea rsi, [rdx*8]
mov rcx, qword [rsi + rcx]
test rcx, rcx
je 0x18003dccf
call fcn.180092b10
mov rbx, rax
test rax, rax
je 0x18003dccf
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180092bd0
test al, al
jne 0x18003dcb6
mov rcx, rbx
call fcn.180092b70
mov rbx, rax
test rax, rax
jne 0x18003dc93
jmp 0x18003dccf
test rbx, rbx
je 0x18003dccf
mov rcx, qword [rdi + 0x18]
mov rdx, rbx
mov rcx, qword [rcx + rsi]
call fcn.180092c10
mov bl, 1
jmp 0x18003dcd1
xor bl, bl
lea rcx, [rsp + 0x30]
call fcn.18000cd10
movzx eax, bl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800c9b90
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18003dd10
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rbx, rcx
je 0x18003dd31
xor ecx, ecx
call fcn.18000a020
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rdx
call fcn.18000f9c0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x18003dd60
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x18003dd50
xor edx, edx
div dword [rbx + 0x14]
mov eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x18003df70
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10], 0x6119a407
mov rdi, rdx
mov rbx, rcx
je 0x18003df9d
xor ecx, ecx
call fcn.18000a020
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.18000f9c0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x18003dfd0
nop dword [rax]
nop dword [rax + rax]
imul eax, eax, 0x21
lea rcx, [rcx + 1]
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x18003dfc0
xor edx, edx
mov r8, rdi
div dword [rbx + 0x14]
mov rcx, rbx
call fcn.18003d9f0
test rax, rax
je 0x18003df90
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180092b40
Function at 0x18003e000
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xd0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp dword [rcx + 0x10], 0x6119a407
je 0x18003e046
xor ecx, ecx
call fcn.18000a020
xor al, al
jmp 0x18003e133
mov rcx, rsi
call fcn.1800130a0
test rdi, rdi
je 0x18003e03f
xor edx, edx
mov r8d, 0x90
lea rcx, [rsp + 0x30]
call fcn.1800cae70
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.18000cc40
nop
cmp dword [rbx + 0x10], 0x6119a407
je 0x18003e088
xor ecx, ecx
call fcn.18000a020
jmp 0x18003e124
lea rcx, [rsp + 0x30]
call fcn.18000f9c0
mov rcx, rax
mov eax, 0x1505
movsx edx, byte [rcx]
test edx, edx
je 0x18003e0b1
lea rcx, [rcx + 1]
imul eax, eax, 0x21
add eax, edx
movsx edx, byte [rcx]
test edx, edx
jne 0x18003e0a1
xor edx, edx
div dword [rbx + 0x14]
cmp edx, dword [rbx + 0x14]
jae 0x18003e124
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18003e124
mov eax, edx
mov rcx, qword [rcx + rdx*8]
test rcx, rcx
je 0x18003e124
call fcn.180092b10
mov rbx, rax
test rax, rax
je 0x18003e124
nop dword [rax]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180092bd0
test al, al
jne 0x18003e103
mov rcx, rbx
call fcn.180092b70
mov rbx, rax
test rax, rax
jne 0x18003e0e0
jmp 0x18003e124
test rbx, rbx
je 0x18003e124
mov rcx, rbx
call fcn.180092b40
test rax, rax
je 0x18003e124
mov rdx, rax
mov rcx, rsi
call fcn.18000ce80
mov bl, 1
jmp 0x18003e126
xor bl, bl
lea rcx, [rsp + 0x30]
call fcn.18000cd10
movzx eax, bl
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0xd0
pop rdi
pop rsi
pop rbx
ret

Function at 0x18003e150
Capabilities:
Hash data with md5

Disassembly:
lea rax, vtable._ckMd5.0
mov qword [rcx], rax
xor eax, eax
mov qword [rcx + 0x18], rax
mov rax, rcx
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
ret

Function at 0x18003ea90
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rbx
mov rbp, r8
mov dword [rcx + 0xc], 0xefcdab89
mov rdi, rdx
mov dword [rcx + 0x10], 0x98badcfe
mov rsi, rcx
mov dword [rcx + 0x14], 0x10325476
cmp dword [rdx + 0xc08], ebx
jbe 0x18003eaff
nop word [rax + rax]
mov r8d, dword [rdi + rbx*4 + 0x808]
mov rcx, rsi
mov rdx, qword [rdi + rbx*8 + 8]
call fcn.18003eef0
inc ebx
cmp ebx, dword [rdi + 0xc08]
jb 0x18003eae0
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18003edc0
Function at 0x18003eb20
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov rdi, r9
mov rbx, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
call fcn.18003eef0
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18003edc0

Function at 0x18003eb70
Capabilities:
Encrypt data using rc4 prga
Hash data with md5

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 8], 0x67452301
mov qword [rcx + 0x18], rax
mov rsi, rcx
mov dword [rcx + 0xc], 0xefcdab89
mov rbp, r8
mov dword [rcx + 0x10], 0x98badcfe
mov rdi, rdx
mov dword [rcx + 0x14], 0x10325476
mov rcx, rdx
call fcn.180015e00
mov rcx, rdi
mov ebx, eax
call fcn.180015b30
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
call fcn.18003eef0
mov rdx, rbp
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18003edc0

Function at 0x18003ebf0
Capabilities:
Hash data with md5

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x18017a408]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r13, qword [rsp + 0xb0]
mov r15, rcx
mov r14, qword [rsp + 0xb8]
xor r12d, r12d
mov qword [rcx + 0x18], r12
mov rsi, r9
mov dword [rcx + 8], 0x67452301
mov rdi, r8
mov dword [rcx + 0xc], 0xefcdab89
mov rbp, rdx
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov ecx, 0x4e28
call fcn.18002b230
mov rbx, rax
test rax, rax
je 0x18003ed1e
mov dword [rsp + 0x30], r12d
mov rcx, rbp
mov r12b, 1
call fcn.180093240
test al, al
jne 0x18003ed07
nop dword [rax]
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x30]
mov r8d, 0x4e20
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov rcx, rbp
call fcn.180093270
test al, al
je 0x18003ed07
mov r8d, dword [rsp + 0x30]
test r8d, r8d
je 0x18003ece6
test r14, r14
je 0x18003ecc3
mov rdx, rbx
mov rcx, r14
call fcn.1800135e0
mov r8d, dword [rsp + 0x30]
mov rdx, rbx
mov rcx, r15
call fcn.18003eef0
test rdi, rdi
je 0x18003ece6
mov edx, dword [rsp + 0x30]
mov r8, rsi
mov rcx, rdi
call fcn.180050350
test al, al
jne 0x18003ecf4
mov rcx, rbp
call fcn.180093240
test al, al
je 0x18003ec80
jmp 0x18003ed07
mov rax, qword [rsi]
lea rdx, str.Digest_MD5_aborted_by_application
mov rcx, rsi
call qword [rax + 0x28]
xor r12b, r12b
mov rcx, rbx
call fcn.1800c96f4
mov rdx, r13
mov rcx, r15
call fcn.18003edc0
movzx eax, r12b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800c9b90
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret