joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180191c70
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x48], rsi
mov rdi, rcx
mov rsi, qword [rcx + 8]
mov rbp, r9
sub rsi, rcx
mov r14, r8
sub rsi, 0x10
mov ecx, 0x2000000
sar rsi, 2
mov r15d, edx
call fcn.1801abdc0
test eax, eax
je 0x180191cc1
mov rcx, rdi
shr rcx, 2
and ecx, 3
je 0x180191cc1
mov eax, 4
sub eax, ecx
jmp 0x180191cc3
xor eax, eax
cmp eax, esi
je 0x180191cfb
mov qword [rsp + 0x40], rbx
mov ebx, eax
mov eax, dword [rdi]
add rbx, 4
inc eax
shl eax, 4
movsxd r8, eax
mov eax, esi
lea rbx, [rdi + rbx*4]
add rax, 4
mov rcx, rbx
lea rdx, [rdi + rax*4]
call sub.VCRUNTIME140.dll_memmove
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x40]
mov ecx, 0x2000000
call fcn.1801abdc0
mov rsi, qword [rsp + 0x48]
mov rcx, rdi
test eax, eax
je 0x180191d2d
mov r9, rbp
mov r8, r14
mov edx, r15d
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.1801aba50
mov r8, rbp
mov rdx, r14
cmp r15d, 1
jne 0x180191d4c
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.180193bd0
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.1801933e0
Function at 0x1801a8170
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x18022bc40]
mov r14, rdx
mov rcx, rbx
test rsi, rsi
je 0x1801a81ce
cmp qword [0x18022bc40], 0
je 0x1801a81ce
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x1801a81c1
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1801a81e9
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x1801a81a8
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
test rbx, rbx
je 0x1801a81ce
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
xor eax, eax
jmp 0x1801a81d3

Function at 0x1801a82a0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov rsi, rcx
lea rbx, [0x18022ba10]
mov r14, r8
mov r15, rdx
mov rcx, rbx
test rsi, rsi
je 0x1801a8306
cmp qword [0x18022ba10], 0
je 0x1801a8306
mov rdi, qword [rsi + 8]
cmp qword [rcx + 8], rdi
jne 0x1801a82f9
mov rdx, qword [rsi + 0x10]
mov r8, rdi
mov rcx, qword [rcx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1801a8326
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x1801a82e0
mov eax, 0xffffffd2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
test rbx, rbx
je 0x1801a8306
mov eax, dword [rbx + 0x20]
mov dword [r15], eax
mov eax, dword [rbx + 0x24]
mov dword [r14], eax
xor eax, eax
jmp 0x1801a830b
Function at 0x1801aafc0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
xor eax, eax
movabs r8, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
test edx, edx
mov qword [rcx + 8], rax
movabs rax, 0x6a09e667f3bcc908
cmovne rax, r8
movabs r8, 0x629a292a367cd507
mov qword [rcx + 0x10], rax
movabs rax, 0xbb67ae8584caa73b
cmovne rax, r8
movabs r8, 0x9159015a3070dd17
mov qword [rcx + 0x18], rax
movabs rax, 0x3c6ef372fe94f82b
cmovne rax, r8
movabs r8, 0x152fecd8f70e5939
mov qword [rcx + 0x20], rax
movabs rax, 0xa54ff53a5f1d36f1
cmovne rax, r8
movabs r8, 0x67332667ffc00b31
mov qword [rcx + 0x28], rax
movabs rax, 0x510e527fade682d1
cmovne rax, r8
movabs r8, 0x8eb44a8768581511
mov qword [rcx + 0x30], rax
movabs rax, 0x9b05688c2b3e6c1f
cmovne rax, r8
movabs r8, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x38], rax
movabs rax, 0x1f83d9abfb41bd6b
cmovne rax, r8
movabs r8, 0x47b5481dbefa4fa4
mov qword [rcx + 0x40], rax
movabs rax, 0x5be0cd19137e2179
cmovne rax, r8
mov qword [rcx + 0x48], rax
xor eax, eax
mov dword [rcx + 0xd0], edx
ret
Function at 0x1801ab290
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm1, xmmword [rdx]
aeskeygenassist xmm0, xmm1, 1
pshufd xmm3, xmm0, 0xff
xorps xmm3, xmm1
movups xmmword [rcx], xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x10], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x20], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x30], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x40], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x50], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x60], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
movdqa xmm3, xmm2
xorps xmm0, xmm1
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x70], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm2, xmm3
xorps xmm2, xmm0
pslldq xmm3, 4
xorps xmm2, xmm3
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm2
movdqu xmmword [rcx + 0x80], xmm2
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
xorps xmm0, xmm1
movdqa xmm3, xmm2
xorps xmm3, xmm0
pslldq xmm2, 4
xorps xmm3, xmm2
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
xorps xmm1, xmm3
movdqu xmmword [rcx + 0x90], xmm3
pslldq xmm3, 4
movdqa xmm0, xmm3
pslldq xmm3, 4
xorps xmm0, xmm1
movdqa xmm1, xmm3
xorps xmm1, xmm0
pslldq xmm3, 4
xorps xmm1, xmm3
movdqu xmmword [rcx + 0xa0], xmm1
ret
Function at 0x1801aba50
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [r8]
mov rax, qword [rcx + 8]
mov r8d, dword [rcx]
dec r8d
xorps xmm0, xmmword [rax]
add rax, 0x10
test edx, edx
jne 0x1801aba8b
test r8d, r8d
je 0x1801aba7f
nop
aesdec xmm0, xmmword [rax]
add rax, 0x10
add r8d, 0xffffffff
jne 0x1801aba70
aesdeclast xmm0, xmmword [rax]
movups xmmword [r9], xmm0
xor eax, eax
ret
test r8d, r8d
je 0x1801aba9f
aesenc xmm0, xmmword [rax]
add rax, 0x10
add r8d, 0xffffffff
jne 0x1801aba90
aesenclast xmm0, xmmword [rax]
movups xmmword [r9], xmm0
xor eax, eax
ret

Function at 0x1801abe30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movsxd rax, r8d
shl rax, 4
add rax, rdx
movdqu xmm0, xmmword [rax]
sub rax, 0x10
movdqu xmmword [rcx], xmm0
add rcx, 0x10
cmp rax, rdx
jbe 0x1801abe66
nop
aesimc xmm0, xmmword [rax]
sub rax, 0x10
movdqu xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
cmp rax, rdx
ja 0x1801abe50
movdqu xmm0, xmmword [rax]
movdqu xmmword [rcx], xmm0
ret
Function at 0x1801b1f00
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
xor eax, eax
mov r8d, 0xc1059ed8
mov qword [rcx], rax
test edx, edx
mov eax, 0x6a09e667
cmovne eax, r8d
mov r8d, 0x367cd507
mov dword [rcx + 8], eax
mov eax, 0xbb67ae85
cmovne eax, r8d
mov r8d, 0x3070dd17
mov dword [rcx + 0xc], eax
mov eax, 0x3c6ef372
cmovne eax, r8d
mov r8d, 0xf70e5939
mov dword [rcx + 0x10], eax
mov eax, 0xa54ff53a
cmovne eax, r8d
mov r8d, 0xffc00b31
mov dword [rcx + 0x14], eax
mov eax, 0x510e527f
cmovne eax, r8d
mov r8d, 0x68581511
mov dword [rcx + 0x18], eax
mov eax, 0x9b05688c
cmovne eax, r8d
mov r8d, 0x64f98fa7
mov dword [rcx + 0x1c], eax
mov eax, 0x1f83d9ab
cmovne eax, r8d
mov r8d, 0xbefa4fa4
mov dword [rcx + 0x20], eax
mov eax, 0x5be0cd19
cmovne eax, r8d
mov dword [rcx + 0x24], eax
xor eax, eax
mov dword [rcx + 0x68], edx
ret
Function at 0x1801b35d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r15
mov rax, qword [rdx + 8]
mov r15, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 8], rax
je 0x1801b35f9
mov eax, 0xfffffffc
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov r11d, dword [rcx]
mov eax, dword [rdx]
sar eax, 1
mov qword [rsp + 0x18], rbx
and eax, 1
sar r11d, 1
and r11d, 1
mov qword [rsp + 0x28], r14
xor eax, r11d
mov ebx, eax
and ebx, r11d
mov dword [r8], ebx
mov r14, qword [rcx + 8]
test r14, r14
je 0x1801b36f0
mov qword [rsp + 0x20], rbp
mov ebp, 1
sub ebp, r11d
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov r10d, 1
sub r10d, eax
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
and ecx, r8d
shr r9, 0x3f
and r9d, edx
or r9d, ecx
and r10d, r9d
or eax, r9d
and r10d, r11d
or r10d, ebx
mov ebx, 1
mov dword [r15], r10d
sub ebx, eax
mov rcx, qword [rsi + 0x10]
and ebx, ebp
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
shr r9, 0x3f
and ecx, r8d
and r9d, edx
or r9d, ecx
and ebx, r9d
or eax, r9d
or ebx, r10d
mov dword [r15], ebx
sub r14, 1
jne 0x1801b3640
mov rbp, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret

Function at 0x1801b8220
Capabilities:
Encode data using add xor sub operations
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rcx]
mov r10, rcx
mov ebx, dword [rcx + 4]
test rdx, rdx
je 0x1801b8282
sub r8, r9
nop word [rax + rax]
lea eax, [r11 + 1]
movzx r11d, al
lea r9, [r9 + 1]
movzx ecx, byte [r11 + r10 + 8]
lea eax, [rbx + rcx]
movzx ebx, al
movzx eax, byte [rbx + r10 + 8]
mov byte [r11 + r10 + 8], al
add al, cl
mov byte [rbx + r10 + 8], cl
movzx eax, al
movzx ecx, byte [rax + r10 + 8]
xor cl, byte [r9 + r8 - 1]
mov byte [r9 - 1], cl
sub rdx, 1
jne 0x1801b8240
mov dword [r10 + 4], ebx
xor eax, eax
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret
Function at 0x1801b8dc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
xor r15d, r15d
mov r12, r9
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
test rdx, rdx
je 0x1801b8e1e
mov r10, rbx
mov rcx, r9
sub r10, r9
mov rdx, qword [rdi + 0x80]
cmp rdx, 0x40
jae 0x1801b8e1e
movzx eax, byte [r10 + rcx]
inc r15
xor al, byte [rdx + rdi + 0x40]
mov byte [rcx], al
inc rcx
inc qword [rdi + 0x80]
sub rbp, 1
jne 0x1801b8df3
lea rsi, [rdi + 0x40]
cmp rbp, 0x40
jb 0x1801b8f29
mov qword [rsp + 0x60], r13
mov r12, rbp
mov qword [rsp + 0x20], r14
mov r13, rbx
shr r12, 6
lea rbx, [r9 + 1]
imul rax, r12, 0xffffffffffffffc0
mov r14, rdi
sub r13, r9
sub r14, r15
add rbp, rax
sub r14, r9
mov rax, r12
shl rax, 6
add rbx, r15
add r14, 0x40
add r15, rax
nop dword [rax + rax]
mov rdx, rsi
mov rcx, rdi
call fcn.1801b85f0
inc dword [rdi + 0x30]
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rbx - 1]
xor al, byte [rbx + r13 - 1]
mov byte [rbx - 1], al
movzx eax, byte [r14 + rbx]
xor al, byte [rbx + r13]
mov byte [rbx], al
movzx eax, byte [r14 + rbx + 1]
xor al, byte [rbx + r13 + 1]
mov byte [rbx + 1], al
movzx eax, byte [r14 + rbx + 2]
xor al, byte [rbx + r13 + 2]
mov byte [rbx + 2], al
movzx eax, byte [r14 + rbx + 3]
xor al, byte [rbx + r13 + 3]
mov byte [rbx + 3], al
movzx eax, byte [r14 + rbx + 4]
xor al, byte [rbx + r13 + 4]
mov byte [rbx + 4], al
movzx eax, byte [r14 + rbx + 5]
xor al, byte [rbx + r13 + 5]
mov byte [rbx + 5], al
movzx eax, byte [r14 + rbx + 6]
xor al, byte [rbx + r13 + 6]
mov byte [rbx + 6], al
add rbx, 8
sub rcx, 1
jne 0x1801b8e90
sub r14, 0x40
sub r12, 1
jne 0x1801b8e70
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test rbp, rbp
je 0x1801b8f6d
mov rdx, rsi
mov rcx, rdi
call fcn.1801b85f0
inc dword [rdi + 0x30]
mov rcx, rbp
sub r15, rdi
lea rdx, [r15 + rbx]
lea r8, [r15 + r12]
nop word [rax + rax]
movzx eax, byte [rsi + rdx - 0x40]
xor al, byte [rsi]
mov byte [r8 + rsi - 0x40], al
lea rsi, [rsi + 1]
sub rcx, 1
jne 0x1801b8f50
mov qword [rdi + 0x80], rbp
xor eax, eax
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801b9590
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1802b7c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rbx, rcx
movups xmmword [rsp + 0x38], xmm0
call fcn.1801b7ea0
test eax, eax
jne 0x1801b978a
movzx eax, byte [rsp + 0x39]
movzx ecx, byte [rsp + 0x3c]
shl ecx, 8
mov qword [rsp + 0x68], rbp
mov ebp, 2
mov qword [rsp + 0x70], rsi
movzx esi, byte [rsp + 0x40]
mov qword [rsp + 0x78], rdi
movzx edi, byte [rsp + 0x38]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [rsp + 0x3a]
shl edi, 8
or edi, eax
movzx eax, byte [rsp + 0x3b]
shl edi, 8
or rdi, rax
movzx eax, byte [rsp + 0x3d]
or ecx, eax
shl rdi, 0x20
movzx eax, byte [rsp + 0x3e]
shl ecx, 8
or eax, ecx
movzx ecx, byte [rsp + 0x44]
shl eax, 8
or rdi, rax
shl ecx, 8
movzx eax, byte [rsp + 0x3f]
or rdi, rax
movzx eax, byte [rsp + 0x41]
or esi, eax
mov qword [rbx + 0x118], rdi
movzx eax, byte [rsp + 0x42]
shl esi, 8
or esi, eax
movzx eax, byte [rsp + 0x43]
shl esi, 8
or rsi, rax
movzx eax, byte [rsp + 0x45]
or ecx, eax
shl rsi, 0x20
movzx eax, byte [rsp + 0x46]
shl ecx, 8
or eax, ecx
mov ecx, ebp
shl eax, 8
or rsi, rax
movzx eax, byte [rsp + 0x47]
or rsi, rax
mov qword [rbx + 0x98], rsi
call fcn.1801abdc0
test eax, eax
jne 0x1801b9779
mov qword [rbx + 0xd8], 0
mov qword [rbx + 0x58], 0
mov r8d, 4
nop dword [rax + rax]
mov eax, esi
mov rcx, rdi
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, rsi
shr rax, 1
mov rsi, rcx
or rsi, rax
mov rax, rdi
shr rax, 1
mov qword [rbx + r8*8 + 0x58], rsi
mov ecx, edx
shl rcx, 0x20
mov rdi, rcx
xor rdi, rax
mov qword [rbx + r8*8 + 0xd8], rdi
shr r8d, 1
jne 0x1801b96d0
mov r8, rbp
nop word [rax + rax]
mov r9, qword [rbx + r8*8 + 0xd8]
mov r10, qword [rbx + r8*8 + 0x58]
cmp r8, 1
jle 0x1801b9768
lea rax, [rbx + 0x60]
lea rdx, [r8 - 1]
nop dword [rax + rax]
mov rcx, r9
xor rcx, qword [rax + 0x80]
mov qword [rax + r8*8 + 0x80], rcx
lea rax, [rax + 8]
mov rcx, r10
xor rcx, qword [rax - 8]
mov qword [rax + r8*8 - 8], rcx
sub rdx, 1
jne 0x1801b9740
lea eax, [rbp*2]
add r8, r8
mov ebp, eax
cmp eax, 8
jle 0x1801b9720
mov rdi, qword [rsp + 0x78]
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801fc6e0
add rsp, 0x50
pop rbx
ret
Function at 0x1801b9f50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, qword [rcx + 0x158]
lea rax, [r8 - 4]
mov rbp, qword [rcx + 0x160]
mov rsi, r8
shl r14, 3
mov rbx, rdx
shl rbp, 3
mov rdi, rcx
cmp rax, 0xc
ja 0x1801ba0a8
lea rdx, [rcx + 0x168]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
test r14, r14
jne 0x1801b9fb4
test rbp, rbp
je 0x1801ba0a4
lea rdx, [rdi + 0x188]
mov rax, rbp
shr rax, 0x38
mov r8, rdx
xor byte [rdx], al
mov rcx, rdi
mov rax, rbp
shr rax, 0x30
xor byte [rdi + 0x189], al
mov rax, rbp
shr rax, 0x28
xor byte [rdi + 0x18a], al
mov rax, rbp
shr rax, 0x20
xor byte [rdi + 0x18b], al
mov rax, rbp
shr rax, 0x18
xor byte [rdi + 0x18c], al
mov rax, rbp
shr rax, 0x10
xor byte [rdi + 0x18d], al
mov rax, rbp
shr rax, 8
xor byte [rdi + 0x18e], al
mov rax, r14
xor byte [rdi + 0x18f], bpl
shr rax, 0x38
xor byte [rdi + 0x190], al
mov rax, r14
shr rax, 0x30
xor byte [rdi + 0x191], al
mov rax, r14
shr rax, 0x28
xor byte [rdi + 0x192], al
mov rax, r14
shr rax, 0x20
xor byte [rdi + 0x193], al
mov rax, r14
shr rax, 0x18
xor byte [rdi + 0x194], al
mov rax, r14
shr rax, 0x10
xor byte [rdi + 0x195], al
mov rax, r14
shr rax, 8
xor byte [rdi + 0x196], al
xor byte [rdi + 0x197], r14b
call fcn.1801b97a0
test rsi, rsi
je 0x1801ba0a4
sub rdi, rbx
nop
movzx eax, byte [rdi + rbx + 0x188]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rsi, 1
jne 0x1801ba090
xor eax, eax
jmp 0x1801ba0ad
mov eax, 0xffffffec
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1801be5d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx r10d, byte [r8 + 1]
mov rbx, rcx
movzx ecx, byte [r8 + 5]
mov r11d, edx
movzx eax, byte [r8]
mov r14, r9
movzx edi, byte [r8 + 4]
movzx edx, byte [r8 + 3]
shl eax, 8
shl edi, 8
or eax, r10d
movzx r10d, byte [r8 + 2]
or edi, ecx
movzx ecx, byte [r8 + 6]
shl eax, 8
shl edi, 8
or eax, r10d
or edi, ecx
shl eax, 8
movzx ecx, byte [r8 + 7]
or eax, edx
shl edi, 8
or edi, ecx
test r11d, r11d
mov r11d, reloc.WS2_32.dll_recv
jne 0x1801be6a3
lea rsi, [rbx + 0x44]
nop dword [rax]
nop word [rax + rax]
xor eax, dword [rsi]
lea rsi, [rsi - 4]
mov ecx, eax
mov r10d, eax
shr ecx, 8
movzx r9d, cl
shr ecx, 8
mov edx, ecx
shr rdx, 8
movzx ecx, cl
mov r8d, dword [rbx + rdx*4 + 0x48]
add r8d, dword [rbx + rcx*4 + 0x448]
xor r8d, dword [rbx + r9*4 + 0x848]
movzx ecx, al
mov eax, r8d
add eax, dword [rbx + rcx*4 + 0xc48]
xor eax, edi
mov edi, r10d
sub r11, 1
jne 0x1801be650
xor r10d, dword [rbx]
xor eax, dword [rbx + 4]
jmp 0x1801be702
mov rsi, rbx
nop word [rax + rax]
xor eax, dword [rsi]
lea rsi, [rsi + 4]
mov ecx, eax
mov r10d, eax
shr ecx, 8
movzx r9d, cl
shr ecx, 8
mov edx, ecx
shr rdx, 8
movzx ecx, cl
mov r8d, dword [rbx + rdx*4 + 0x48]
add r8d, dword [rbx + rcx*4 + 0x448]
xor r8d, dword [rbx + r9*4 + 0x848]
movzx ecx, al
mov eax, r8d
add eax, dword [rbx + rcx*4 + 0xc48]
xor eax, edi
mov edi, r10d
sub r11, 1
jne 0x1801be6b0
xor r10d, dword [rbx + 0x44]
xor eax, dword [rbx + 0x40]
mov rbx, qword [rsp + 8]
mov ecx, r10d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
shr ecx, 0x18
mov byte [r14], cl
mov ecx, r10d
shr ecx, 0x10
mov byte [r14 + 1], cl
mov ecx, r10d
shr ecx, 8
mov byte [r14 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r14 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r14 + 5], cl
mov ecx, eax
mov byte [r14 + 7], al
xor eax, eax
shr ecx, 8
mov byte [r14 + 6], cl
mov byte [r14 + 3], r10b
mov r14, qword [rsp + 0x20]
ret
Function at 0x1801c1010
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x70]
add rcx, 0x4ac
call fcn.1801acc10
mov rcx, qword [rbx + 0x70]
add rcx, 0x504
call fcn.1801aef50
mov rcx, qword [rbx + 0x70]
xor edx, edx
add rcx, 0x560
call fcn.1801b1f00
mov rcx, qword [rbx + 0x70]
mov edx, 1
add rcx, 0x5d0
add rsp, 0x20
pop rbx
jmp fcn.1801aafc0
Function at 0x1801e2170
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 8
mov r10, rdx
mov r9, rcx
cmp rdx, 0x10
jb 0x1801e2219
mov qword [rsp], rbx
lea r11d, [r8 - 0x7a143589]
lea rbx, [rdx - 0xf]
add rbx, rcx
lea edx, [r8 + 0x24234428]
lea eax, [r8 + 0x61c8864f]
imul ecx, dword [r9], 0x7a143589
sub edx, ecx
imul ecx, dword [r9 + 4], 0x7a143589
rol edx, 0xd
imul edx, edx, 0x9e3779b1
sub r11d, ecx
imul ecx, dword [r9 + 8], 0x7a143589
rol r11d, 0xd
imul r11d, r11d, 0x9e3779b1
sub r8d, ecx
imul ecx, dword [r9 + 0xc], 0x7a143589
rol r8d, 0xd
add r9, 0x10
imul r8d, r8d, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp r9, rbx
jb 0x1801e21a4
mov rbx, qword [rsp]
rol eax, 0x12
rol r8d, 0xc
add eax, r8d
rol r11d, 7
add eax, r11d
rol edx, 1
add eax, edx
jmp 0x1801e2220
lea eax, [r8 + 0x165667b1]
add eax, r10d
and r10d, 0xf
cmp r10, 4
jb 0x1801e225e
mov r8d, r10d
shr r8, 2
imul rcx, r8, 0xfffffffffffffffc
add r10, rcx
nop dword [rax + rax]
mov ecx, dword [r9]
add r9, 4
imul edx, ecx, 0x3d4d51c3
sub eax, edx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
sub r8, 1
jne 0x1801e2240
test r10, r10
je 0x1801e228f
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
imul edx, ecx, 0x165667b1
add eax, edx
rol eax, 0xb
imul eax, eax, 0x9e3779b1
sub r10, 1
jne 0x1801e2270
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul edx, ecx, 0xc2b2ae3d
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 8
ret

Function at 0x1801e9c10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
cmp rbx, 0x20
jb 0x1801e9ced
mov rdx, qword [rcx + 8]
mov r9, qword [rcx + 0x18]
mov rax, rdx
mov r8, qword [rcx + 0x10]
mov r11, r9
mov r10, qword [rcx + 0x20]
rol r11, 0xc
rol rax, 1
add r11, rax
mov qword [rsp + 0x30], rsi
movabs rsi, 0x9e3779b185ebca87
mov qword [rsp + 0x38], rdi
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, r8
rol rax, 7
add r11, rax
mov rax, r10
imul rdx, rdi
imul r8, rdi
imul r10, rdi
imul r9, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
imul rdx, rsi
movabs rax, 0x7a1435883d4d519d
rol r8, 0x1f
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r8, rsi
imul r10, rsi
sub r11, rax
rol r9, 0x1f
xor r11, r8
imul r11, rsi
imul r9, rsi
sub r11, rax
xor r11, r9
imul r11, rsi
sub r11, rax
xor r11, r10
movabs r10, 0x85ebca77c2b2ae63
imul r11, rsi
mov rsi, qword [rsp + 0x30]
add r10, r11
jmp 0x1801e9cfe
mov r10, qword [rcx + 0x18]
movabs rdx, 0x27d4eb2f165667c5
add r10, rdx
add r10, rbx
lea rdx, [rcx + 0x28]
mov rcx, r10
xor r9d, r9d
mov r8, rbx
add rsp, 0x20
pop rbx
jmp 0x1801e9990