joyce8/EMBER2024-capa huggingface dataset:
Function at 0x24a4c
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, dword [rcx + 0x1c]
mov edi, dword [rcx]
mov ebp, dword [rcx + 4]
mov r12d, dword [rcx + 8]
mov r15d, dword [rcx + 0xc]
mov esi, dword [rcx + 0x10]
mov r13d, dword [rcx + 0x14]
mov r14d, dword [rcx + 0x18]
lea r11, [rcx + 0x20]
mov dword [rsp + 0x40], eax
mov r8, r11
mov r10d, 0x10
mov ecx, dword [r8]
mov edx, ecx
mov eax, ecx
shr eax, 0x10
and edx, 0xff0000
or edx, eax
mov eax, ecx
shl ecx, 0x10
and eax, 0xff00
shr edx, 8
or eax, ecx
shl eax, 8
or edx, eax
mov dword [r8], edx
add r8, 4
sub r10, 1
jne 0x24a91
lea r10, [r11 + 0x38]
mov ebx, 0x30
mov ecx, dword [r10]
mov edx, dword [r10 - 0x34]
add r10, 4
mov r8d, ecx
mov eax, ecx
shr ecx, 0xa
rol r8d, 0xf
rol eax, 0xd
xor r8d, eax
mov eax, edx
xor r8d, ecx
mov ecx, edx
shr edx, 3
rol ecx, 0xe
ror eax, 7
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r10 - 0x3c]
add r8d, dword [r10 - 0x18]
sub rbx, 1
mov dword [r10 + 4], r8d
jne 0x24acd
mov r9d, dword [rsp + 0x40]
lea r10, [0x00045110]
mov ebx, 0x40
sub r11, r10
mov r8d, esi
mov eax, esi
mov ecx, esi
ror r8d, 0xb
rol eax, 7
not ecx
xor r8d, eax
and ecx, r14d
mov eax, esi
ror eax, 6
mov edx, edi
xor r8d, eax
mov eax, r13d
and eax, esi
or ecx, eax
mov eax, edi
add r8d, ecx
mov ecx, ebp
add r8d, dword [r11 + r10]
or ecx, edi
add r8d, dword [r10]
and ecx, r12d
add r10, 4
add r8d, r9d
ror edx, 0xd
rol eax, 0xa
xor edx, eax
mov eax, edi
mov r9d, r14d
ror eax, 2
mov r14d, r13d
mov r13d, esi
xor edx, eax
mov eax, ebp
lea esi, [r8 + r15]
and eax, edi
mov r15d, r12d
mov r12d, ebp
or ecx, eax
mov ebp, edi
add edx, ecx
sub rbx, 1
lea edi, [rdx + r8]
jne 0x24b27
mov rbx, qword [rsp + 0x48]
mov dword [rsp + 0x40], r9d
mov r9, qword [rsp + 0x38]
add dword [r9 + 4], ebp
mov eax, dword [rsp + 0x40]
add dword [r9], edi
add dword [r9 + 8], r12d
add dword [r9 + 0xc], r15d
add dword [r9 + 0x10], esi
add dword [r9 + 0x14], r13d
add dword [r9 + 0x18], r14d
mov rbp, qword [rsp + 0x50]
add dword [r9 + 0x1c], eax
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x272f8
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x53534c4d
mov edx, 0x70
mov r8d, esi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x3e8], rax
test rax, rax
jne 0x27330
mov eax, 0x64
jmp 0x27436
and qword [rax + 0x58], 0
and qword [rax + 0x60], 0
mov dword [rax], 0x67452301
mov dword [rax + 4], 0xefcdab89
mov dword [rax + 8], 0x98badcfe
mov dword [rax + 0xc], 0x10325476
mov dword [rax + 0x10], 0xc3d2e1f0
mov eax, 0x302
xor ecx, ecx
mov r8d, esi
cmp word [rbx + 0x37e], ax
ja 0x273c1
lea edx, [rcx + 0x70]
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbx + 0x3e0], rax
test rax, rax
jne 0x2739a
mov rcx, qword [rbx + 0x3e8]
test rcx, rcx
je 0x27326
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x27326
and qword [rax + 0x50], 0
and qword [rax + 0x58], 0
mov dword [rax], 0x67452301
mov dword [rax + 4], 0xefcdab89
mov dword [rax + 8], 0x98badcfe
mov dword [rax + 0xc], 0x10325476
jmp 0x273f3
mov rax, qword [rbx + 0x3a8]
mov rdx, qword [rax + 0x18]
and rdx, 0xfffffffffffffff0
add rdx, 0x10
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rcx, rax
mov qword [rbx + 0x3f0], rax
test rax, rax
je 0x27384
mov rax, qword [rbx + 0x3a8]
call qword [rax + 0x38]
cmp dword [rbx + 0x10], 0
jne 0x27434
mov rdx, qword [rbx + 0x7f8]
movzx r8d, byte [rdx + 6]
movzx eax, byte [rdx + 7]
add rdx, 5
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 3]
shl r8d, 8
or r8, rax
cmp r8, 0x8000
ja 0x27434
add r8, 4
mov rcx, rbx
call fcn.00027448
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x287fc
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rdi, r8
mov r12, rdx
mov rbp, rcx
test rdx, rdx
je 0x28994
test r8, r8
je 0x28994
test rbx, rbx
je 0x28994
mov rsi, qword [rsp + 0x60]
test rsi, rsi
je 0x28994
mov rdx, qword [rcx + 0x248]
mov rcx, qword [rcx + 0x240]
mov r15d, 9
lea r8, [0x000445c0]
mov r9, r15
call fcn.000326a8
lea r14d, [r15 - 8]
test eax, eax
jne 0x2887f
mov dword [r12], r14d
jmp 0x288a4
mov rcx, qword [rbp + 0x240]
lea r8, [0x00041a18]
mov r9d, 7
call fcn.000326a8
test eax, eax
jne 0x288a9
mov dword [r12], 2
and dword [rsi], 0
jmp 0x288e1
mov rcx, qword [rbp + 0x240]
lea r8, [0x000445b0]
call fcn.000326a8
test eax, eax
jne 0x2898d
mov rdx, qword [rbp + 0x2b8]
mov rcx, qword [rbp + 0x2b0]
mov dword [r12], 0x40
call fcn.00028ab0
mov dword [rsi], eax
mov rsi, qword [rbp + 0x2d8]
test rsi, rsi
je 0x2898d
mov rdx, qword [rbp + 0x2e0]
test rdx, rdx
je 0x2898d
lea r8, [0x000445d0]
mov r9, r15
mov rcx, rsi
call fcn.000326a8
test eax, eax
jne 0x2891c
mov dword [rbx], r14d
jmp 0x28986
lea r8, [0x000445e0]
mov rcx, rsi
call fcn.000326a8
test eax, eax
jne 0x28937
mov dword [rbx], 2
jmp 0x28986
lea r8, [0x000445f0]
mov rcx, rsi
call fcn.000326a8
test eax, eax
jne 0x28952
mov dword [rbx], 4
jmp 0x28986
lea r8, [0x00044600]
mov rcx, rsi
call fcn.000326a8
test eax, eax
jne 0x2896d
mov dword [rbx], 5
jmp 0x28986
lea r8, [0x00044610]
mov rcx, rsi
call fcn.000326a8
test eax, eax
jne 0x2898d
mov dword [rbx], 6
mov dword [rdi], r14d
xor eax, eax
jmp 0x28999
mov eax, 0x210
jmp 0x28999
mov eax, 2
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x2d4d0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rdi, r8
lea r8, [rsp + 0x28]
mov rbx, r9
call fcn.000326f4
test eax, eax
jne 0x2d688
cmp dword [rsp + 0x28], 1
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
je 0x2d510
mov eax, 0xf0
jmp 0x2d688
cmp dword [rsp + 0x2c], 0
je 0x2d521
mov eax, 0xeb
jmp 0x2d688
cmp dword [rsp + 0x30], 0x10
je 0x2d532
mov eax, 0xe9
jmp 0x2d688
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, rsi
mov r9, rbx
call fcn.0002d6a0
test eax, eax
jne 0x2d688
mov rax, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
sub rdi, rax
lea rcx, [rax + rsi]
mov rdx, rdi
call fcn.000326f4
test eax, eax
jne 0x2d688
cmp dword [rsp + 0x28], eax
jne 0x2d506
cmp dword [rsp + 0x2c], eax
jne 0x2d517
cmp dword [rsp + 0x30], 3
jne 0x2d528
mov rdi, qword [rsp + 0x38]
cmp rdi, 1
jb 0x2d683
mov rsi, qword [rsp + 0x40]
cmp byte [rsi], al
jne 0x2d683
mov rdx, qword [rbx + 0x248]
mov rcx, qword [rbx + 0x240]
lea r9d, [rax + 9]
lea r8, [0x000445c0]
call fcn.000326a8
test eax, eax
jne 0x2d5de
lea rdx, [rdi - 1]
lea rcx, [rsi + 1]
mov r8, rbx
call fcn.0002d834
jmp 0x2d688
mov rcx, qword [rbx + 0x240]
lea r8, [0x00041a18]
mov r9d, 7
call fcn.000326a8
test eax, eax
jne 0x2d64a
lea rdx, [rdi - 1]
lea rcx, [rsi + 1]
lea r8, [rsp + 0x28]
call fcn.000326f4
test eax, eax
jne 0x2d688
cmp dword [rsp + 0x28], eax
jne 0x2d506
cmp dword [rsp + 0x2c], eax
jne 0x2d517
cmp dword [rsp + 0x30], 2
jne 0x2d528
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x2a0], rax
mov rax, qword [rsp + 0x38]
mov qword [rbx + 0x2a8], rax
jmp 0x2d678
mov rcx, qword [rbx + 0x240]
lea r8, [0x000445b0]
call fcn.000326a8
test eax, eax
jne 0x2d67c
dec rdi
je 0x2d67c
lea rax, [rsi + 1]
mov qword [rbx + 0x2c8], rdi
mov qword [rbx + 0x2c0], rax
xor eax, eax
jmp 0x2d688
mov eax, 0x210
jmp 0x2d688
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x2d6a0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
lea r8, [rax - 0x38]
mov rdi, r9
call fcn.000326f4
xor ebx, ebx
cmp eax, ebx
jne 0x2d818
cmp dword [rsp + 0x20], 1
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
jne 0x2d7d5
cmp dword [rsp + 0x24], ebx
jne 0x2d7e2
cmp dword [rsp + 0x28], 0x10
jne 0x2d7f0
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
lea r8, [rsp + 0x20]
mov rdx, rbp
mov rcx, rsi
call fcn.000326f4
cmp eax, ebx
jne 0x2d818
cmp dword [rsp + 0x20], ebx
jne 0x2d7d5
cmp dword [rsp + 0x24], ebx
jne 0x2d7e2
cmp dword [rsp + 0x28], 6
jne 0x2d7f0
mov rax, qword [rsp + 0x38]
add rsi, qword [rsp + 0x40]
sub rbp, qword [rsp + 0x40]
mov qword [rdi + 0x240], rax
mov rax, qword [rsp + 0x30]
lea r8d, [rbx + 9]
lea rdx, [0x000445c0]
lea rcx, [rsp + 0x20]
mov qword [rdi + 0x248], rax
call fcn.00032818
cmp eax, ebx
je 0x2d816
lea r8d, [rbx + 7]
lea rdx, [0x00041a18]
lea rcx, [rsp + 0x20]
call fcn.00032818
cmp eax, ebx
jne 0x2d7a0
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.0002d948
mov ebx, eax
jmp 0x2d816
lea rdx, [0x000445b0]
lea rcx, [rsp + 0x20]
mov r8d, 7
call fcn.00032818
cmp eax, ebx
jne 0x2d811
lea r8, [rsp + 0x20]
mov rdx, rbp
mov rcx, rsi
call fcn.000326f4
cmp eax, ebx
jne 0x2d79c
cmp dword [rsp + 0x20], ebx
je 0x2d7dc
mov ebx, 0xf0
jmp 0x2d816
cmp dword [rsp + 0x24], ebx
je 0x2d7e9
mov ebx, 0xeb
jmp 0x2d816
cmp dword [rsp + 0x28], 6
je 0x2d7f7
mov ebx, 0xe9
jmp 0x2d816
mov rax, qword [rsp + 0x38]
mov qword [rdi + 0x2b0], rax
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x2b8], rax
jmp 0x2d816
mov ebx, 0x210
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x34010
Capabilities:
Hash data using sha384

Disassembly:
and qword [rcx + 0x2c0], 0
and qword [rcx + 0x2c8], 0
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 8], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x10], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x18], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x20], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x28], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x30], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x38], rax
ret

Function at 0x340e4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov qword [rcx], rdx
mov rbp, r9
mov r13, r8
mov rdi, rdx
mov rsi, rcx
cmp r9, qword [rdx + 0x20]
jbe 0x3414b
add rcx, 8
call qword [rdx + 0x38]
lea rcx, [rsi + 8]
mov r8, rbp
mov rdx, r13
call qword [rdi + 0x40]
lea r12, [rsi + 0x2d8]
lea rcx, [rsi + 8]
mov rdx, r12
call qword [rdi + 0x48]
mov r11, qword [rdi + 0x28]
mov r8, qword [rdi + 0x20]
lea rcx, [r11 + rsi + 0x2d8]
sub r8, r11
jmp 0x3416f
lea r12, [rcx + 0x2d8]
mov r8, r9
mov rdx, r13
mov rcx, r12
call fcn.0003a6f0
mov r8, qword [rdi + 0x20]
lea rcx, [rsi + rbp + 0x2d8]
sub r8, rbp
xor edx, edx
call fcn.0003bc80
xor ecx, ecx
cmp qword [rdi + 0x20], rcx
jbe 0x34192
mov r8, r12
xor byte [r8], 0x36
inc ecx
inc r8
mov eax, ecx
cmp rax, qword [rdi + 0x20]
jb 0x34181
lea rcx, [rsi + 8]
call qword [rdi + 0x38]
mov r8, qword [rdi + 0x20]
lea rcx, [rsi + 8]
mov rdx, r12
mov rax, qword [rdi + 0x40]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
jmp rax

Function at 0x341cc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, qword [rcx]
mov rbp, rdx
lea rdx, [rcx + 0x358]
mov rdi, rcx
add rcx, 8
call qword [rbx + 0x48]
xor r8d, r8d
cmp qword [rbx + 0x20], r8
jbe 0x3421e
lea rcx, [rdi + 0x2d8]
xor byte [rcx], 0x6a
inc r8d
inc rcx
mov eax, r8d
cmp rax, qword [rbx + 0x20]
jb 0x3420c
lea rcx, [rdi + 8]
call qword [rbx + 0x38]
mov r8, qword [rbx + 0x20]
lea rdx, [rdi + 0x2d8]
lea rcx, [rdi + 8]
call qword [rbx + 0x40]
mov r8, qword [rbx + 0x28]
lea rdx, [rdi + 0x358]
lea rcx, [rdi + 8]
call qword [rbx + 0x40]
lea rdx, [rdi + 0x358]
lea rcx, [rdi + 8]
call qword [rbx + 0x48]
test rbp, rbp
je 0x3426f
mov r8, qword [rbx + 0x28]
lea rdx, [rdi + 0x358]
mov rcx, rbp
call fcn.0003a6f0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x34768
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x00047100]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0xa8]
mov r12, qword [rsp + 0xa0]
mov r15, r8
mov r14, rdx
mov r13, rcx
cmp rbp, 0x100
jbe 0x347b7
mov eax, 0xe5
jmp 0x34940
mov edi, 0x53534c4d
mov ebx, 0x70
xor ecx, ecx
mov r8d, edi
mov rdx, rbx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r8d, edi
mov rdx, rbx
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rdi, rax
test rsi, rsi
je 0x34928
test rax, rax
je 0x3491a
test rbp, rbp
je 0x348fa
lea eax, [rbx - 0x6f]
mov dword [rsp + 0x20], eax
lea edx, [rax + 0x40]
lea rcx, [rsp + 0x28]
mov r8d, eax
mov ebx, eax
call fcn.0003bc80
and qword [rdi + 0x58], 0
and qword [rdi + 0x60], 0
lea rdx, [rsp + 0x28]
mov r8, rbx
mov rcx, rdi
mov dword [rdi], 0x67452301
mov dword [rdi + 4], 0xefcdab89
mov dword [rdi + 8], 0x98badcfe
mov dword [rdi + 0xc], 0x10325476
mov dword [rdi + 0x10], 0xc3d2e1f0
call fcn.0003598c
mov r8, r14
mov rdx, r13
mov rcx, rdi
call fcn.0003598c
mov r8d, 0x40
mov rdx, r15
mov rcx, rdi
call fcn.0003598c
xor edx, edx
mov rcx, rdi
call fcn.00035a14
and qword [rsi + 0x50], 0
and qword [rsi + 0x58], 0
mov r8, r14
mov rdx, r13
mov rcx, rsi
mov dword [rsi], 0x67452301
mov dword [rsi + 4], 0xefcdab89
mov dword [rsi + 8], 0x98badcfe
mov dword [rsi + 0xc], 0x10325476
call fcn.00034fc0
mov r8d, 0x14
mov rdx, rdi
mov rcx, rsi
call fcn.00034fc0
xor edx, edx
mov rcx, rsi
call fcn.00035048
mov ebx, 0x10
mov rdx, rsi
cmp rbp, rbx
mov rcx, r12
cmovb rbx, rbp
mov r8, rbx
call fcn.0003a6f0
mov eax, dword [rsp + 0x20]
add r12, rbx
inc eax
sub rbp, rbx
mov dword [rsp + 0x20], eax
jne 0x34805
mov edx, 0x53534c4d
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edx, 0x53534c4d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
jmp 0x34940
mov edx, 0x53534c4d
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
test rdi, rdi
je 0x3493b
mov edx, 0x53534c4d
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0x64
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.0003a660
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x34b5c
Capabilities:
Hash data using sha512

Disassembly:
and qword [rcx + 0x2c0], 0
and qword [rcx + 0x2c8], 0
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x38], rax
ret
Function at 0x34d38
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov rsi, qword [rcx]
mov r12, qword [rcx + 8]
mov r13, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x20]
mov r14, qword [rcx + 0x28]
mov r15, qword [rcx + 0x30]
mov qword [rsp + 0x68], rax
mov rax, qword [rcx + 0x38]
lea rbx, [rcx + 0x40]
mov qword [rsp + 0x70], rax
mov edi, 0x10
mov r11, rbx
mov rcx, qword [r11]
call fcn.00024370
mov qword [r11], rax
add r11, 8
sub rdi, 1
jne 0x34d86
lea r9, [rbx + 0x70]
lea r11d, [rdi + 0x40]
mov rcx, qword [r9]
mov rdx, qword [r9 - 0x68]
add r9, 8
mov r8, rcx
mov rax, rcx
shr rcx, 6
ror r8, 0x13
rol rax, 3
xor r8, rax
mov rax, rdx
xor r8, rcx
mov rcx, rdx
shr rdx, 7
ror rcx, 8
ror rax, 1
xor rcx, rax
xor rcx, rdx
add r8, rcx
add r8, qword [r9 - 0x78]
add r8, qword [r9 - 0x30]
sub r11, 1
mov qword [r9 + 8], r8
jne 0x34da3
mov r10, qword [rsp + 0x68]
lea r9, [0x00041330]
mov r11d, 0x50
sub rbx, r9
mov r8, rbp
mov rax, rbp
mov rcx, rbp
rol r8, 0x17
ror rax, 0x12
not rcx
xor r8, rax
and rcx, r15
mov rax, rbp
ror rax, 0xe
mov rdx, rsi
xor r8, rax
mov rax, r14
and rax, rbp
or rcx, rax
mov rax, rsi
add r8, rcx
mov rcx, r12
add r8, qword [rbx + r9]
or rcx, rsi
add r8, qword [r9]
and rcx, r13
add r9, 8
add r8, qword [rsp + 0x70]
rol rdx, 0x1e
ror rax, 0x1c
xor rdx, rax
mov rax, rsi
rol rax, 0x19
xor rdx, rax
mov rax, r12
and rax, rsi
or rcx, rax
add rdx, rcx
sub r11, 1
mov rcx, r15
mov r15, r14
mov r14, rbp
lea rbp, [r8 + r10]
mov r10, r13
mov r13, r12
mov r12, rsi
lea rsi, [rdx + r8]
mov qword [rsp + 0x70], rcx
jne 0x34e07
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x68], r10
mov r10, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
add qword [r10], rsi
add qword [r10 + 8], r12
add qword [r10 + 0x10], r13
add qword [r10 + 0x18], rax
add qword [r10 + 0x20], rbp
add qword [r10 + 0x28], r14
add qword [r10 + 0x30], r15
add qword [r10 + 0x38], rcx
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x36660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x00047100]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rdx
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.0003bc80
xor r8d, r8d
lea r11d, [r8 + 0xf]
movdqu xmm5, xmmword [rbx]
mov ebx, 0x80
movdqu xmmword [rsp + 0x20], xmm5
mov cl, r8b
mov rax, r8
mov edx, ebx
and cl, 7
shr rax, 3
sar edx, cl
test byte [rax + rdi], dl
je 0x366ce
xor ecx, ecx
mov al, byte [rsp + rcx + 0x20]
inc rcx
xor byte [rsp + rcx + 0x2f], al
cmp rcx, 0x10
jb 0x366bd
test byte [rsp + 0x2f], 1
lea r9, [rsp + 0x2f]
mov r10, r11
je 0x36705
mov cl, byte [r9 - 1]
mov al, byte [r9]
shl cl, 7
shr al, 1
or cl, al
mov byte [r9], cl
dec r9
sub r10, 1
jne 0x366dd
mov al, byte [rsp + 0x20]
shr al, 1
xor al, 0xe1
mov byte [rsp + 0x20], al
jmp 0x36723
mov cl, byte [r9 - 1]
mov al, byte [r9]
shl cl, 7
shr al, 1
or cl, al
mov byte [r9], cl
dec r9
sub r10, 1
jne 0x36705
shr byte [rsp + 0x20], 1
inc r8
cmp r8, rbx
jb 0x366a5
movdqu xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rdi], xmm0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.0003a660
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x36d14
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x48
mov rax, qword [0x00047100]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0xa0]
mov rax, qword [rcx + 0x18]
mov rbx, qword [rsp + 0xa8]
mov rbp, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
jmp 0x36db1
lea rcx, [rsp + 0x20]
mov r8, rax
mov rdx, rbp
call fcn.0003a6f0
mov r8, rsi
mov rdx, rbp
mov rcx, r13
call qword [rdi + 0x40]
xor r11d, r11d
cmp qword [rdi + 0x18], r11
jbe 0x36d91
mov rdx, r12
mov rcx, rsi
sub rdx, rsi
mov al, byte [rdx + rcx]
inc r11
xor byte [rcx], al
inc rcx
cmp r11, qword [rdi + 0x18]
jb 0x36d80
mov r8, qword [rdi + 0x18]
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.0003a6f0
mov rax, qword [rdi + 0x18]
add rbp, qword [rdi + 0x18]
add rsi, qword [rdi + 0x18]
sub rbx, rax
cmp rbx, rax
jae 0x36d52
neg rbx
sbb eax, eax
and eax, 0xe5
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.0003a660
add rsp, 0x48
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x36e40
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
mov r11, rcx
test dl, 3
je 0x36e5f
mov eax, 0xe5
jmp 0x36f0c
cmp rdx, 4
jb 0x36f07
xor ecx, ecx
xor ebx, ebx
cmp rdx, 2
jne 0x36e80
cmp byte [r11], 0x3d
jne 0x36e8c
cmp byte [r11 + 1], 0x3d
je 0x36ed9
cmp rdx, 1
jne 0x36e8c
cmp byte [r11], 0x3d
je 0x36ee9
cmp byte [r11], 0x7f
ja 0x36f00
movzx eax, byte [r11]
lea rdi, [0x0003fec0]
cmp byte [rax + rdi], 0x3f
ja 0x36f00
movzx eax, byte [rax + rdi]
shl ecx, 6
inc rbx
inc r11
dec rdx
or ecx, eax
cmp rbx, 4
jb 0x36e6d
mov eax, ecx
shr eax, 0x10
mov byte [r10 + r8], al
mov eax, ecx
shr eax, 8
add r10, 3
mov byte [r10 + r8 - 2], al
mov byte [r10 + r8 - 1], cl
jmp 0x36e5f
shr ecx, 4
lea rax, [r10 + 1]
mov byte [r10 + r8], cl
mov qword [r9], rax
jmp 0x36f0a
mov eax, ecx
shr eax, 0xa
shr ecx, 2
mov byte [r10 + r8], al
mov byte [r10 + r8 + 1], cl
lea rax, [r10 + 2]
jmp 0x36ee4
mov eax, 0xe4
jmp 0x36f0c
mov qword [r9], r10
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x3a1b8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx r9d, byte [rdx]
movzx eax, byte [rdx + 1]
mov r11, r8
movzx r8d, byte [rdx + 4]
shl r9d, 8
mov rdi, rcx
or r9d, eax
movzx eax, byte [rdx + 2]
shl r8d, 8
shl r9d, 8
lea rsi, [0x00010000]
or r9d, eax
movzx eax, byte [rdx + 3]
shl r9d, 8
or r9d, eax
movzx eax, byte [rdx + 5]
or r8d, eax
movzx eax, byte [rdx + 6]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 7]
shl r8d, 8
or r8d, eax
mov eax, r9d
shr eax, 4
xor eax, r8d
and eax, 0xf0f0f0f
xor r8d, eax
shl eax, 4
xor r9d, eax
mov eax, r9d
shr eax, 0x10
xor eax, r8d
movzx ecx, ax
xor r8d, ecx
shl ecx, 0x10
xor r9d, ecx
mov eax, r8d
shr eax, 2
xor eax, r9d
and eax, 0x33333333
xor r9d, eax
shl eax, 2
xor r8d, eax
mov eax, r8d
shr eax, 8
xor eax, r9d
and eax, 0xff00ff
xor r9d, eax
shl eax, 8
xor r8d, eax
mov r10d, r9d
shr r10d, 1
xor r10d, r8d
and r10d, 0x55555555
lea ebx, [r10 + r10]
xor r10d, r8d
xor ebx, r9d
mov r9d, 0x10
rol ebx, 1
rol r10d, 1
mov eax, dword [rdi]
add rdi, 8
xor eax, r10d
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rsi + rcx*4 + 0x2dc50]
xor edx, dword [rsi + rax*4 + 0x2de50]
mov rax, r8
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rsi + rax*4 + 0x2e050]
mov eax, r10d
xor edx, dword [rsi + r8*4 + 0x2e250]
xor ebx, edx
ror eax, 4
xor eax, dword [rdi - 4]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rsi + rcx*4 + 0x2db50]
xor edx, dword [rsi + rax*4 + 0x2dd50]
mov rax, r8
and r8d, 0x3f
shr rax, 8
and eax, 0x3f
xor edx, dword [rsi + rax*4 + 0x2df50]
xor edx, dword [rsi + r8*4 + 0x2e150]
xor ebx, edx
sub r9, 1
mov edx, r10d
mov r10d, ebx
mov ebx, edx
jne 0x3a29e
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ror r10d, 1
ror edx, 1
mov eax, r10d
shr eax, 1
xor eax, edx
and eax, 0x55555555
xor edx, eax
add eax, eax
xor r10d, eax
mov eax, edx
shr eax, 8
xor eax, r10d
and eax, 0xff00ff
xor r10d, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, r10d
and eax, 0x33333333
xor r10d, eax
shl eax, 2
xor edx, eax
mov eax, r10d
shr eax, 0x10
xor eax, edx
movzx ecx, ax
xor edx, ecx
shl ecx, 0x10
xor r10d, ecx
mov eax, r10d
shr eax, 4
xor eax, edx
and eax, 0xf0f0f0f
xor edx, eax
shl eax, 4
xor r10d, eax
mov byte [r11 + 7], dl
mov eax, r10d
mov byte [r11 + 3], r10b
shr eax, 0x18
mov byte [r11], al
mov eax, r10d
shr eax, 0x10
mov byte [r11 + 1], al
mov eax, r10d
shr eax, 8
mov byte [r11 + 2], al
mov eax, edx
shr eax, 0x18
mov byte [r11 + 4], al
mov eax, edx
shr eax, 0x10
mov byte [r11 + 5], al
mov eax, edx
shr eax, 8
mov byte [r11 + 6], al
ret