joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005fe64
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
cmp dword [rdx + 8], 0x26
mov r9, rdx
mov rdi, rcx
jne 0x1005ff94
mov rax, qword [rdx]
cmp word [rax], 0x7b
jne 0x1005ff94
cmp word [rax + 0x4a], 0x7d
jne 0x1005ff94
xor ebx, ebx
lea r8d, [rbx + 1]
lea r11d, [rbx + 2]
cmp r8d, 9
je 0x1005ff74
cmp r8d, 0xe
je 0x1005ff74
cmp r8d, 0x13
je 0x1005ff74
cmp r8d, 0x18
je 0x1005ff74
mov r10, qword [r9]
movzx ecx, word [r11 + r10]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x1005feda
movzx edx, cx
sub edx, 0x30
jmp 0x1005ff01
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x1005feeb
movzx edx, cx
sub edx, 0x57
jmp 0x1005ff01
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x1005fefc
movzx edx, cx
sub edx, 0x37
jmp 0x1005ff01
mov edx, 0xffffffff
test edx, edx
js 0x1005ff94
movzx ecx, word [r11 + r10 + 2]
lea eax, [rcx - 0x30]
cmp ax, 9
ja 0x1005ff20
movzx eax, cx
sub eax, 0x30
jmp 0x1005ff47
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x1005ff31
movzx eax, cx
sub eax, 0x57
jmp 0x1005ff47
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x1005ff42
movzx eax, cx
sub eax, 0x37
jmp 0x1005ff47
mov eax, 0xffffffff
test eax, eax
js 0x1005ff94
shl edx, 4
or edx, eax
jl 0x1005ff94
cmp ebx, 8
mov eax, ebx
jae 0x1005ff65
cmp ebx, 4
sbb eax, eax
and eax, 2
inc eax
xor eax, ebx
inc ebx
add r8d, 2
mov byte [rax + rdi], dl
add r11, 4
jmp 0x1005ff86
mov rax, qword [r9]
cmp word [r11 + rax], 0x2d
jne 0x1005ff94
inc r8d
add r11, 2
cmp r8d, 0x25
jb 0x1005fe99
mov al, 1
jmp 0x1005ff96
xor al, al
pop rdi
pop rbx
ret

Function at 0x100838b8
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
cmp rdx, 0x200
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov dword [r8], 0
mov dword [r8 + 4], 0
jb 0x1008393b
cmp word [rcx], 0x5a4d
jne 0x1008393b
mov r9d, dword [rcx + 0x3c]
cmp r9d, 0x1000
jae 0x1008393b
lea ecx, [r9 + 0x200]
cmp rcx, rdx
ja 0x1008393b
test r9b, 7
jne 0x1008393b
lea rdx, [rbx + r9]
cmp dword [rdx], 0x4550
jne 0x1008393b
movzx ecx, word [rdx + 4]
sub ecx, 0x14c
je 0x10083975
sub ecx, 0x74
je 0x1008396e
sub ecx, 2
je 0x1008396e
sub ecx, 2
je 0x10083967
sub ecx, 0x3c
je 0x10083960
cmp ecx, 0x8464
je 0x10083975
mov rdx, rsi
mov rcx, rbx
call fcn.1008368c
test eax, eax
jne 0x10083959
mov rdx, rsi
mov rcx, rbx
call fcn.10083748
test eax, eax
je 0x1008399b
mov eax, 1
jmp 0x100839a9
mov eax, 0x3030401
jmp 0x1008397a
mov eax, 0x3030701
jmp 0x1008397a
mov eax, 0x3030501
jmp 0x1008397a
mov eax, 0x3030103
cmp word [rdx + 0x14], 0x400
ja 0x1008393b
movzx ecx, word [rdx + 0x18]
cmp ecx, 0x10b
je 0x10083996
cmp ecx, 0x20b
jne 0x1008393b
mov dword [r8], eax
jmp 0x10083959
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1008380c
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x1008b1d0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
cmp edx, 8
mov r9, rcx
jb 0x1008b1f7
mov ecx, edx
shr rcx, 3
mov eax, dword [r9 + 4]
add edx, 0xfffffff8
xor eax, dword [r9]
add r9, 8
xor r8d, eax
dec rcx
jne 0x1008b1e1
cmp edx, 4
jb 0x1008b203
xor r8d, dword [r9]
add r9, 4
and edx, 3
cmp edx, 2
jbe 0x1008b218
movzx eax, byte [r9]
shl eax, 0x10
xor r8d, eax
inc r9
cmp edx, 1
jbe 0x1008b22a
movzx ecx, byte [r9]
shl ecx, 8
xor r8d, ecx
inc r9
test edx, edx
je 0x1008b235
movzx ecx, byte [r9]
xor r8d, ecx
mov eax, r8d
ret
Function at 0x1009d72c
Capabilities:
Parse credit card information

Disassembly:
cmp dword [rcx + 0x58], 2
jge 0x1009d73f
cmp byte [rcx + 0x5e], 0
je 0x1009d7af
cmp edx, 0x3f
jae 0x1009d799
jmp 0x1009d7af
cmp edx, 0x2c
jb 0x1009d7af
cmp dword [rcx + 0x58], 3
mov eax, 0xffffffff
jl 0x1009d75a
cmp edx, 0x2c
jne 0x1009d758
lea eax, [rdx + 0x1c]
ret
add edx, eax
cmp dword [rcx + 0x58], 4
jl 0x1009d76b
cmp edx, 0x2c
jne 0x1009d769
lea eax, [rdx + 0x1d]
ret
add edx, eax
cmp edx, 0x3a
jb 0x1009d7af
cmp byte [rcx + 0x20], 0
je 0x1009d78b
cmp edx, 0x3a
jne 0x1009d77f
lea eax, [rdx + 0xa]
ret
cmp edx, 0x3b
jne 0x1009d788
lea eax, [rdx + 0xa]
ret
add edx, 0xfffffffe
cmp edx, 0x3f
jb 0x1009d7a5
cmp byte [rcx + 0x5e], 0
je 0x1009d7a5
cmp edx, 0x3f
jne 0x1009d7a1
mov eax, 0x46
ret
lea eax, [rdx - 1]
ret
cmp edx, 0x44
mov eax, 0x47
je 0x1009d7b1
mov eax, edx
ret

Function at 0x1009d900
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 2
mov r9, rdx
mov r8, rcx
jb 0x1009d953
cmp byte [rcx], 0x4d
jne 0x1009d953
cmp byte [rcx + 1], 0x5a
jne 0x1009d953
cmp rdx, 0x40
jb 0x1009d953
mov edx, dword [rcx + 0x3c]
lea eax, [rdx - 0x40]
cmp eax, 0xfc0
ja 0x1009d953
test dl, 7
jne 0x1009d953
lea eax, [rdx + 0x18]
mov ecx, eax
cmp rcx, r9
ja 0x1009d953
cmp dword [r8 + rdx], 0x4550
mov rax, rdx
jne 0x1009d953
xor eax, eax
cmp word [r8 + rdx + 0x14], 0x60
setae al
ret
xor al, al
ret

Function at 0x100c1c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
lea rdx, str.MSWIM
mov rcx, rdi
mov r8d, 8
call sub.msvcrt.dll_memcpy
mov dword [rdi + 8], 0xd0
mov eax, dword [rbx]
mov dword [rdi + 0xc], eax
mov eax, dword [rbx + 4]
lea rdx, [rbx + 0x10]
mov dword [rdi + 0x10], eax
mov eax, dword [rbx + 8]
lea rcx, [rdi + 0x18]
mov r8d, 0x10
mov dword [rdi + 0x14], eax
call sub.msvcrt.dll_memcpy
movzx r11d, word [rbx + 0x20]
xor edx, edx
mov word [rdi + 0x28], r11w
movzx eax, word [rbx + 0x22]
lea rcx, [rdi + 0x94]
mov word [rdi + 0x2a], ax
mov eax, dword [rbx + 0x24]
lea r8d, [rdx + 0x3c]
mov dword [rdi + 0x2c], eax
mov rax, qword [rbx + 0x30]
mov qword [rdi + 0x30], rax
mov al, byte [rbx + 0x48]
mov byte [rdi + 0x37], al
mov rax, qword [rbx + 0x38]
mov qword [rdi + 0x38], rax
mov rax, qword [rbx + 0x40]
mov qword [rdi + 0x40], rax
mov rax, qword [rbx + 0x50]
mov qword [rdi + 0x48], rax
mov al, byte [rbx + 0x68]
mov byte [rdi + 0x4f], al
mov rax, qword [rbx + 0x58]
mov qword [rdi + 0x50], rax
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x58], rax
mov rax, qword [rbx + 0x70]
mov qword [rdi + 0x60], rax
mov al, byte [rbx + 0x88]
mov byte [rdi + 0x67], al
mov rax, qword [rbx + 0x78]
mov qword [rdi + 0x68], rax
mov rax, qword [rbx + 0x80]
mov qword [rdi + 0x70], rax
mov rax, qword [rbx + 0x90]
mov qword [rdi + 0x7c], rax
mov al, byte [rbx + 0xa8]
mov byte [rdi + 0x83], al
mov rax, qword [rbx + 0x98]
mov qword [rdi + 0x84], rax
mov rax, qword [rbx + 0xa0]
mov qword [rdi + 0x8c], rax
mov eax, dword [rbx + 0x28]
mov dword [rdi + 0x78], eax
add rsp, 0x28
pop rdi
pop rbx
jmp sub.msvcrt.dll_memset
Function at 0x100e8c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 0x40], 0xa
mov r8, rcx
jae 0x100e8c83
nop
nop
mov r9d, dword [r8]
cmp r9d, 8
jae 0x100e8c58
mov r10, qword [r8 + 8]
cmp r10, qword [r8 + 0x10]
je 0x100e8d54
movzx edx, byte [r10]
lea eax, [r9 + 8]
mov ecx, 0x18
sub ecx, r9d
mov dword [r8], eax
lea rax, [r10 + 1]
shl edx, cl
mov qword [r8 + 8], rax
or dword [r8 + 4], edx
mov eax, dword [r8 + 4]
add dword [r8], 0xfffffff8
mov ecx, eax
shl eax, 8
mov dword [r8 + 4], eax
mov eax, dword [r8 + 0x40]
shr ecx, 0x18
mov byte [rax + r8 + 0x70e6], cl
inc dword [r8 + 0x40]
cmp dword [r8 + 0x40], 0xa
jb 0x100e8c20
mov dword [r8 + 0x70f0], 0
movzx eax, byte [r8 + 0x70ec]
shl eax, 8
mov dword [r8 + 0x70f0], eax
movzx ecx, byte [r8 + 0x70ed]
or ecx, eax
shl ecx, 8
mov dword [r8 + 0x70f0], ecx
movzx edx, byte [r8 + 0x70ee]
or edx, ecx
shl edx, 8
mov dword [r8 + 0x70f0], edx
movzx eax, byte [r8 + 0x70ef]
or eax, edx
mov dword [r8 + 0x70f0], eax
cmp byte [r8 + 0x70e6], 0x31
jne 0x100e8d57
cmp byte [r8 + 0x70e7], 0x41
jne 0x100e8d57
cmp byte [r8 + 0x70e8], 0x59
jne 0x100e8d57
cmp byte [r8 + 0x70e9], 0x26
jne 0x100e8d57
cmp byte [r8 + 0x70ea], 0x53
jne 0x100e8d57
cmp byte [r8 + 0x70eb], 0x59
jne 0x100e8d57
cmp byte [r8 + 0x70f8], 0
jne 0x100e8d26
inc qword [r8 + 0x7100]
inc qword [r8 + 0x7108]
mov byte [r8 + 0x70f8], 1
mov eax, dword [r8 + 0x70f4]
rol eax, 1
xor eax, dword [r8 + 0x70f0]
mov dword [r8 + 0x70f4], eax
mov dword [r8 + 0x3c], 2
xor eax, eax
ret
cmp byte [r8 + 0x70e6], 0x17
jne 0x100e8dfb
cmp byte [r8 + 0x70e7], 0x72
jne 0x100e8dfb
cmp byte [r8 + 0x70e8], 0x45
jne 0x100e8dfb
cmp byte [r8 + 0x70e9], 0x38
jne 0x100e8dfb
cmp byte [r8 + 0x70ea], 0x50
jne 0x100e8dfb
cmp byte [r8 + 0x70eb], 0x90
jne 0x100e8dfb
cmp byte [r8 + 0x70f8], 0
jne 0x100e8dac
inc qword [r8 + 0x7100]
mov edx, dword [r8 + 4]
mov byte [r8 + 0x70f8], 1
test edx, edx
je 0x100e8dc4
mov byte [r8 + 0x70fa], 1
mov eax, dword [r8]
mov dword [r8 + 0x3c], 0xb
mov ecx, eax
and ecx, 7
sub eax, ecx
shl edx, cl
mov dword [r8], eax
mov eax, dword [r8 + 0x70f4]
mov dword [r8 + 4], edx
cmp dword [r8 + 0x70f0], eax
je 0x100e8d54
mov byte [r8 + 0x70f9], 1
mov eax, 1
ret
Function at 0x100ed320
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x2c], 8
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x28]
mov r8d, edx
mov rdx, qword [rcx]
mov qword [rcx + 0x20], rax
mov rax, qword [rcx + 0x8cf8]
mov qword [rsp + 0x60], rsi
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x28], esi
mov byte [rsp + 0x30], sil
mov dword [rcx + 0x8ce8], esi
mov r9d, dword [rax + 0x19c]
call fcn.100ecb40
mov rcx, qword [rbx + 0x8cf8]
cmp byte [rcx + 0x1ec], sil
je 0x100ed3a6
mov eax, dword [rbx + 0x8cec]
mov rcx, qword [rcx + 0x1b0]
imul rax, rax, 0x8e28
mov rcx, qword [rax + rcx + 0x8d18]
call fcn.10127890
cmp dword [rbx + 0x8ce8], esi
mov edx, esi
jbe 0x100ed3e7
lea r8, [rbx + 0x7ce8]
nop
nop
nop
mov rcx, qword [rbx + 0x8cf8]
inc edx
add r8, 4
mov eax, dword [rcx + 0x1a8]
rol eax, 1
xor eax, dword [r8 - 4]
mov dword [rcx + 0x1a8], eax
cmp edx, dword [rbx + 0x8ce8]
jb 0x100ed3c0
mov eax, dword [rsp + 0x28]
movzx r9d, byte [rsp + 0x30]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x8cf8]
lea r8d, [rax*8 + 8]
mov qword [rsp + 0x58], rbp
sub r8d, dword [rsp + 0x2c]
call fcn.100ecdd0
mov rbp, qword [rbx + 0x8cf8]
cmp byte [rbp + 0x1ec], sil
je 0x100ed4b6
mov qword [rsp + 0x68], rdi
mov edi, dword [rbx + 0x8cec]
inc edi
cmp edi, dword [rbp + 0x1e8]
cmove edi, esi
cmp qword [rbp + 0x208], rsi
je 0x100ed48c
lea rcx, [rbp + 0x160]
call fcn.1000b15c
mov ecx, 0xf
lea rdx, [rbx + 0x8d20]
sub ecx, dword [rbp + 0x158]
lea r8, [rsp + 0x20]
shr rcx, 3
lea r11, [rcx + rax]
mov rax, qword [rbx + 0x8cf8]
mov qword [rsp + 0x20], r11
mov rcx, qword [rax + 0x208]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov esi, eax
mov rcx, qword [rbx + 0x8cf8]
mov r8d, edi
mov rdx, qword [rcx + 0x1b0]
imul r8, r8, 0x8e28
lea rcx, [r8 + rdx + 0x8d18]
call fcn.10127a40
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x10107ef0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x38], rbx
mov ebx, r8d
mov qword [rsp + 0x40], rsi
xor sil, sil
xor r9b, r9b
test ebx, ebx
mov qword [rsp + 0x48], rdi
mov r8, rdx
mov byte [rcx + 4], 0
mov rdi, rcx
mov dword [rcx], 0xffffffff
je 0x10107f40
mov rax, rdx
mov r10, rbx
nop
nop
nop
xor r9b, byte [rax]
inc rax
dec r10
jne 0x10107f30
test r9b, r9b
jne 0x10107f9c
test ebx, ebx
je 0x10107f9c
mov byte [rcx + 4], 1
mov rdx, rbx
mov rcx, r8
mov sil, 1
call fcn.1012f3b0
xor ecx, ecx
mov r11d, eax
lea rax, [0x101509c0]
cmp dword [rax + 4], r11d
jne 0x10107f6c
cmp dword [rax], ebx
je 0x10107f7c
inc ecx
add rax, 0xc
cmp ecx, 6
jb 0x10107f62
mov ecx, 0xffffffff
test ecx, ecx
mov dword [rdi], ecx
js 0x10107f98
mov al, 1
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
ret
mov byte [rdi + 4], 0
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
mov al, sil
mov rsi, qword [rsp + 0x40]
add rsp, 0x28
ret
Function at 0x1010f390
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
xor ebx, ebx
cmp r8, 0x40
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, r8
mov qword [rax - 0x48], rbx
mov qword [rax - 0x40], rbx
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov rsi, rdx
mov rbp, rcx
jbe 0x1010f3fa
call fcn.1012f760
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.1012fe70
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1012ff20
jmp 0x1010f404
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rax, rbx
nop
nop
nop
xor dword [rsp + rax*4 + 0x20], 0x36363636
inc rax
cmp rax, 0x10
jb 0x1010f420
mov rcx, rbp
call fcn.1012f760
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rbp
call fcn.1012fe70
nop
xor dword [rsp + rbx*4 + 0x20], 0x6a6a6a6a
inc rbx
cmp rbx, 0x10
jb 0x1010f450
lea rcx, [rbp + 0x80]
call fcn.1012f760
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x80]
mov r8d, 0x40
call fcn.1012fe70
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x1010f4a0
Capabilities:
Hash data using sha1

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rbx, rcx
call fcn.1012ff20
lea rcx, [rbx + 0x80]
mov r8d, 0x14
mov rdx, rdi
call fcn.1012fe70
lea rcx, [rbx + 0x80]
mov rdx, rdi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
jmp fcn.1012ff20

Function at 0x1010f4f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov rax, rsp
sub rsp, 0xd8
mov qword [rax + 0x20], rbx
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
mov r14, rdx
mov r13d, r8d
mov qword [rax - 0x38], r15
lea rdx, [rsp + 0x20]
mov r8d, 0x14
mov r15, rcx
call fcn.10130030
lea rdx, [rsp + 0x60]
lea rcx, [r15 + 0x80]
mov r8d, 0x14
call fcn.10130030
test r13d, r13d
mov ebx, dword [r14]
mov edi, dword [r14 + 4]
mov esi, dword [r14 + 8]
mov ebp, dword [r14 + 0xc]
mov r12d, dword [r14 + 0x10]
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x2c], ebp
mov dword [rsp + 0x30], r12d
je 0x1010f5ca
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.10130090
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [r15 + 0x80]
call fcn.10130090
xor ebx, dword [rsp + 0x20]
xor edi, dword [rsp + 0x24]
xor esi, dword [rsp + 0x28]
xor ebp, dword [rsp + 0x2c]
xor r12d, dword [rsp + 0x30]
dec r13
jne 0x1010f580
mov r14, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xb0]
mov dword [r14], ebx
mov rbx, qword [rsp + 0xf8]
mov dword [r14 + 4], edi
mov rdi, qword [rsp + 0xc0]
mov dword [r14 + 8], esi
mov rsi, qword [rsp + 0xc8]
mov dword [r14 + 0xc], ebp
mov rbp, qword [rsp + 0xd0]
mov dword [r14 + 0x10], r12d
mov r12, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xa8]
add rsp, 0xd8
ret
Function at 0x1010f630
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
xor ebx, ebx
cmp r8, 0x40
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, r8
mov qword [rax - 0x48], rbx
mov qword [rax - 0x40], rbx
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov rsi, rdx
mov rbp, rcx
jbe 0x1010f69a
call fcn.10130200
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.1012fe70
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.10130780
jmp 0x1010f6a4
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rax, rbx
nop
nop
nop
xor dword [rsp + rax*4 + 0x20], 0x36363636
inc rax
cmp rax, 0x10
jb 0x1010f6c0
mov rcx, rbp
call fcn.10130200
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rbp
call fcn.1012fe70
nop
xor dword [rsp + rbx*4 + 0x20], 0x6a6a6a6a
inc rbx
cmp rbx, 0x10
jb 0x1010f6f0
lea rcx, [rbp + 0x80]
call fcn.10130200
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x80]
mov r8d, 0x40
call fcn.1012fe70
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x1010f740
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov rbx, rcx
call fcn.10130780
lea rcx, [rbx + 0x80]
mov r8d, 0x20
mov rdx, rdi
call fcn.1012fe70
lea rcx, [rbx + 0x80]
mov rdx, rdi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
jmp fcn.10130780

Function at 0x1010fd70
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov rax, rsp
sub rsp, 0xd8
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rcx, [rsp + 0x30]
call fcn.10130200
mov esi, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0xe0], eax
call fcn.1012fe70
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0xe0], eax
call fcn.1012fe70
lea rcx, [rsp + 0xb0]
mov edx, 0x20
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1010fe0f
mov esi, 0x64
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x30]
lea r8d, [rsi - 0x44]
call fcn.1012fe70
mov qword [rsp + 0xe8], rbx
nop
nop
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1010fe44
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, 8
call fcn.1012fe70
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0xe0], eax
call fcn.1012fe70
mov ebx, 0x64
nop
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.10130780
lea rcx, [rsp + 0x30]
call fcn.10130200
lea rcx, [rsp + 0x30]
mov r8d, 0x20
mov rdx, rdi
call fcn.1012fe70
dec rbx
jne 0x1010fe70
add esi, 0xffffffff
jne 0x1010fe20
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.10130780
mov rbx, qword [rsp + 0xe8]
mov byte [rdi + 0x20], sil
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
add rsp, 0xd8
ret
Function at 0x10110000
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov esi, dword [rcx + 0x100]
mov qword [rsp + 0x48], rdi
mov edi, dword [rcx + 0x104]
xor edi, dword [rdx + 4]
mov qword [rsp + 0x18], r13
mov r13d, dword [rcx + 0x108]
xor r13d, dword [rdx + 8]
mov qword [rsp + 0x10], r14
mov r14d, dword [rdx + 0xc]
xor r14d, dword [rcx + 0x10c]
mov ebp, esi
movzx ebx, r8b
xor ebp, dword [rdx]
test r8b, r8b
mov r10, rdx
mov r9, rcx
jne 0x1011006c
mov rax, qword [rdx]
lea rcx, [rsp]
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
xor r11d, r11d
mov qword [rsp + 0x20], r12
test bl, bl
je 0x1011007d
mov eax, r11d
jmp 0x10110085
mov eax, 0x1f
sub eax, r11d
and eax, 3
inc r11d
mov r8d, dword [r9 + rax*4 + 0x100]
mov eax, r14d
rol eax, 0xb
add eax, r13d
xor eax, r8d
mov edx, eax
shr rax, 0x10
movzx eax, al
movzx r12d, byte [rax + r9]
mov rax, rdx
shr rax, 0x18
movzx ecx, byte [rax + r9]
mov rax, rdx
shr rax, 8
shl ecx, 8
movzx eax, al
or r12d, ecx
movzx ecx, byte [rax + r9]
shl r12d, 8
movzx eax, dl
movzx eax, byte [rax + r9]
or r12d, ecx
shl r12d, 8
or r12d, eax
mov eax, r13d
xor r12d, ebp
rol eax, 0x11
mov ebp, r13d
xor eax, r14d
mov r13d, r12d
add eax, r8d
mov edx, eax
shr rax, 0x10
movzx eax, al
movzx r8d, byte [rax + r9]
mov rax, rdx
shr rax, 0x18
movzx ecx, byte [rax + r9]
mov rax, rdx
shr rax, 8
shl ecx, 8
or r8d, ecx
movzx eax, al
movzx ecx, byte [rax + r9]
shl r8d, 8
movzx eax, dl
movzx eax, byte [rax + r9]
or r8d, ecx
shl r8d, 8
or r8d, eax
xor r8d, edi
cmp r11d, 0x20
mov edi, r14d
mov r14d, r8d
jb 0x10110074
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
xor esi, r12d
mov r12, qword [rsp + 0x20]
mov dword [r10], esi
mov eax, dword [r9 + 0x104]
mov rsi, qword [rsp + 0x40]
xor eax, r8d
lea rcx, [rsp]
mov dword [r10 + 4], eax
mov eax, dword [r9 + 0x108]
mov edx, 4
xor eax, ebp
mov rbp, qword [rsp + 0x38]
lea r8, [0x10193c00]
mov dword [r10 + 8], eax
xor edi, dword [r9 + 0x10c]
test bl, bl
mov rbx, qword [rsp + 0x30]
cmovne rcx, r10
mov dword [r10 + 0xc], edi
mov rdi, qword [rsp + 0x48]
add rcx, 2
nop
nop
movzx eax, byte [rcx - 2]
add rcx, 4
mov eax, dword [r8 + rax*4]
xor dword [r9 + 0x100], eax
movzx eax, byte [rcx - 5]
mov eax, dword [r8 + rax*4]
xor dword [r9 + 0x104], eax
movzx eax, byte [rcx - 4]
mov eax, dword [r8 + rax*4]
xor dword [r9 + 0x108], eax
movzx eax, byte [rcx - 3]
mov eax, dword [r8 + rax*4]
xor dword [r9 + 0x10c], eax
dec rdx
jne 0x101101c0
add rsp, 0x28
ret
Function at 0x10111e30
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x138
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rdx
lea rdx, [rsp + 0x60]
mov qword [rax + 0x20], rdi
call fcn.1012ff20
movabs r11, 0x3636363636363636
xor ebx, ebx
mov edi, 4
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov rcx, rbx
mov rdx, rdi
movzx eax, byte [rsp + rcx + 0x60]
add rcx, 5
xor byte [rsp + rcx + 0x1b], al
movzx eax, byte [rsp + rcx + 0x5c]
xor byte [rsp + rcx + 0x1c], al
movzx eax, byte [rsp + rcx + 0x5d]
xor byte [rsp + rcx + 0x1d], al
movzx eax, byte [rsp + rcx + 0x5e]
xor byte [rsp + rcx + 0x1e], al
movzx eax, byte [rsp + rcx + 0x5f]
xor byte [rsp + rcx + 0x1f], al
dec rdx
jne 0x10111e92
lea rcx, [rsp + 0xb0]
call fcn.1012f760
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xb0]
mov r8d, 0x40
call fcn.1012fe70
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xb0]
call fcn.1012ff20
movabs r11, 0x5c5c5c5c5c5c5c5c
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
nop
nop
nop
movzx eax, byte [rsp + rbx + 0x60]
add rbx, 5
xor byte [rsp + rbx + 0x1b], al
movzx eax, byte [rsp + rbx + 0x5c]
xor byte [rsp + rbx + 0x1c], al
movzx eax, byte [rsp + rbx + 0x5d]
xor byte [rsp + rbx + 0x1d], al
movzx eax, byte [rsp + rbx + 0x5e]
xor byte [rsp + rbx + 0x1e], al
movzx eax, byte [rsp + rbx + 0x5f]
xor byte [rsp + rbx + 0x1f], al
dec rdi
jne 0x10111f40
lea rcx, [rsp + 0xb0]
call fcn.1012f760
lea r8d, [rdi + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xb0]
call fcn.1012fe70
lea rdx, [rsp + 0x94]
lea rcx, [rsp + 0xb0]
call fcn.1012ff20
mov rdi, qword [rsp + 0x158]
mov rbx, qword [rsp + 0x148]
lea rcx, [rsp + 0x80]
mov rax, qword [rcx]
mov qword [rsi], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rsi + 0x18], rax
mov rsi, qword [rsp + 0x150]
add rsp, 0x138
ret
Function at 0x10113a50
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
xor r8d, r8d
lea rax, [rcx + 0x10]
mov dword [rcx + 0x400], r8d
mov edx, r8d
mov dword [rax - 0x10], 0x6a09e667
mov dword [rax - 0xc], 0xbb67ae85
mov dword [rax - 8], 0x3c6ef372
mov dword [rax - 4], 0xa54ff53a
mov dword [rax], 0x510e527f
mov dword [rax + 4], 0x9b05688c
mov dword [rax + 8], 0x1f83d9ab
mov dword [rax + 0xc], 0x5be0cd19
xor dword [rax - 8], edx
xor dword [rax - 0x10], 0x2080020
xor dword [rax - 4], 0x20000000
inc edx
mov dword [rax + 0x10], r8d
mov dword [rax + 0x14], r8d
mov dword [rax + 0x18], r8d
mov dword [rax + 0x1c], r8d
mov dword [rax + 0x60], r8d
mov dword [rax + 0x64], r8d
sub rax, 0xffffffffffffff80
cmp edx, 8
jb 0x10113a61
mov dword [rcx + 0x3f4], 0xffffffff
ret